v0.5.7

Highlights / 亮点

SMB share mounts / SMB 共享挂载 (#14)

• Storage Mounts can point to a Windows share, NAS or Samba server with smb://host[:port]/share[/subdir] over SMB2/3, with a username, password and optional domain or workgroup; an empty username connects as guest. / 存储挂载可用 smb://主机[:端口]/共享名[/子目录] 连接 Windows 共享、NAS 与 Samba（SMB2/3），支持用户名、密码与可选的域或工作组，用户名留空时以来宾连接。
• SMB mounts work in the online file manager and as scheduled backup targets; the connection opens on first use and reconnects after the server drops it, and wrong credentials or a missing share give a clear error. / 与本地、WebDAV 挂载一样支持在线文件管理与定时备份目的地；首次使用时连接，断开后自动重连，凭据错误或共享不存在时给出明确提示。
• The sidebar group Network Storage is now File Services, with Storage Mounts (Gately connecting to storage) and WebDAV Service / FTP Service (Gately sharing directories); API paths are unchanged. / 侧边栏「网络存储」改为「文件服务」，包含「存储挂载」（Gately 连接存储）与「WebDAV 服务」「FTP 服务」（Gately 共享目录）；API 路径不变。

Themes / 主题

• 15 palettes, Gately originals plus GitHub, Nord, Dracula, Catppuccin, Tokyo Night, Gruvbox, Rosé Pine and Solarized, each with light and dark; light, dark or follow system. / 15 个色系（原创 + GitHub、Nord、Dracula、Catppuccin、Tokyo Night、Gruvbox、Rosé Pine、Solarized），各有亮暗两版，可选亮色、暗色或跟随系统。
• Custom accent (10 presets or any color) that the logo and login gradient follow, and sharp, palette or round corners; previous theme choices are migrated automatically. / 自定义主色（10 种预设或任意颜色），Logo 与登录页渐变随之变化；圆角可选直角、跟随色系或圆润；旧主题自动迁移。
• The Web terminal follows the interface theme by default, and the container terminal uses the same preference. / Web 终端配色默认跟随界面主题，容器终端使用同一偏好。

Faster and lighter / 更快、更省流量

• The management interface is compressed with br / gzip and its assets are precompressed (850 KB main script → about 270 KB); the binary is about 11% smaller. / 管理界面使用 br / gzip 压缩，静态资源预压缩（850 KB 主脚本约 270 KB）；程序缩小约 11%。
• Page refreshes pause in background tabs; log cards fetch the latest 200 entries first with Load earlier logs, and the log API gains limit and before; the DDNS page loads in one round trip. / 后台标签页暂停定时刷新；日志卡片先拉最近 200 条并可加载更早日志，日志接口新增 limit 与 before；DDNS 页一次往返加载。

Fixes / 修复

• Web service sites with compression enabled re-compressed gzip responses from the upstream over plain HTTP, so browsers got garbled content. / 开启压缩的 Web 服务站点经 HTTP 访问时，上游已 gzip 的响应被再压一次，浏览器收到乱码。
• Intrusion Prevention counters reset after saving settings or restarting the module. / 入侵防护的计数在保存设置或模块重启后归零。
• Open popups no longer let the page below scroll; retrying right after a failed online upgrade no longer reports "upgrade in progress". / 弹出菜单打开时下方页面不再滚动；在线升级失败后立即重试不再提示「升级进行中」。

Upgrading / 升级

• Linux binary installs upgrade from the About page; Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / Linux 二进制在「关于」页直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• The configuration format is unchanged. / 配置格式没有变化，可直接升级。

