v1.6.0

Hosts-table down marker + HTTP/3 chunked-encoding fix. Full changelog: v1.5.2...v1.6.0

v1.5.2 — dependency updates

Routine dependency maintenance. No functional changes.

Changed

• quic-go 0.60.0 → 0.61.0 — the HTTP/3 (QUIC) engine.
• modernc.org/sqlite 1.54.0 → 1.55.0 — the config store.

Verified with the full test suite plus a runtime check that the HTTP/3 listener still binds (tcp+udp) and the store works.

v1.5.1 — moved to the Quicgate organization

The project now lives in its own GitHub organization: Quicgate/quicgate.

Changed

• Container image is now ghcr.io/quicgate/quicgate (:1, :1.5, :1.5.1, :latest). The old ghcr.io/maferick/quicgate path stops receiving updates — repoint your image: to the new one.
• All links updated to the new org. The old maferick/quicgate URL auto-redirects.

No functional changes to the binary.

v1.5.0 — Overview dashboard + Traefik-inspired features

An at-a-glance dashboard, plus four proxy-layer features mined from Traefik's most-reacted enhancement requests.

Added

• Overview dashboard — a new landing page: listeners, config counts (hosts by type, certificates, streams, access lists), health donuts (upstreams, certificates, hosts by type), feature flags, and providers. One GET /api/overview call, vanilla inline-SVG donuts, no chart library.
• Real client IP behind a trusted proxy (Traefik #3097) — behind Cloudflare or another LB, set trusted-proxy CIDRs + a header (Settings) so access lists, GeoIP, rate limits and logs use the real client IP. A rightmost-untrusted X-Forwarded-For walk defeats header spoofing.
• Sticky sessions (#1207/#1035) — per-host cookie affinity across a load-balanced upstream pool. The cookie carries an opaque id, never the upstream address.
• Maintenance mode (#3520) — a per-host toggle that serves a 503 page (with Retry-After and an optional custom body) instead of proxying.
• Response caching (#878) — a per-host TTL that caches cacheable GET/HEAD responses in memory (honouring Cache-Control, skipping Set-Cookie and authenticated requests), with an X-Cache: HIT/MISS header.

Notably, several top Traefik requests are things quicgate already does (UI-driven config, per-host typed timeouts, header variable placeholders).

v1.4.0 — GeoIP confirmation + country picker

Makes GeoIP country rules easy to set up and verify.

Added

• GeoIP status on the Settings page. See at a glance whether the GeoLite2-Country database is loaded (with its type and build date), or the exact path it's expected at and the load error when it's missing. A Recheck button re-opens the file with no restart, and a test-an-IP lookup confirms country resolution actually works.
• Country picker for access rules. Country rules are now chosen from the full list of ISO 3166-1 countries by name (via the browser's Intl API) instead of typing a code, so no more typos. The access-list editor warns when a country rule is used while GeoIP isn't loaded, and codes are validated server-side.

API

• GET /api/geoip/status, POST /api/geoip/reload, GET /api/geoip/lookup?ip=.

v1.3.0 — Multiple Docker hosts + simpler connect model

Builds on the v1.2.0 Docker label provider with multi-host support and a much simpler connect model.

Added

• Multiple Docker hosts. Watch several daemons at once. Configure a JSON list of endpoints (QG_DOCKER_ENDPOINTS, or the Docker hosts box on the Docker page), each with a name, a connect (a local socket path or tcp://host:port), and the address where that host's published ports are reachable. A container on a remote host is reached at that host's IP. The Docker page shows each host's connection state and labels every container with its host.
• The Docker client now speaks tcp:// endpoints in addition to unix sockets, so you can point it at a read-only socket proxy.

Changed

• Simpler connect model. quicgate now always reaches a container at the Docker host's address on its published port (a network_mode: host container at that port directly). The auto / network / published connect-mode and the shared-network container-IP path are gone. quicgate.port still names the container's internal port, so publish the port you want routed.

Reach remote daemons through a read-only socket proxy (e.g. tecnativa/docker-socket-proxy with only CONTAINERS=1 and EVENTS=1) so quicgate never gets write access. See the Docker labels docs.

v1.2.0 — Docker label provider

Derive proxy hosts and TCP/UDP streams from Docker container labels — Traefik's provider idea with a flat label set, no router/service/middleware graph. Opt-in via QG_DOCKER=1 with the daemon socket mounted read-only.

Highlights

• Flat labels: quicgate.enable, quicgate.host, quicgate.port, quicgate.exclude-ports, quicgate.scheme, quicgate.tls-skip-verify, quicgate.tls, quicgate.access-list, and quicgate.streams.
• Streams too: quicgate.streams=25565, 2222:22/tcp, 53/udp exposes non-HTTP ports as L4 forwards. Stream ports are auto-excluded from web-port detection, so a container with a web port and a game/DB port needs no manual excludes. Containers can be HTTP-only, streams-only, or both.
• Reuses named access lists, and QG_DOCKER_DOMAIN derives the hostname from the container name.
• Connect-mode auto / network / published resolves each upstream address, so it works whether quicgate runs on a bridge network or network_mode: host.
• Manual hosts always win a naming conflict; derived routes are never persisted (re-derived from live containers).
• Docker page shows every container with the exact reason it is or isn't routed, plus one-click Convert to host to graduate a container to editable configuration.
• Read-only stdlib Docker client (list / inspect / events), zero new dependencies.

Opt-in and dormant until enabled, so upgrading changes nothing until you set QG_DOCKER=1 and mount the socket. See the Docker labels docs.

v1.1.1

Patch release: an in-app Help & FAQ page (the ? icon in the top bar) with common recipes and concepts — access-list evaluation, the GET-from-everywhere pattern, hosts vs streams, certs/HTTP-3, admin-port safety, API tokens. Embedded, works offline.

v1.1.0

Minor release.

• Streams: reuse an access list as the source filter — pick a list instead of retyping CIDRs.
• Method-scoped access rules: clickable verb chips replace the free-text box.

Pin ghcr.io/maferick/quicgate:1 to ride the 1.x line. Full notes in CHANGELOG.md.

v1.0.0

quicgate v1.0.0 — first public release.

A single-binary reverse-proxy manager: the Nginx Proxy Manager workflow on a native Go engine (HTTP/1.1/2/3), automatic Let's Encrypt, and every advanced option as a typed, validated setting instead of a free-text config blob. Running a ~50-host homelab in production.

Install

services:
  quicgate:
    image: ghcr.io/maferick/quicgate:1   # pin :1 for the 1.x line, or :latest for newest
    restart: unless-stopped
    network_mode: host
    environment:
      - QG_ACME_EMAIL=you@example.com
    volumes:
      - ./data:/data

Multi-arch (amd64 + arm64). First login admin@example.com / changeme (forced change). Don't expose the admin port to the internet.

Highlights

• Proxy / redirect / 404 / static hosts, wildcard domains, load-balanced pools + health checks, custom locations & path rewrites
• Auto Let's Encrypt (HTTP-01), DNS-01 wildcards, custom/self-signed/from-file certs, custom ACME CAs, mTLS, HTTP/3
• Access lists: CIDR / dynamic-DNS / GeoIP + per-rule HTTP-method scoping, forward-auth, rate limiting, auto-ban; CORS preflight handled
• TCP/UDP streams (PROXY protocol, SNI passthrough, TLS termination) + UPnP router forwards
• JSON access logs + viewer, Prometheus metrics, backup/restore, declarative import
• Hardened admin: strict CSP, CSRF guard, 2FA, API tokens, OIDC/LDAP; runs fully offline (no runtime CDN)

Full notes in CHANGELOG.md.