Gately v0.6.0.4 released

October 29, 2026

Download v0.6.0.4 · GitHub Release

LuCI app for OpenWrt

Each release now also ships an architecture-independent LuCI app, luci-app-gately_v0.6.0.4_openwrt_all.ipk / .apk. Install it after Gately and LuCI gains a Services → Gately page:

• see the running state, PID, version, memory usage, start at boot, admin address and configuration directory;
• start, stop and restart the service, and enable or disable start at boot;
• open the Gately admin interface in one click, with the safe entrance from the global settings already in the link; a notice appears when the admin interface only listens on loopback or "LAN access only" is on;
• set the admin interface port. It is stored in /etc/config/gately and only replaces the port of the listen address in the global settings, while a setting that listens on loopback or a LAN address only stays unchanged. If a port conflict or a wrong port makes the admin interface unreachable, change it back here; leave it empty to follow the global settings.

The app follows the LuCI language setting, supports 10 languages and has been tested on OpenWrt 24.10 (opkg) and 25.12 (apk). See Installation · LuCI app for the steps.

Redirect site variables

Besides {host}, the target of a redirect site can now use:

• {path} / {PATH} and {args} / {Args}: the original request path and query string. With "Keep path" on, the part you wrote in the target is no longer appended again;
• {port}, {hostAndPort}, {domainPartN}, {pathPartN}, {ClientIP}, {RemoteIP} and {time};
• {1}: the part matched by * in a site domain such as *.example.com;
• {STUN_RuleName_PORT} / _IP / _ADDR: the current public address of a STUN Traversal rule. When the port changes the site needs no edit, because the next request goes to the new port. If the rule is disabled, has not traversed yet or is retrying, the site returns 503 and the runtime log records why.

For example, a CDN-fronted *.example.com can redirect to https://{1}.v4.example.com:{STUN_web_PORT}{path}{args}. Saving checks the target with sample values. At request time, a redirect whose expanded target has no host returns 503, and a visitor host containing characters that never appear in a domain, such as &, = or /, returns 400, so visitors are never sent to another site. Redirects with such variables in imported configurations used to make the whole listener be skipped because the address failed validation; they now import normally. See Web Services · Redirect variables.

Shared users and OIDC clients as summaries

In "Web Services → Global settings", shared users and OIDC clients are now one summary row each. A shared user shows the username, TOTP and password state, groups, display name, email and remark. An OIDC client shows the name, confidential or public type, a copyable Client ID, the number of redirect URIs, allowed users and remark, and a new secret that is not saved yet or a missing redirect URI is flagged separately. Click "Edit" or "Add" to change all fields in a dialog; changes are written back only on "OK", and "Cancel" discards them. A username cannot be empty or duplicated, and a Client ID must be filled in and unique.

Upgrading

• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one, and install luci-app-gately as well if you want the LuCI page. fnOS: install the new .fpk in the App Center. Other installs can upgrade online in Settings.