Release notes: https://gately.cn/en/news/v0.5.7 · 更新说明：https://gately.cn/news/v0.5.7

v0.5.6.4

Features / 新功能

• Certificate auto deploy gains Copy to local directory: add any number of local directories, each with its own "Run after copying" command. After a certificate is issued, renewed or updated it is copied and the commands run; failures retry hourly and send a "Certificate: deployment failed" notification. Files deleted or changed in a target directory are copied again on the next check. (#13) / 证书自动部署新增「复制到本机目录」：可添加任意多个本机目录，每个目录有自己的「复制后执行」命令。证书签发、续期或更新后自动复制并执行命令，失败时每小时重试并发出「证书：部署失败」通知；目标目录中的文件被删除或改动后，下一次检查会重新复制。（#13）
• Custom file names for local directory and SSH targets: set names for the certificate (full chain) and private key, such as fullchain.pem and privkey.pem, to write only those two files. $certFile / $keyFile in the command point to them. Left empty, the usual <remark>.crt/.pem/.key are used. (#13) / 本机目录与 SSH 部署目标支持自定义文件名：填写证书（完整链）与私钥的文件名，例如 fullchain.pem、privkey.pem，填写后只写入这两个文件，命令中的 $certFile / $keyFile 指向它们；留空时沿用 <备注>.crt/.pem/.key。（#13）

Upgrading / 升级

• The existing "Certificate mapping" is unchanged. Existing SSH and Docker deployment targets are not redeployed after upgrading. / 原有「证书映射」保持不变；已有的 SSH 与 Docker 部署目标升级后不会重新部署。
• When Gately runs in Docker, local directories and commands are inside the container, so mount the target directories into it. / Gately 运行在 Docker 中时，本机目录与命令都在容器内，需要把目标目录挂载进容器。
• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one. Other installs can upgrade online in Settings. / Docker 拉取新镜像后重建容器；OpenWrt 覆盖安装新的 .apk / .ipk；其他部署方式可在「系统设置」中在线升级。

Release notes: https://gately.cn/en/news/v0.5.6.4 · 更新说明：https://gately.cn/news/v0.5.6.4

v0.5.6.3

Fixes / 修复

• OpenWrt's LAN bridge br-lan (and br-wan) is shown on the overview again; only Docker network bridges (br- plus 12 hex digits) are hidden. On a bypass router the overview previously listed no LAN address at all. (#12) / 概览重新显示 OpenWrt 的局域网网桥 br-lan（以及 br-wan），只隐藏 Docker 自定义网络的网桥（br- 加 12 位十六进制）；之前旁路由部署时概览看不到任何局域网地址。（#12）
• The time zone database is built in, so zones such as Asia/Shanghai can be saved in Settings on systems without /usr/share/zoneinfo. (#12) / 内置时区数据库，没有 /usr/share/zoneinfo 的系统上也能在设置里保存 Asia/Shanghai 等时区。（#12）
• On OpenWrt, Gately follows the system time zone (zonename in /etc/config/system, or /etc/TZ) when none is set in Settings, so log and notification times are no longer in UTC. (#12) / OpenWrt 上未在设置里指定时区时，自动使用系统时区（/etc/config/system 的 zonename，或 /etc/TZ），日志与通知时间不再按 UTC 计算。（#12）

Upgrading / 升级

• OpenWrt: install the new .apk / .ipk over the old one. Docker: pull the new image and recreate the container. Other installs can upgrade online in Settings. / OpenWrt 覆盖安装新的 .apk / .ipk；Docker 拉取新镜像后重建容器；其他部署方式可在「系统设置」中在线升级。
• After changing the system time zone in LuCI, restart Gately. A zone set in Gately's Settings takes priority. / 在 LuCI 修改系统时区后需重启 Gately；Gately 设置中指定的时区优先。

