Gately v0.6.5 released

November 6, 2026

Download v0.6.5 · GitHub Release

Backend timeouts, visitor timeouts and automatic retry

• The Traffic tab of reverse proxy sites gets Backend timeouts: connect, TLS handshake and response header, defaulting to 10 seconds, 10 seconds and no limit. A response header timeout returns 504 and does not affect downloads or long connections such as WebSocket and SSE afterwards.
• When a backend cannot be reached (connection refused, unreachable or connect timeout), the same request moves to the next backend at once, trying up to 3 backends per request; the request has not been sent yet at that point, so this is safe for POST and other requests too.
• Visitor timeouts limit idle time while reading the request body and writing the response, 60 seconds by default, to drop visitors that send or read extremely slowly; a request body read timeout returns 408.
• nginx import turns proxy_connect_timeout and proxy_read_timeout into the site's connect and response header timeouts.

See Backend timeouts and Visitor timeouts.

Passing identity to the backend

The separate "Pass user name" and "Pass email" settings become one Pass identity list, where each row writes one field of the signed-in user into a request header: user name, email, display name or groups. Apps that use email as the account, such as Firefly III, can read Remote-Email directly. Copies of these headers sent by visitors, including variants with underscores instead of hyphens, are removed before authentication and cannot be forged, and visitors cannot get them dropped through the Connection header either. Existing settings are converted on upgrade. See Pass identity.

Opening firewall ports automatically

Web Services listeners and the rules of Port Forwarding and Protocol Routing get an Open firewall port switch that allows only the ports actually listened on in the local firewall (nftables, iptables or ip6tables), with IPv6 and port ranges, merging consecutive ports into one rule; listeners with HTTP/3 also open the UDP port with the same number, and listeners on loopback addresses need nothing. The rules are removed when the listener stops or is deleted. See Open firewall port.

Run logs

• Web Services access logs are split by day and compressed, with retention days and a total size limit, so past traffic can still be searched; Load earlier logs looks into the archives.
• The log toolbar gets Export, which downloads every entry matching the current filters, including the history in log files and archives, as CSV (UTF-8 with BOM for Excel, guarded against formula injection) or JSON Lines; exports by read-only accounts hide passwords and tokens in addresses just as the viewer does.
• Settings → Runtime gets Log directory, to keep run logs in another directory such as one on an external disk.
• The Source filter lists every source; logs of IPv4 and IPv6 listeners with the same name are no longer mixed, and a site's Logs window shows only its own listener's visitors.
• Logs are written to disk as soon as 256 KB are waiting, so busy sites no longer lose access log entries; on phones the log viewer opens at the newest entry again.

See Run logs.

Guard: IPv6 strict mode

Port scan detection gets IPv6 strict mode: IPv6 sources may only connect to open ports (listening ports plus the extra open ports), and the first connection to any other port bans their /64; IPv4 keeps the threshold. A port that stops listening for a moment still counts as open for 30 seconds, and the FTP service's passive port range counts as open automatically. See Guard.

Managed process resources

The Overview page gets a Managed processes card, and the Performance page lists the CPU and memory of each external program Gately manages (frpc / frps, tailscaled, NetBird, cloudflared, File Browser), with curves that continue across restarts. See Performance.

Other improvements and fixes

• Site links: when a listener is only reachable through Protocol Routing or Port Forwarding, site links use the rule's entry port, for example 4433 for a listener on 4435 fed by an SNI rule on 4433; a manually set access port still wins.
• The network topology gets Active only, showing just the sites and backends with requests or active IPs in the last 60 seconds; active nodes are no longer folded into "N more".
• Network self-check: an occasional local DNS timeout no longer reports a correctly resolving DDNS record as unresolved; public DNS is used to double-check.
• DDNS: syncs cancelled because a task stops or restarts no longer log errors or mark records as failed.
• TLS handshake failures caused by scanners are logged at debug level, so they no longer flood the run log; redirect sites whose target uses variables such as {host} answer requests without a Host header with 400.
• Guard writes its ban table in a compact format, and bans that merely expire no longer trigger a rewrite.
• Imported reverse proxy settings keep the HTTP/3 setting of listeners.
• The sign-in page no longer shows the default account and the reset-password hint.
• Web Terminal: the file manager's editor opens again after being closed with the X or Esc; on phones, Copy in select mode works after dragging the selection up past the top of the screen.
• UI: site rows no longer squeeze domains into a narrow column on tablets and small laptops; IPv6 listen addresses are shown as http://[::1]:18951.