Skip to content

Repository navigation

v0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 05:07
· 97 commits to main since this release
v0.5.0
3403b53

Highlights / 亮点

Security & trust / 安全与可信

  • Audit log / 操作审计 — sign-ins, configuration changes and access to sensitive content (backups, private keys, terminals); records the real client address behind local proxies; never stores request bodies or secrets.
  • Config history & one-click rollback / 配置历史与回滚 — every overwritten config file keeps its previous 30 versions with a line diff.
  • Passkey (WebAuthn) sign-in and read-only accounts / 只读账号.
  • Trusted local proxies / 信任本机代理 — X-Real-IP / X-Forwarded-For are honoured only from this host (or configured proxies), so LAN-only access, sign-in rate limiting and the audit log see the real source.
  • Signed releases / 签名发布 — cosign keyless signatures for binaries (checksums) and images, build provenance and SBOM. See docs/en/VERIFY.md.

Features / 功能

  • ACME HTTP-01 validation (no DNS provider needed).
  • HTTP/3 (QUIC) for Web Services listeners.
  • Port forwarding can send PROXY protocol v1/v2 to the target.
  • DDNS: Amazon Route 53, OVHcloud, Gandi, NS1, Bunny DNS, Namecheap, DynDNS2 (No-IP, Dynu, …).
  • Notifications: ntfy, Gotify, Pushover, Discord, Slack, ServerChan, PushPlus, plus built-in rule templates.

Operations / 运维

  • Global Prometheus endpoint /api/metrics with a metrics:read token scope and a ready-made Grafana dashboard — see docs/en/MONITORING.md.
  • One-click network self-check (public IPv4/IPv6, CGNAT, clock, ports 80/443, DDNS resolution, certificate expiry) and first-run onboarding.
  • GATELY_INITIAL_PASSWORD, declarative config directory -apply / GATELY_APPLY_DIR, systemd and OpenWrt procd templates.

Upgrade notes / 升级说明

  • If a port-forwarding rule enables PROXY protocol, the target must accept it (e.g. haproxy accept-proxy). Downgrading to v0.4.x ignores the option and sends plain TCP, so remove accept-proxy on the target first.
  • Trusting local proxies is on by default; turn it off under Settings → Access control if needed.
  • The binary is now about 32 MB (QUIC support).

Verify / 校验

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/wangwanjie/gately/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify gately_v0.5.0_linux_amd64.tar.gz --repo wangwanjie/gately
Assets 15
Loading