Release notes: https://gately.cn/en/news/v0.5.6.3 · 更新说明：https://gately.cn/news/v0.5.6.3

v0.5.6.2

Improvements / 改进

• Redesigned visitor pages: the login page of sites with web authentication, the 404 / 502 error pages and the page shown for a wrong security entrance of the admin console now share one card design that follows the system light or dark theme. Non-browser requests still get plain text. / 访客页面重新设计：开启网页认证的站点登录页、404 / 502 错误页，以及管理后台输错安全入口时的提示页，换成统一的卡片式设计，随系统切换浅色与深色；非浏览器请求仍返回纯文本。
• Two-step verification for Web service shared users moves to a popup: after the password is accepted, a code dialog opens on the same page and submits at 6 digits. The username and password are no longer cleared when a code is needed, and a wrong password keeps the username. / Web 服务共享用户的两步验证改为弹窗：密码通过后在原页面弹出验证码框，输满 6 位自动提交；需要验证码时不再清空已填的用户名和密码，密码输错也会保留用户名。

Fixes / 修复

• Docker 29 support: the Docker module negotiates the Engine API version instead of pinning 1.41, which Docker 29 rejects. / 支持 Docker 29：Docker 模块改为协商 Engine API 版本，不再固定使用 Docker 29 已不接受的 1.41。
• Opening the admin UI without a session goes straight to the login page instead of flashing the overview first. / 未登录打开管理界面时直接进入登录页，不再先闪现总览页。
• Cloudflare uses Global API Key auth only when the ID is an email, so credentials imported from Lucky (API token plus a stale ID) no longer fail with 6003. / Cloudflare 仅在 ID 为邮箱时使用 Global API Key，从 Lucky 导入的凭据（API Token 加残留 ID）不再报 6003。
• DDNS records whose domain, type, line or TTL changed are synced again after saving instead of inheriting the old sync state. / 改了域名、类型、线路或 TTL 的 DDNS 记录保存后会重新同步，不再沿用旧的同步状态。

Upgrading / 升级

• Docker: pull the new image and recreate the container. Other installs can upgrade online in Settings or install the new package over the old one. / Docker 拉取新镜像后重建容器；其他部署方式可在「系统设置」中在线升级，或覆盖安装新安装包。

Release notes: https://gately.cn/en/news/v0.5.6.2 · 更新说明：https://gately.cn/news/v0.5.6.2

v0.5.6.1

Fix / 修复

• The v0.5.6 Docker image shipped nftables 1.1.5. Since 1.1.2, nftables writes set metadata that older releases cannot parse, so an nft older than 1.1.1 on the host (for example 1.0.6 on Debian 12 and fnOS) crashed on nft list ruleset once Gately created its inet gately table. The image now pins nftables 1.1.1; after upgrading, Gately rebuilds the table on start and the host's nft works again. fnOS / OpenWrt packages and binary installs use the system's nft and are not affected. / v0.5.6 的 Docker 镜像内置 nftables 1.1.5。nftables 从 1.1.2 起会在集合上写入旧版不认识的元数据，Gately 创建 inet gately 表后，宿主机上 1.1.1 之前的 nft（如 Debian 12、飞牛 fnOS 的 1.0.6）执行 nft list ruleset 会崩溃。镜像现已固定为 nftables 1.1.1，升级后 Gately 启动时重建该表，宿主机 nft 恢复正常。飞牛 / OpenWrt 安装包与二进制部署使用系统自带的 nft，不受影响。

Upgrading / 升级

• Docker: pull the new image and recreate the container. Other installs can stay on v0.5.6. / Docker 拉取新镜像后重建容器；其余部署方式可继续使用 v0.5.6。

See v0.5.6 for the Intrusion Prevention release notes. / 入侵防护的完整说明见 v0.5.6。
Release notes: https://gately.cn/en/news/v0.5.6.1 · 更新说明：https://gately.cn/news/v0.5.6.1

v0.5.6

Highlights / 亮点

Intrusion Prevention (fail2ban-style) / 入侵防护（类 fail2ban） (#10)

