Gately v0.6.6.6 released

November 15, 2026

Search: the search box at the top of the visitor page lets visitors choose a search engine (up to 12, with common presets built in; use {q} in the address for the keyword). Enter searches in a new tab, and typing still filters the links on the page. A default search scope can be set.
Sign-in only: a link can be made visible after sign-in only. Its name and address are not sent in the page to visitors who have not signed in, and it is shown with a lock mark after sign-in. The site must have web authentication enabled with "Require authentication only for paths marked "Required" below; all other paths are public" selected. Visitors using a share link do not count as signed in.
Background image: enter an image address or upload an image (up to 1 MB), and adjust blur and overlay. Uploaded images are served on a separate path and can be cached. Visitors can also switch to their own background, blur and overlay in the page settings.
Cards and groups: link cards come in a large and a small size, with an optional title and description. Groups can be collapsed, and visitors can turn on a "Frequent" group of the links they open most.
Page information: custom tab title, tab icon, page description and footer.
Visitor language and user menu: visitors can switch the language on the page (stored in a cookie); after sign-in a user menu is shown and signing out asks for confirmation.

See Web Services for details.

Dynamic DNS

New DNS providers: Tencent Cloud EdgeOne, Alibaba Cloud ESA, Baidu Cloud, Volcano Engine, DNS.LA, Rainyun, HiPM DNSMgr, Eranet / Tnet.hk, Vercel, NameSilo, Dynadot (existing records only), Spaceship, Name.com, Gcore, ClouDNS and deSEC. Tencent Cloud EdgeOne also supports certificate DNS validation and deleting provider records.
TTL: with TTL set to 0, new records use the provider default; on update, depending on the provider, the existing TTL is kept or the default is used, and the TTL of existing records is no longer changed.
Cloudflare: the extra field "Proxy status" synchronizes the proxy status of existing records when set to true / false and leaves it unmanaged when empty; records with the proxy on always use automatic TTL. When several records share the same name and type, one is kept and set to the target value, and the others holding old values are deleted.
Other: domains under multi-level public suffixes such as com.ar and org.br are split using the public suffix list; custom callbacks support the {timestamp} variable, and {ttl} is 600 when no TTL is configured; dynv6 updates the root domain address through the zone; Alibaba Cloud only operates on the default line when no line is specified.

See Dynamic DNS for details.

Trusted sources: trusted sources registered by modules no longer trigger decoy port and port scan detection (both the nftables and iptables backends support this); log rules, manual bans and access control still apply.
frps: the source address of a frpc that signs in with the correct token becomes a trusted source. When another device behind the same home broadband exit performs TCP hole punching, the frpc is no longer banned along with it for being judged a port scan. It stays valid for 10 minutes after the sign-in or while the connection to frps is kept; once the connection drops, a new sign-in is needed. It is revoked when frps stops or the token or listening port changes.

Admin sign-in bypass across parent domains: the administrator now starts a one-time ticket handshake by opening /__gately_auth/admin-start on the site (optionally with ?next=/path), and ordinary visitors are no longer redirected to the admin entry address. Saving this address as a bookmark is recommended.
Response cache: requests that carry only Gately's own sign-in cookie can be cached again. Previously, once a single sign-on domain or web authentication was enabled, every signed-in request carried a cookie and the cache stayed empty. Other cookies, session cookies issued by other instances and authentication request headers still skip the cache.

Docker: pull the new image and recreate the container; OpenWrt: install the new .apk / .ipk over the old one; fnOS: install the new .fpk in the App Center; other installs can upgrade online from System Settings.
Administrators who use admin sign-in bypass across parent domains need to open /__gately_auth/admin-start on the site once after the upgrade to complete a handshake.
Several same-name, same-type records with old values in a Cloudflare Dynamic DNS task are merged into one at the next sync.