Gately v0.6.3.5 released

November 3, 2026

Download v0.6.3.5 · GitHub Release

Security fixes

• Read-only accounts and read-only API tokens could see the login link of a pending login in the Tailscale status endpoint and in the module logs; anyone holding that link could register this gateway in their own tailnet. Login links are now returned only to identities with write permission on Tailscale, and logs keep only the host part of the link (the new NetBird module treats login links and device codes the same way). (GHSA-xq69-cppr-8497)
• In the Web Terminal, "Test connection" now also has to pass the terms-of-use and two-step verification gate when it tests a saved connection, merges saved secrets or references an authentication preset: such requests send the saved password to the host named in the request.

NetBird networking (#69)

The new NetBird module manages the official client and works like the Tailscale module:

• Gately can run netbird service run itself (state is kept in the config directory) or take over a NetBird service already installed on the system;
• log in with a setup key or a login link / device code, and set a self-hosted management server URL, hostname, routes, DNS, Block inbound, Userspace networking with "Reach local services", and a SOCKS5 proxy;
• when managed, Gately handles the connection, reconnects automatically after the daemon restarts, and retries failures with a backoff from 10 seconds to 5 minutes;
• "Online install" on the page downloads, updates, rolls back and uninstalls NetBird, and "Restore defaults" logs out and clears the login state.

See Networking & Tunnels · NetBird.

Automatic update checks and security alerts (#68)

• By default, Gately anonymously queries the release list and security advisories on GitHub every 12 hours (through the "Update proxy"; it only reads and reports nothing), which can be turned off on the About page or in Settings;
• when a new version is out, the console shows a banner at the top where you can view the changes or skip that version; when the current version is affected by a published security issue, a red banner lists the advisory IDs, severity and fixed versions;
• new versions and security issues emit system.update / system.security events, and the Notification Center gains an "Updates" rule template; the online install cards of frp, cloudflared, Tailscale, NetBird and File Browser gain "Check for updates", and Docker's scheduled checks also send a notification when they find a new image.

See Installation · Automatic update checks and security alerts.

Copying items (#65)

Every list can create a copy based on an existing item: the edit dialog opens with the original as a template and "(copy)" added to the name, while passwords and secrets are carried over from the original on the server, so plaintext never passes through the browser. A certificate copy is issued or loaded again and its deployment targets start disabled so they do not overwrite the original certificate's files; a Web site copy can be placed on another listener, and a listener copy can optionally include its sites. The API is the generic POST <path>/{key}/copy.

Moving Web sites (#63)

• The site's "Listener" field in the edit dialog can now be changed when editing, and saving moves the site to the new listener;
• "Sort & batch" mode gains "Move to listener", which can check sites across listeners and move several at once;
• dragging a site onto a site or group of another listener moves it there.

A move is rejected when the target listener already has the same domain; Performance alert rules and the usage counts of share links follow the site, while login sessions are scoped by listener and site, so visitors need to log in again after a move. Moving a site that requires login from HTTPS to plain HTTP shows a risk warning.

Notifications and proxies (#67)

• The Notification Center gains "Notification settings" with a global notification proxy (none / use the global update proxy / custom), and each channel can choose its own; http://, https://, socks5:// and socks5h:// are supported, and email through a proxy performs STARTTLS / SSL inside the tunnel;
• DDNS / STUN Webhooks, HTTP requests of Scheduled Tasks, subscribed IP lists and GeoIP database downloads can also use a proxy;
• proxy passwords are hidden in cards and error messages.

Other improvements

• Page headers and list toolbars stay visible while scrolling: module headers stick to the top and only the action bar remains once the title scrolls away; toolbars inside cards stick below the header; dialog titles, tab bars and footer buttons stay fixed while the form scrolls in between (#64);
• Docker background tasks such as pull, push, build, update checks, Compose and bulk upgrades can be stopped, and Compose first receives an interrupt signal so it can finish cleanly (#67);
• in the network topology, sites, backends and active IPs open their access logs directly, and sites, backends and listeners can be edited in place on the topology page; Web Services site rows gain a "Logs" button (#67);
• the image is also published to Docker Hub as vanjayak/gately, the same multi-architecture image as on GHCR with the same cosign signature (#67);
• the dialog for a new API token gains an example call to /api/openapi.json (#67);
• manual bans in Web Services and "Close and ban" gain a "Permanent" option;
• "Hide banned sources" also hides the requests that triggered the ban of a source that is still banned;
• read-only accounts no longer see Audit Log, Config History, API Tokens and Settings in the sidebar; opening those pages directly returns to the Overview, and the console no longer calls admin endpoints.

Fixes and hardening

• Batch creation now validates while holding the lock, fixing a data race between new Web Services listeners and IP lists;
• consecutive site moves run in order, so Performance alert rules are not left on a site that no longer exists;
• manual bans reject loopback, unspecified and trusted proxy addresses (manual bans in Intrusion Guard reject loopback and unspecified addresses), and very large ban durations no longer overflow into a permanent ban;
• Docker's scheduled checks keep their notification records while a check fails or the container is stopped, so the same new image is not notified twice;
• NetBird and Tailscale no longer change the permissions of an existing custom state directory when managing the daemon; a warning is shown when NetBird older than 0.75 always listens on 0.0.0.0 for its userspace SOCKS5, and the UI warns when the SOCKS5 listener is on an address beyond this machine;
• viewing the access logs of a named default site from the topology page filters by that site; unnamed default sites no longer offer an entry that would mix in the logs of all sites;
• the clear button of the source filter in runtime logs works again; read-only accounts no longer trigger 403 requests when refreshing admin pages;
• proxy passwords containing unencoded @, / or : are also fully hidden.

Upgrade notes

• Docker: pull the new image and recreate the container; when the Docker socket is mounted, Gately can also upgrade itself from its Docker page. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in Settings.
• Automatic update checks are on by default after the upgrade; turn them off on the About page if you do not need them.