• Log jails read log files (following rotation), the systemd journal, command output such as logread -f on OpenWrt, or Docker container logs, find failures with regular expressions and <HOST>, and ban an IP that reaches the count within the time window. Templates for SSH, Dropbear, Nginx, Vaultwarden, Home Assistant, Proxmox VE and more, anchored so user-controlled fields cannot inject another IP; paste sample lines into the editor to test. / 日志规则读取日志文件（自动跟随轮转）、systemd 日志、命令输出（如 OpenWrt 的 logread -f）或 Docker 容器日志，用正则与 <HOST> 找出失败记录，同一 IP 在统计窗口内达到次数即封禁。内置 SSH、Dropbear、Nginx、Vaultwarden、Home Assistant、Proxmox VE 等模板，均锚定行尾，用户名等字段无法注入其他 IP；编辑时可粘贴日志样例测试。
• Failed admin console logins and WAF blocks can feed a jail without any regular expression. / 管理后台登录失败、WAF 拦截也能作为规则来源，不用写正则。
• Trap ports ban any source that connects to ports this host does not use; port-scan detection bans sources that hit closed ports more often than the threshold per minute. / 诱饵端口：连接本机未使用端口的来源立即封禁；端口扫描检测：每分钟连接未开放端口超过阈值即封禁。
• One ban list for manual bans (CIDR networks and permanent bans), the web service's failed-auth bans and everything above; persisted, escalating durations for repeat offenders, and a whitelist that ignores LAN, loopback, 100.64.0.0/10 and this host's IPv6 /64 networks by default. / 统一封禁表：手动封禁（支持网段与永久）、Web 服务认证失败封禁与上述来源都在这里，重启保留，重复违规时长翻倍；白名单默认忽略内网、回环、100.64.0.0/10 与本机所在的 IPv6 /64。
• Bans are written to a separate inet gately table in nftables and dropped in the kernel, including traffic forwarded to Docker containers and LAN devices; replies to connections the host opens itself still get through; the table is removed when Gately stops and rewritten if another program deletes it. Port forwarding, web services, STUN, WebDAV, FTP and the admin console also reject banned addresses. / 封禁写入 nftables 中独立的 inet gately 表并在内核层丢弃，发往 Docker 容器与内网设备的转发流量同样拦截；本机主动发起连接的回包不受影响；Gately 停止时删表，被其他程序删除后自动重写。端口转发、Web 服务、STUN、WebDAV、FTP 与管理后台也直接拒绝被封地址。
• Where nftables is unavailable (Windows, macOS, FreeBSD, Linux without nftables or permission), bans apply to Gately's own services, trap ports fall back to user-space listeners and scan detection is off; the page explains why. / 没有 nftables 或权限的平台：封禁只对 Gately 自身的服务生效，诱饵端口改由 Gately 监听，扫描检测不可用，页面会说明原因。
• New “Intrusion Prevention: IP banned” event, overview summary, Prometheus metrics and self-check results. / 新增「入侵防护：IP 已被封禁」事件、总览摘要、Prometheus 指标与自检项。

Other / 其他

• Docker settings show the Docker daemon's own registry mirrors (registry-mirrors in daemon.json). / Docker 设置显示 Docker 守护进程自己的镜像加速地址。(#11)
• Fixed turning on scheduled backups failing with unknown field "hasPassword". / 修复开启定时备份时报 unknown field "hasPassword"。(#9)

Upgrading / 升级

• Linux binary installs upgrade from the About page; Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / Linux 二进制在「关于」页直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• Docker: add cap_add: [NET_ADMIN] (with network_mode: host) for firewall-level bans; the image now ships nftables. / Docker 需在 compose 中加入 cap_add: [NET_ADMIN]（并使用 host 网络）才能在防火墙层封禁，镜像已内置 nftables。
• Linux instances running as root create the inet gately table after upgrading; with no bans it holds only empty rules. Turn sync off under Intrusion Prevention → Settings, or disable the module, if you do not want it. / 以 root 运行的 Linux 升级后会自动创建 inet gately 表，没有封禁时只有空规则；不需要可在「入侵防护 → 设置」关闭同步或关闭整个模块。
• The web service's failed-auth bans now use the shared ban list and apply to the whole host when firewall sync is on; “Ignore LAN addresses” (on by default) keeps LAN addresses from being banned this way. For sites behind a CDN that passes the real IP in a header, do not enable the WAF jail or failed-auth bans. / Web 服务认证失败封禁并入统一封禁表，开启防火墙同步后对整机生效；默认开启的「忽略内网地址」使内网地址不再被这类封禁。经 CDN 按请求头传递真实 IP 的站点不要启用 WAF 规则与认证失败封禁。

