Releases: kilo666mj/tlsgate
Release list
v0.8.0
Full Changelog: v0.7.0...v0.8.0
v0.7.0
TLSGate v0.6.0
TLSGate v0.6.0 adds per-route policies, allowing one process to enforce strict mail filtering while enrolling HTTPS clients and forwarding PROXY v2 only to backends that support it.
Changes
- Override global defaults with
--route LISTEN=BACKEND,allow-unknown=true|false,proxy-protocol=off|v2. - Configure the same overrides through Ansible route entries and inspect effective policies with
tlsgate doctor. - Log Gatehub trusted ranges on the initial load and actual range changes. Repeated, reordered, or duplicate ranges no longer produce recurring update messages.
- Add integration coverage for mixed route policies, shared fingerprint decisions, and backend PROXY framing.
- Includes cleanup/error-handling improvements and CI updates since v0.5.0.
Example
tlsgate serve --fingerprint ja4 \
--route '[::]:993=127.0.0.1:10993' \
--route '[::]:465=127.0.0.1:10465' \
--route '[::]:443=127.0.0.1:1443,allow-unknown=true,proxy-protocol=v2'Upgrade notes
Existing route syntax and global defaults remain supported. This release requires no new database migration or fingerprint reset when upgrading a correctly initialized v0.5.0 database. For older releases, follow the v0.5.0 format migration instructions.
Routes share the database, Gatehub decisions, trusted-source exemptions, and connection limits. Observation mode permits pending fingerprints but does not override explicit blocks. Fingerprints remain a noise filter, not device authentication.
Changing route command-line settings requires a service restart; graceful binary reloads retain existing arguments. Enable PROXY protocol only for backend listeners configured to accept it.
Artifacts
Static Linux binaries for amd64 and arm64 and SHA256SUMS are attached. The container image is ghcr.io/kilo666mj/tlsgate:0.6.0 (amd64/arm64).
Validation: go test -race ./..., go vet ./..., golangci-lint (0 issues), Ansible syntax and route-template checks, and production HTTPS/IMAPS/SMTPS checks. The logging update was also verified through a graceful reload with an established IMAPS session remaining connected.
TLSGate v0.5.0
Security fixes
- Reject pending fingerprints from untrusted sources in strict mode, including fingerprints first seen during enrollment or on trusted sources.
- Require verified implicit TLS for SMTP notifications; reject plaintext and opportunistic STARTTLS configurations.
- Cap persistent alert deduplication at the latest 10,000 range/IP pairs, including concurrent writers. Evicted pairs may alert again.
- Correct JA3 GREASE filtering and JA4 ALPN encoding; quote fingerprint fields in logs.
- Upgrade Gatekit to v0.5.0 for bounded metadata/history, paginated sync, and redirect rejection. Apply max_fingerprints transactionally to new observations.
Required upgrade steps
Existing fingerprint databases require an explicit reset and re-enrollment. Stop all old serving processes sharing the database, back it up, review existing decisions, and reconcile old Gatehub decisions before resuming sync. Do not use a SIGHUP handoff across this fingerprint-format transition. Reset with tlsgate reset --db PATH --fingerprint ja3 (or ja4), then start the new binary with the same method and re-enroll clients. Alternatively, serve --reset-fingerprints explicitly allows the incompatible-format reset; remove that flag after transition. Reset deletes fingerprint decisions and history. Rollback requires the pre-upgrade database backup.
SMTP notification URLs must explicitly specify encryption=ImplicitTLS and use an implicit TLS listener, typically port 465. Omitted/Auto, None, and ExplicitTLS settings are rejected.
Gatekit trims excess existing observation history and clears oversized metadata on database open. Back up before upgrading if complete history must be retained.
See upgrade instructions and the security audit with resolutions.
Artifacts
Static Linux binaries for amd64 and arm64, with SHA256SUMS. Container image: ghcr.io/kilo666mj/tlsgate:0.5.0.
