Gately v0.6.3 released

November 2, 2026

Download v0.6.3 · GitHub Release

Performance monitoring (#59)

The new "Performance" module samples the host's CPU, memory, disk and load, plus Gately's own CPU, memory, file descriptors and goroutines, every 5 seconds:

• the page shows trends over 60 seconds / 1 hour / 24 hours, next to the requests in progress, requests per second, 5xx ratio, time to first byte P95 and backend health of running sites; click a site to open its statistics;
• Web sites now measure time to first byte (from receiving the request to sending the response headers), site statistics gain P50 / P95 curves, Prometheus gains gately_site_request_duration_seconds plus the gately_host_* and gately_process_* metrics, and the Grafana dashboard is updated to match;
• an alert rule picks a metric, a comparison and a threshold, then a duration (1 to 1440 minutes); it fires only when the condition holds for the whole duration, and a recovery notification is sent when it clears. The 5xx ratio and latency rules can set a minimum request count, so too little traffic is not judged. Alerts go out through the Notification Center, and the page warns when no notification rule subscribes to them.

History is kept in memory only and starts over after a restart. See Performance.

WAF with SafeLine

A WAF instance can hand requests to your self-hosted SafeLine Community Edition detection engine for semantic analysis, without another reverse proxy in front of or behind Gately:

• enter the detector address (host:port, or unix: plus the path of snserver.sock); "Test connection" sends a heartbeat and a sample SQL injection and shows the round trip and the event ID recorded by SafeLine;
• SafeLine runs before the rule groups, and rule groups may stay empty when only SafeLine is used; "Detect only" mode logs detections without blocking;
• blocks count in the WAF counters, the WAF log (with the event ID), access logs, site statistics and Intrusion Guard;
• you can set the detection timeout (default 1 second), the inspected body limit (default 1024 KB, the rest is forwarded unchanged), and whether requests are allowed or answered with 503 when the engine is unavailable (allowed by default).

See WAF Firewall · Using SafeLine.

Batch operations (#57)

The "Sort" mode of lists becomes "Sort & batch": after checking items you can enable, disable and delete them in one step, and the names are listed for confirmation before deleting. Web Services sites can be checked across listeners to add or remove domains in bulk, replace the suffix of the main domain (old.com → new.com also rewrites www.old.com and *.old.com), and change compression, access logs, CORS, forwarded headers, close on refusal and WAF references in bulk; options you leave unchanged keep each site's own value. The whole batch is validated first and saved once, nothing takes effect if any item fails, and only the affected listeners are reloaded without dropping existing connections. The API consists of the generic PUT <path>-enable and POST <path>-delete plus POST /api/webservice/sites/batch.

STUN: open firewall ports automatically

STUN rules gain "Open firewall port": when enabled, Gately opens the traversal port in this machine's firewall (together with the internal UPnP / NAT-PMP port when one is set) and removes it when the rule stops or is deleted. nftables (OpenWrt fw4, firewalld) and iptables (fw3, ufw) are supported, rules are restored within 30 seconds after a firewall reload, and the rule card shows the result or the reason for a failure. See STUN Traversal.

Fix: issuance failing because of wildcard CNAMEs (#61)

When a domain has a wildcard such as *.example.com pointing to example.com, _acme-challenge also resolves to a CNAME, the DNS-01 validation record was written to @, and the CA reported that it could not find the TXT record. Gately now decides for itself: a CNAME that was set explicitly is still followed, so validation can be delegated to another domain; a CNAME produced by a wildcard is recognized and the record is written to _acme-challenge.<domain>. Certificates also gain the option "Do not follow the CNAME of _acme-challenge". See SSL Certificates.

Web Services logs (#62)

• Access logs record why a request was blocked (ban, IP list, country, rate limit, WAF), and requests that carry a login session of this instance's console record the console user name;
• the log page gains "Hide banned sources" (off by default, so the requests that triggered a ban stay visible for auditing) and "Hide console requests" (on by default); they only affect what is shown, and logs are saved as before;
• the IP filter accepts exclusions starting with ! or -, written as addresses, ranges or partial addresses.

Other improvements

• The network topology gains "Filter": by listener, only nodes with problems, and sites by block reason; masking gains an "Aliases" style that replaces addresses with numbers such as Visitor-01 and Backend-01 (#54);
• the README tour video starts right on the intro card;
• dependency updates: go-jose to v4.1.7 and klauspost/compress to v1.18.7.

Fixes and hardening

• When the backend of a WAF site returns 403 itself, it is no longer treated as a WAF block: it used to add to the block counters and emit a waf.blocked event, so an Intrusion Guard rule subscribed to WAF blocks could ban a regular visitor;
• "Hide console requests" only trusts administrator sessions, so the login cookie of a read-only account cannot be used to mark requests as console requests; blocked requests carry no console mark;
• batch operations limit the number of submitted items before deduplicating, and a batch that sets a WAF instance that does not exist is rejected;
• when several Gately instances run on one host, the firewall rules opened automatically are told apart per instance and do not delete each other.

Upgrade notes

• Docker: pull the new image and recreate the container; when the Docker socket is mounted, Gately can also upgrade itself from its Docker page. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in Settings.