Release notes: https://gately.cn/en/news/v0.5.6 · 更新说明：https://gately.cn/news/v0.5.6

v0.5.5.2

Security fix / 安全修复

File permissions in the config directory / 配置目录中的文件权限

• Some filesystems ignore the permissions requested when a file is created; fnOS volumes mounted with trimacl create every new file and directory as 0755. On such volumes, runtime logs (logs/), audit.log, config history (history/), configs generated by the frp module (frp/, containing the frp token), subscribed IP list caches, local backups, pre-restore backups and the Tailscale state directory were readable by other local users. / 部分文件系统会忽略创建文件时指定的权限，例如飞牛 fnOS 以 trimacl 挂载的存储卷会把新建的文件和目录一律设为 0755。在这类卷上，运行日志（logs/）、audit.log、配置历史（history/）、frp 模块生成的配置（frp/，含 frp 令牌）、订阅 IP 列表缓存、本地备份、恢复前备份与 Tailscale 状态目录可以被本机其他用户读取。
• Files and directories are now chmodded explicitly after creation, and on startup existing content of these kinds is tightened to 0600 / 0700, with the number of changes written to the system log. bin/ and the config directory itself are left alone. / 现在创建文件和目录后都会显式设置权限，启动时把已有的上述内容收紧为 0600 / 0700，并在系统日志中记录改动数量。bin/ 与配置目录本身保持不变。
• Module config files (*.json) were always saved as 0600 and are not affected; regular filesystems such as ext4 are not affected. / 各模块配置文件（*.json）一直以 0600 保存，不受影响；ext4 等普通文件系统不受影响。

Upgrading / 升级

• From v0.5.5, Linux binary installs can upgrade from About → Check for Updates. Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / 从 v0.5.5 起，Linux 二进制部署可在「关于 → 检查更新」直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• v0.5.4 and earlier do not understand four-part version numbers; use About → “Upload upgrade package”, or upgrade to v0.5.5 first. / v0.5.4 及更早版本不识别四段版本号，请在「关于」页用「上传升级包」安装，或先升级到 v0.5.5。
• If you copied files from the config directory elsewhere, check the permissions of those copies yourself. / 如果曾把配置目录中的文件复制到别处，请自行检查那些副本的权限。

Release notes: https://gately.cn/en/news/v0.5.5.2 · 更新说明：https://gately.cn/news/v0.5.5.2

v0.5.5.1

Highlights / 亮点

Persistent runtime logs / 运行日志落盘 (#8)

• The system log and every module log are now written to logs/ in the configuration directory (one JSON Lines file per source, system logs in logs/gately.log), so the System logs page and every module page still show earlier logs after a restart, container recreation or upgrade. / 系统日志与各模块日志写入配置目录下的 logs/（每个来源一个 JSON Lines 文件，系统日志为 logs/gately.log），重启、重建容器或升级后，「系统日志」与各模块页面仍能看到之前的日志。
• Entries are written in batches at most one second after they are logged, and nothing is written while idle. Each file is limited to 2 MB by default and rotated with one previous file kept. / 有新日志时最多延迟 1 秒批量写入，空闲时不产生写入；单个文件默认上限 2 MB，写满后轮转并保留一份历史。
• Settings → Network & Runtime → Runtime parameters adds a “Persist logs” switch and a “Log file limit”, effective immediately; with persistence off, logs stay in memory only as before. / 「设置 → 网络与运行 → 运行参数」新增「日志落盘」开关与「日志文件上限」，立即生效；关闭后与之前一样只保存在内存。
• Clearing a module's logs also deletes its files. Configuration backups do not include logs/ or audit.log. The audit log was already stored on disk and is unchanged. / 清空模块日志会同时删除对应文件；配置备份不包含 logs/ 与 audit.log。操作审计日志原本就保存在磁盘上，不受影响。