Publishing this release does not deploy it to running hosts.
v0.4.0
tlsgate v0.3.0
Highlights
- Add opt-in backend PROXY protocol v2 support with
--proxy-protocol v2. - Preserve the original TLS stream byte-for-byte after the PROXY header.
- Support IPv4 and IPv6 source and destination addresses.
- Add Ansible configuration and nginx setup documentation.
- Upgrade to Gatekit v0.4.0 for timestamped per-IP and per-port fingerprint sightings.
PROXY protocol remains disabled by default. Enable it only when every configured backend listener expects PROXY v2.
What's Changed
- Stamp the deployed version by @kilo666mj in #42
- Hand off instead of restarting on deploy by @kilo666mj in #44
Full Changelog: v0.2.0...v0.3.0
Contributors
Assets 5
v0.2.0
What's Changed
- Add Porter artwork to README by @kilo666mj in #26
- Add tlsgate service mark to README by @kilo666mj in #27
- Use tlsgate mark in README by @kilo666mj in #28
- Refresh tlsgate service mark with clean gateway icon by @kilo666mj in #29
- Add Porter v2 artwork to README by @kilo666mj in #30
- Link Porter artwork to Gatehub by @kilo666mj in #31
- Cap Gatehub observation values by @kilo666mj in #32
- Update ghcr.io/kilo666mj/tlsgate:latest Docker digest to 6671327 by @renovate[bot] in #33
- Update dependency go to v1.26.5 by @renovate[bot] in #34
- Update golang Docker tag to v1.26.5 by @renovate[bot] in #35
- Update module modernc.org/sqlite to v1.55.0 by @renovate[bot] in #36
- Update actions/setup-go action to v7 by @renovate[bot] in #37
- Open renovate PRs on detection, not on a schedule by @kilo666mj in #38
- Set the go directive to 1.26.5 by @kilo666mj in #40
- Move the fingerprint store and sync client to gatekit by @kilo666mj in #41
Full Changelog: v0.1.6...v0.2.0
Contributors
Assets 5
v0.1.6
What's Changed
- Pin dependencies by @renovate[bot] in #15
- Update dependency go to v1.26.4 by @renovate[bot] in #16
- Update Go Docker base image to v1.26.4 by @renovate[bot] in #17
- Update Go module updates to v1.52.0 by @renovate[bot] in #18
- Allow Renovate to open major update PRs by @kilo666mj in #19
- Update Go Docker base image by @renovate[bot] in #20
- Update Go Docker base image by @renovate[bot] in #21
- Add launch video to README by @kilo666mj in #24
- Update Go module updates to v1.53.0 by @renovate[bot] in #22
- Update actions/checkout action to v7 by @renovate[bot] in #23
- Add gatehub control plane sync by @kilo666mj in #25
New Contributors
Full Changelog: 0.1.6...v0.1.6
What's Changed
- Pin dependencies by @renovate[bot] in #15
- Update dependency go to v1.26.4 by @renovate[bot] in #16
- Update Go Docker base image to v1.26.4 by @renovate[bot] in #17
- Update Go module updates to v1.52.0 by @renovate[bot] in #18
- Allow Renovate to open major update PRs by @kilo666mj in #19
- Update Go Docker base image by @renovate[bot] in #20
- Update Go Docker base image by @renovate[bot] in #21
- Add launch video to README by @kilo666mj in #24
- Update Go module updates to v1.53.0 by @renovate[bot] in #22
- Update actions/checkout action to v7 by @renovate[bot] in #23
- Add gatehub control plane sync by @kilo666mj in #25
New Contributors
Full Changelog: 0.1.6...v0.1.6
Contributors
Assets 5
v0.1.5
What's Changed
- approve_ranges bypass, CLI display sanitization, root warning by @kilo666mj in #12
Full Changelog: v0.1.4...v0.1.5
Contributors
Assets 5
v0.1.4
What's Changed
- Add --register to approve and block by @kilo666mj in #10
- gofmt main_test.go by @kilo666mj in #11
Full Changelog: v0.1.3...v0.1.4