v0.6.3

中文

性能监控（#59）

新增「性能监控」模块，后台每 5 秒采集一次主机 CPU、内存、磁盘、负载与 Gately 进程的 CPU、内存、文件描述符、协程数：

• 页面按 60 秒 / 1 小时 / 24 小时显示趋势，旁边是运行中站点的进行中请求、每秒请求数、5xx 比例、首字节延迟 P95 与后端健康状态，点站点打开站点统计；
• Web 站点开始统计首字节延迟（从收到请求到发出响应头），站点统计新增 P50 / P95 曲线，Prometheus 新增 gately_site_request_duration_seconds 以及 gately_host_*、gately_process_* 指标，Grafana 面板同步新增；
• 告警规则选择指标、比较方式与阈值，再设持续时长（1～1440 分钟），条件持续满足整段时长才触发，恢复时另发通知；5xx 比例与延迟可设最少请求数，流量太少时不判断。告警经通知中心发送，没有通知规则订阅时页面会提示。

历史数据只保存在内存中，重启后重新累计。详见 性能监控。

WAF 接入雷池（SafeLine）

WAF 实例可以把请求交给自建的雷池社区版检测引擎做语义分析，不需要在 Gately 前后再加一层反向代理：

• 填写检测引擎地址（host:port，或 unix: 加 snserver.sock 路径），「测试连接」会发送心跳与一条示例 SQL 注入，显示往返耗时与雷池记录的事件 ID；
• 雷池先于规则组执行，只用雷池时可以不选规则组；「仅检测」模式只记录不拦截；
• 拦截计入 WAF 计数、WAF 日志（含事件 ID）、访问日志、站点统计与入侵防护；
• 可设检测超时（默认 1 秒）、送检正文上限（默认 1024 KB，超出部分原样转发）以及引擎不可用时放行或返回 503（默认放行）。

详见 WAF 防火墙 · 使用雷池。

批量操作（#57）

列表的「排序」模式改为「排序与批量」，勾选后可以批量启用、停用和删除，删除前列出名称确认。Web 服务站点可以跨监听勾选，批量增删域名、替换主域名后缀（old.com → new.com 同时改写 www.old.com 与 *.old.com），以及批量修改压缩、访问日志、CORS、转发头、拒绝时断开连接与 WAF 引用；没改的选项保留各站点原值。整批先校验再一次保存，任何一项失败都不生效，只重载受影响的监听，不断开现有连接。接口为通用的 PUT <路径>-enable、POST <路径>-delete 与 POST /api/webservice/sites/batch。

STUN 自动放行防火墙端口

STUN 规则新增「自动放行防火墙」：开启后 Gately 在本机防火墙放行穿透端口（设置了 UPnP / NAT-PMP 内部端口时一并放行），规则停止或删除时移除。支持 nftables（OpenWrt fw4、firewalld）与 iptables（fw3、ufw），防火墙重载后 30 秒内自动补回，规则卡片显示放行结果或失败原因。详见 STUN 穿透。

修复泛解析 CNAME 导致的签发失败（#61）

域名有 *.example.com 指向 example.com 这类泛解析时，_acme-challenge 也会解析出 CNAME，DNS-01 验证记录被写到 @，CA 报告找不到 TXT 记录。现在 Gately 自行判断：明确设置的 CNAME 仍然跟随，便于把验证委派到其他域名；泛解析产生的 CNAME 会被识别出来，记录写在 _acme-challenge.<域名>。证书还新增「不跟随 _acme-challenge 的 CNAME」选项。详见 SSL 证书。

Web 服务日志（#62）

• 访问日志记录拦截原因（封禁、IP 名单、国家、限流、WAF），带本实例管理后台登录态的请求记录后台用户名；
• 日志页新增「隐藏被封禁来源」（默认关闭，触发封禁的请求仍可见，便于审计）与「隐藏后台自身请求」（默认开启），只影响显示，日志照常保存；
• IP 筛选支持以 ! 或 - 开头的排除项，可写地址、网段或部分地址。

其他改进

• 网络拓扑新增「筛选」：按监听、只看有问题的节点、按拦截原因筛选站点；打码新增「代号」样式，把地址整体替换成 Visitor-01、Backend-01 这类编号（#54）；
• README 巡览视频直接从介绍页开始播放；
• 依赖更新：go-jose 升级到 v4.1.7、klauspost/compress 升级到 v1.18.7。

修复与加固

• WAF 站点的后端自己返回 403 时不再被当成 WAF 拦截：此前会计入拦截次数并发出 waf.blocked 事件，订阅 WAF 拦截的入侵防护规则可能因此封禁正常访客；
• 「隐藏后台自身请求」只认管理员会话，只读账号的登录 Cookie 不能用来给请求打上后台标记；被拦截的请求不带后台标记；
• 批量操作在去重前先限制提交数量；批量设置的 WAF 实例不存在时拒绝保存；
• 同一主机上运行多个 Gately 时，自动放行的防火墙规则按实例区分，不会互相删除。

升级提示

• Docker 拉取新镜像后重建容器，已挂载 Docker 套接字的也可以在 Gately 的 Docker 页面直接升级 Gately 自身；OpenWrt 覆盖安装新的 .apk / .ipk；飞牛在应用中心手动安装新版 .fpk；其他部署方式可在「系统设置」中在线升级。