Other / 其他

• Fixed a data race where saving settings replaced the global time zone while other goroutines were reading it; it is now only replaced when the time zone actually changes. / 修复保存设置时替换全局时区与其他协程读取之间的数据竞争，现在只在时区确实变化时才替换。

Upgrading / 升级

• From v0.5.5, Linux binary installs can upgrade from About → Check for Updates. Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / 从 v0.5.5 起，Linux 二进制部署可在「关于 → 检查更新」直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• v0.5.4 and earlier only understand three-part version numbers, so Check for Updates will not offer this release. Use About → “Upload upgrade package” with the .tar.gz for your platform below, or upgrade to v0.5.5 first. / v0.5.4 及更早版本只识别三段版本号，「检查更新」不会提示本版本。请在「关于」页用「上传升级包」安装下方对应平台的 .tar.gz，或先升级到 v0.5.5。
• With Docker, logs are in the mounted configuration directory, for example ./gately-data/logs/. / Docker 部署的日志位于挂载的配置目录中，例如 ./gately-data/logs/。

Release notes: https://gately.cn/en/news/v0.5.5.1 · 更新说明：https://gately.cn/news/v0.5.5.1

v0.5.5

Highlights / 亮点

Import nginx configs / 导入 nginx 配置

• Web Services → Import nginx accepts server blocks or the full output of nginx -T; include directives are expanded the way nginx does, and every site is previewed (type, backend or directory, source file and line, warnings, missing certificates) before anything is saved. / 「Web 服务 → 导入 nginx」可粘贴 server 块或 nginx -T 的完整输出，include 会像 nginx 一样展开；保存前先预览每个站点的类型、后端或目录、来源文件与行号、注意事项与缺少的证书。
• Converts proxy_pass with upstream weights, backups and balancing policies, root / alias directories, redirects, fixed responses, headers, gzip, allow / deny, and per-location backends, access rules and redirects. / 可转换反向代理（含 upstream 权重、备用与负载均衡策略）、静态目录、跳转、固定内容、请求头与响应头、压缩、allow / deny，以及 location 级的分路径后端、访问控制与跳转。
• auth_request becomes forward auth (common Authelia setups convert directly, including per-location auth); auth_basic becomes basic auth with shared users, so no imported site is left open. / auth_request 转换为转发认证，Authelia 的常见写法（含只对部分路径认证）可直接转换；auth_basic 转换为使用共享用户的基本认证，导入后不会出现没有保护的站点。
• Sites join an existing listener on the same port or a new one, existing domains are skipped, and imports are disabled by default so they can run alongside nginx. Validated against a production config with 77 sites. / 相同端口合并到已有监听，已存在的域名跳过，默认以停用状态导入，便于与 nginx 并行核对。已用 77 个站点的生产配置验证。

Certificate auto deploy / 证书自动部署

• After issuance, renewal or update, a certificate can be uploaded to an SSH host through an existing Web Terminal connection and a command run there (for example systemctl reload nginx, with $certName, $certDir, $certFile, $keyFile), or local Docker containers can be restarted. / 证书签发、续期或更新后，可经 Web 终端中的 SSH 连接上传到远程主机并执行命令（如 systemctl reload nginx，可用 $certName、$certDir、$certFile、$keyFile），或重启本机 Docker 容器。
• Unknown hosts are never trusted; files are replaced atomically with a 0600 private key; failures retry hourly and raise the new “Certificate: deployment failed” event; Deploy now runs all targets at once. / 不信任未知主机；文件原子替换，私钥权限 0600；失败每小时重试并发出新的「证书：部署失败」通知；「立即部署」可马上执行。

