Gately v0.6.1.1 released

October 30, 2026

Download v0.6.1.1 · GitHub Release

Web path probing bans

Intrusion Prevention has a new jail source, Web path probing, which counts requests handled by the web service directly instead of reading logs:

• Limit it to one or more listeners, or leave it empty for all; path rules take wildcards (* also matches /, case-insensitive) or regular expressions starting with ~, and //.env or /a/../.env match through the normalized path as well;
• By default only 404 and 444 count, so requests for pages that exist do not; you can count any status code (together with path rules) or unknown domains only;
• Three templates: Web decoy paths (/.env, /.git, wp-login.php, phpinfo.php, phpMyAdmin and more, banned on the first hit), Unknown domain scans (5 in 1 minute) and Web 404 probing (10 in 1 minute);
• Count, window, ban time, whitelist, escalating bans and nftables sync are shared with other jails, and a ban triggered on any listener applies to all services.

The Probe ban button on a web service listener card preselects that listener and the decoy template; paste request paths into the editor to test the rules. See Intrusion Prevention · Web path probing.

Auth users page

The Web group in the sidebar has a new Auth users page that gathers shared users, the single sign-on domain, self-service password change and the OIDC identity provider, and lists sites by listener with a filter and select-all to choose in bulk which sites accept shared users: selecting a site without authentication also turns on web auth, a site that authenticates only with shared users cannot be cleared there so it never becomes public by accident, and sites using forward auth cannot be selected. Everything is saved together, and nothing is saved if any check fails. The API is GET/PUT /api/webservice/users.

Self-service password change

With Self-service password change on the Auth users page turned on, shared users (including users who sign in to apps through the built-in OIDC provider) can change their password at /__gately_auth/password (/__gately_oidc/password on the issuer domain) after entering the current one and a verification code, and their sessions on all sites end. Shared file users have their own switch on the File shared users page and use the same page; plaintext or bcrypt storage is kept, and WebDAV, FTP and SMB use the new password right away. Failures share the login rate limit and automatic ban, and each account can change its password once a minute. See Web services · Self-service password change.

Close the connection when access is denied

The site's Security tab has a new When denied option: with Close connection, requests rejected by a ban, IP access control (including path rules) or the country filter get no response at all and are logged as 444, so your own IPs can be let in while everyone else is dropped. Rate limiting and WAF blocks are unchanged. The docs now also state what closing cannot do: the TCP and TLS handshakes have completed, HTTP/2 and HTTP/3 only reset the request, and hiding a port from scanners needs an Intrusion Prevention ban.

Cloudflare tunnel routes

With an optional Cloudflare API token on a token tunnel, the Routes button on its card reads and writes the tunnel's remote config: hostname, path regex and service, plus Skip origin TLS verification and the origin Host header, picked up by running cloudflared without a restart. Saving checks the config version so changes made elsewhere are not overwritten, and can create proxied CNAME records for the hostnames, leaving existing records untouched and listing them. See Cloudflare Tunnel · Routes.

Exclude filter in logs

The log viewer has a new Exclude box: entries containing any of its terms are hidden, combined with the keywords. The logs API takes the matching exclude parameter.

Fixes and improvements

• Saving failed when decoy ports or scan detection used a permanent ban (#41);
• Routes: a lone trailing / on a service address is removed (cloudflared rejects services with a path); tunnels managed by a local config file ask for confirmation before saving; a CNAME pointing to the tunnel but not proxied is reported as a conflict; zones are looked up only in the tunnel's account;
• The web service global settings dialog no longer submits shared users and OIDC settings, so it cannot overwrite changes just saved on the Auth users page;
• Path probing matches the path the visitor requested (rewrite rules no longer affect counting), and the access log records it too; very long paths are matched by their beginning and end, and ban reasons escape newlines and other control characters;
• When saving a self-service password change fails, the page shows a generic message and the details go to the log;
• Some multi-paragraph API descriptions mixed Chinese with the translated text.

Upgrade notes

• Docker: pull the new image and recreate the container; OpenWrt: install the new .apk / .ipk over the old one; fnOS: install the new .fpk manually from the app center; other deployments can upgrade online in System settings.
• A saved path probing jail that counts any status code without path rules and without Unknown domains only will be rejected the next time it is edited and saved; add path rules.