English

Performance monitoring (#59)

The new "Performance" module samples the host's CPU, memory, disk and load, plus Gately's own CPU, memory, file descriptors and goroutines, every 5 seconds:

• the page shows trends over 60 seconds / 1 hour / 24 hours, next to the requests in progress, requests per second, 5xx ratio, time to first byte P95 and backend health of running sites; click a site to open its statistics;
• Web sites now measure time to first byte (from receiving the request to sending the response headers), site statistics gain P50 / P95 curves, Prometheus gains gately_site_request_duration_seconds plus the gately_host_* and gately_process_* metrics, and the Grafana dashboard is updated to match;
• an alert rule picks a metric, a comparison and a threshold, then a duration (1 to 1440 minutes); it fires only when the condition holds for the whole duration, and a recovery notification is sent when it clears. The 5xx ratio and latency rules can set a minimum request count, so too little traffic is not judged. Alerts go out through the Notification Center, and the page warns when no notification rule subscribes to them.

History is kept in memory only and starts over after a restart. See Performance.

WAF with SafeLine

A WAF instance can hand requests to your self-hosted SafeLine Community Edition detection engine for semantic analysis, without another reverse proxy in front of or behind Gately:

• enter the detector address (host:port, or unix: plus the path of snserver.sock); "Test connection" sends a heartbeat and a sample SQL injection and shows the round trip and the event ID recorded by SafeLine;
• SafeLine runs before the rule groups, and rule groups may stay empty when only SafeLine is used; "Detect only" mode logs detections without blocking;
• blocks count in the WAF counters, the WAF log (with the event ID), access logs, site statistics and Intrusion Guard;
• you can set the detection timeout (default 1 second), the inspected body limit (default 1024 KB, the rest is forwarded unchanged), and whether requests are allowed or answered with 503 when the engine is unavailable (allowed by default).

See WAF Firewall · Using SafeLine.

Batch operations (#57)

The "Sort" mode of lists becomes "Sort & batch": after checking items you can enable, disable and delete them in one step, and the names are listed for confirmation before deleting. Web Services sites can be checked across listeners to add or remove domains in bulk, replace the suffix of the main domain (old.com → new.com also rewrites www.old.com and *.old.com), and change compression, access logs, CORS, forwarded headers, close on refusal and WAF references in bulk; options you leave unchanged keep each site's own value. The whole batch is validated first and saved once, nothing takes effect if any item fails, and only the affected listeners are reloaded without dropping existing connections. The API consists of the generic PUT <path>-enable and POST <path>-delete plus POST /api/webservice/sites/batch.

STUN: open firewall ports automatically

STUN rules gain "Open firewall port": when enabled, Gately opens the traversal port in this machine's firewall (together with the internal UPnP / NAT-PMP port when one is set) and removes it when the rule stops or is deleted. nftables (OpenWrt fw4, firewalld) and iptables (fw3, ufw) are supported, rules are restored within 30 seconds after a firewall reload, and the rule card shows the result or the reason for a failure. See STUN Traversal.

Fix: issuance failing because of wildcard CNAMEs (#61)

When a domain has a wildcard such as *.example.com pointing to example.com, _acme-challenge also resolves to a CNAME, the DNS-01 validation record was written to @, and the CA reported that it could not find the TXT record. Gately now decides for itself: a CNAME that was set explicitly is still followed, so validation can be delegated to another domain; a CNAME produced by a wildcard is recognized and the record is written to _acme-challenge.<domain>. Certificates also gain the option "Do not follow the CNAME of _acme-challenge". See SSL Certificates.

Web Services logs (#62)

• Access logs record why a request was blocked (ban, IP list, country, rate limit, WAF), and requests that carry a login session of this instance's console record the console user name;
• the log page gains "Hide banned sources" (off by default, so the requests that triggered a ban stay visible for auditing) and "Hide console requests" (on by default); they only affect what is shown, and logs are saved as before;
• the IP filter accepts exclusions starting with ! or -, written as addresses, ranges or partial addresses.

Other improvements

• The network topology gains "Filter": by listener, only nodes with problems, and sites by block reason; masking gains an "Aliases" style that replaces addresses with numbers such as Visitor-01 and Backend-01 (#54);
• the README tour video starts right on the intro card;
• dependency updates: go-jose to v4.1.7 and klauspost/compress to v1.18.7.

Fixes and hardening

• When the backend of a WAF site returns 403 itself, it is no longer treated as a WAF block: it used to add to the block counters and emit a waf.blocked event, so an Intrusion Guard rule subscribed to WAF blocks could ban a regular visitor;
• "Hide console requests" only trusts administrator sessions, so the login cookie of a read-only account cannot be used to mark requests as console requests; blocked requests carry no console mark;
• batch operations limit the number of submitted items before deduplicating, and a batch that sets a WAF instance that does not exist is rejected;
• when several Gately instances run on one host, the firewall rules opened automatically are told apart per instance and do not delete each other.

Upgrade notes

• Docker: pull the new image and recreate the container; when the Docker socket is mounted, Gately can also upgrade itself from its Docker page. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online in Settings.