WAF: large uploads and WebDAV / WAF：大文件上传与 WebDAV

• Adjustable request body inspection limit (up to 1024 MB): reject larger bodies or inspect only the first part; skip body inspection on chosen paths. / 请求体检查上限可调（最大 1024 MB），超限时拒绝或只检查前面部分；可按路径跳过请求体检查。
• New “WebDAV and upload compatible” switch allows WebDAV methods, the Lock-Token, If and Content-Range headers and any upload content type, so cloud drives and WebDAV work behind the WAF while attacks are still blocked. / 新增「兼容 WebDAV 与上传」开关，放行 WebDAV 方法、Lock-Token、If、Content-Range 请求头与任意上传内容类型，网盘与 WebDAV 挂上 WAF 也能正常使用，攻击照常拦截。
• Every instance now allows Expect: 100-continue, which curl and rclone send with large uploads and OWASP CRS 4 used to block. / 所有实例放行 curl、rclone 上传大文件时带的 Expect: 100-continue，之前会被 OWASP CRS 4 拦截。

Subscribed IP lists / 订阅 IP 列表

• Subscribe to IP lists by URL (for example province lists from metowolf/iplist) under Web Services → Global Settings; they refresh on a schedule, are cached locally, and can be referenced by site and path-rule allowlists and blocklists. / 在「Web 服务 → 全局设置」按地址订阅 IP 列表（如 metowolf/iplist 的省市 IP 段），定时刷新并缓存在本地，站点与路径规则的黑白名单可以引用。(#4)

Self-check / 网络自检

• Reports HTTPS sites whose domains have no matching certificate, and frp proxy name, domain and remote port conflicts (typical when several devices share one frpc config). / 新增两项：HTTPS 站点缺少匹配证书的域名；frp 代理名、域名或远程端口冲突（常见于多台设备复制了同一份 frpc 配置）。

Other / 其他

• Online upgrade understands four-part versions such as v0.5.4.1, and says so when versions cannot be compared instead of claiming the installation is up to date. / 在线升级支持 v0.5.4.1 这样的四段版本号；版本号无法比较时明确提示，不再显示“已是最新”。

Upgrading / 升级

• From v0.5.4, Linux binary installs can upgrade from About → Check for Updates. Docker: pull the new image and recreate the container; fnOS: install the new .fpk; OpenWrt: install the new .ipk / .apk. / 从 v0.5.4 起，Linux 二进制部署可在「关于 → 检查更新」直接升级；Docker 拉取新镜像后重建容器；飞牛安装新版 .fpk；OpenWrt 安装新版 .ipk / .apk。
• Cloud drive or WebDAV sites already behind a WAF: turn on “WebDAV and upload compatible” in that WAF instance after upgrading. / 已挂 WAF 的网盘、WebDAV 站点，升级后在对应 WAF 实例中开启「兼容 WebDAV 与上传」。

Release notes: https://gately.cn/en/news/v0.5.5 · 更新说明：https://gately.cn/news/v0.5.5

v0.5.4

Highlights / 亮点

Online upgrade / 在线升级 (#6)

