v0.5.2

Highlights / 亮点

SNI routing for port forwarding / 端口转发 SNI 分流 (closes #3)

• Several services can share one port such as 443: Gately reads the domain from the TLS handshake and passes the connection through to the backend chosen by domain, without decrypting TLS. It replaces haproxy's req_ssl_sni routing. / 多个服务共用 443 等同一个端口：读取 TLS 握手里的域名，按域名把连接透传到对应后端，不解密 TLS，可替代 haproxy 的 req_ssl_sni 分流。
• Exact domains, *.example.com wildcards and *; a default target for unmatched connections, connections without SNI and non-TLS clients; PROXY protocol v1/v2 set per route; per-route connection counters. / 支持精确域名、通配与 *；未命中、无 SNI、非 TLS 的连接走默认目标；每条路由单独设置 PROXY 协议 v1/v2，并显示每条路由的连接数。

Web Services can replace nginx / Web 服务可以替代 nginx

• Path backends / 分路径后端 — send a path prefix to other backends or add request headers for it (nginx location).
• Forward auth / 转发认证 — hand authentication to Authelia or similar (auth_request); protect only paths such as /admin.
• HTTPS backends receive the visited domain as SNI / HTTPS 后端按访问域名发送 SNI — for backends that route by SNI, e.g. frp vhost_https.
• {host} in redirects / 重定向支持 {host} — https://{host} sends every domain's HTTP to HTTPS.
• Static sites / 静态站点 — clean URLs (VitePress and similar), custom 404 page, response headers.
• Editing sites no longer restarts the listener / 修改站点不再重启监听 — open connections (WebSocket included) stay up, statistics are kept, an invalid new config keeps the old one serving.
• See "Replacing haproxy and nginx" in the Web Services docs. / 对应关系见官网 Web 服务文档的「替换 haproxy 与 nginx」。

Shared users with TOTP and single sign-on / 共享用户：TOTP 与单点登录

• Users defined once under Web Services → Global settings, each with optional TOTP (QR code setup); sites opt in with "Use shared users". / 在 Web 服务全局设置里定义一次，可为每个用户启用 TOTP（扫码绑定），站点勾选「使用共享用户」即可。
• An SSO domain such as example.com lets one sign-in cover every site under it. / 设置单点登录域（如 example.com）后，登录一次即可访问同域下的所有站点。

Performance / 性能 — same machine, 2 CPU cores each, a real server's configuration (90 domains, PROXY v2) / 同一台机器、各限 2 核、按真实服务器配置（90 个域名、PROXY v2）：

Scenario / 场景	haproxy + nginx	Gately
HTTPS reverse proxy, keep-alive, 1 KB / HTTPS 反代，长连接，1 KB	14,767 req/s	26,434 req/s
New TLS connection per request / 每请求新建 TLS 连接	2,557 req/s	3,448 req/s
1 MB responses / 1 MB 响应	1,053 MB/s	1,585 MB/s
SNI passthrough stream / SNI 透传数据流	2,927 MB/s	4,962 MB/s
SNI passthrough, new connections / SNI 透传新建连接	6,334 /s	6,266 /s

Memory: about 110 MB for Gately against about 42 MB for haproxy plus nginx. Method and caveats: README. / 内存：Gately 约 110 MB，haproxy 加 nginx 约 42 MB。测试方法与注意事项见 README。

Also: the README now has screenshots of the SNI routing page, config history, audit log and API docs, and a QR code for the Telegram group. / 另外：README 新增 SNI 分流、配置历史、操作审计与 API 文档截图，并加入 Telegram 群二维码。

Upgrade notes / 升级说明

• Versions before v0.5.2 do not understand SNI routing rules. Disable or delete them before downgrading, because an older version treats such a rule as plain forwarding, and a rule without a default target crashes it on the first connection. / v0.5.2 之前的版本不认识 SNI 分流规则。降级前请先停用或删除这些规则，旧版会把它当作普通转发，没有默认目标的规则会在第一个连接到来时让程序崩溃。
• When taking over from haproxy, stop haproxy before enabling the Gately rule; only one program can listen on a port. / 接替 haproxy 时，先停止 haproxy 再启用 Gately 的规则，同一个端口只能由一个程序监听。
• Shared users, path backends and forward auth are new optional settings; existing configuration keeps working unchanged. / 共享用户、分路径后端与转发认证都是新增的可选设置，已有配置无需改动。

Verify / 校验

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/wangwanjie/gately/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify gately_v0.5.2_linux_amd64.tar.gz --repo wangwanjie/gately