• Linux binary installs (systemd, PVE LXC containers, manual OpenWrt installs) can upgrade from About → Check for Updates → Upgrade now: Gately downloads the package for this platform from GitHub, verifies its SHA-256 against checksums.txt, test-runs the new binary, then replaces it and restarts in place, keeping the previous version as gately.old. / Linux 二进制部署（systemd、PVE LXC 容器、手动部署的 OpenWrt）可在「关于 → 检查更新 → 立即升级」在线升级：从 GitHub 下载本机平台的发布包，对照 checksums.txt 校验 SHA-256，试运行新程序后原地替换并重启，旧版本保留为 gately.old。
• PVE LXC containers no longer need to be recreated / PVE LXC 容器不用再删除重建 — containers created from the OCI image upgrade online too. / 用 OCI 镜像创建的 LXC 容器同样可以在线升级。
• The update dialog shows the release notes, the current step, download progress and speed, and can cancel until the binary is replaced; a reload resumes a running upgrade, and failures show the reason with a retry button. / 更新弹窗展示更新内容、当前步骤、下载进度与速度，替换程序前可随时取消；刷新页面后继续显示进行中的升级，失败时给出原因并可重试。
• Update proxy / 更新代理 (http, https or socks5) under About or Settings → Network & Runtime, used for both the check and the download. / 可在「关于」或「设置 → 网络与运行」设置 http、https、socks5 代理，检查更新与下载都经过它。
• Upload upgrade package / 上传升级包 accepts a release tar.gz or bare binary of any version for offline upgrades and rollbacks. / 支持上传发布页的 tar.gz 或程序本身，不限版本高低，可离线升级或回退。
• Upgrades only run when an administrator starts them. Docker, fnOS and OpenWrt package installs point to their own upgrade path. / 只由管理员手动触发；Docker、飞牛与 OpenWrt 安装包会提示各自的升级方式。

OpenWrt packages / OpenWrt 安装包 (#7)

• gately_v0.5.4_openwrt_<arch>.ipk for OpenWrt 24.10 and earlier (including iStoreOS): opkg install; .apk for OpenWrt 25.12: apk add --allow-untrusted. Architectures: amd64, arm64, arm (ARMv7 with FPU), mipsle, mips, riscv64. / .ipk 用于 OpenWrt 24.10 及以前（含 iStoreOS），执行 opkg install；.apk 用于 OpenWrt 25.12，执行 apk add --allow-untrusted。架构：amd64、arm64、arm（ARMv7 带浮点）、mipsle、mips、riscv64。
• The service is enabled and started on install; config in /etc/gately is kept across upgrades, uninstalls and sysupgrade; the package checks DISTRIB_ARCH before installing. The binary is about 35 MB. / 安装后自动启用并启动；/etc/gately 在升级、卸载与刷写固件时保留；安装前核对 DISTRIB_ARCH。程序约 35 MB。

Fixes / 修复

• Saving port forwarding or Web Services settings no longer restarts every listener, and editing a forwarding rule keeps existing connections when ports, protocols, mode and limits are unchanged, so an admin UI reached through Gately itself stays connected. / 保存端口转发或 Web 服务设置不再重启全部监听，编辑转发规则时端口、协议、模式与限制不变则保留现有连接，经 Gately 自身转发访问的管理界面不再断开。
• The WAF no longer flags JSON field names such as credentials or forwardAuth (CRS 930120), which returned 403 when saving DDNS tasks or adding Web Services listeners. / WAF 不再误判 credentials、forwardAuth 等字段名，保存 DDNS 任务或添加 Web 服务监听不再返回 403。
• List inputs no longer swallow Enter, commas and spaces as you type. / 列表输入框不再吞掉回车、逗号与空格。
• mips / mipsle binaries use soft float and run on routers without an FPU. / mips / mipsle 程序改为软浮点，可在无浮点单元的路由器上运行。
• Version comparison follows semver, so newer builds are no longer offered a downgrade. / 版本比较改为语义化版本，较新的构建不再被提示降级。

Upgrading / 升级

• Online upgrade starts with this version, so upgrading from v0.5.3 is still manual: replace the binary and restart, pull the new Docker image and recreate the container, or install the new .fpk on fnOS. Later versions can be upgraded from the About page. / 在线升级从本版开始提供，从 v0.5.3 升级仍需手动：替换程序后重启、Docker 拉取新镜像后重建容器、飞牛安装新版 .fpk。之后的版本可在「关于」页直接升级。
• Manual OpenWrt installs can install the .ipk / .apk over the existing setup; /etc/gately keeps working. / OpenWrt 手动部署可直接安装 .ipk / .apk 覆盖，/etc/gately 配置继续使用。

Release notes: https://gately.cn/en/news/v0.5.4 · 更新说明：https://gately.cn/news/v0.5.4