Skip to content

v0.6.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 12:01
· 32 commits to main since this release
v0.6.4
0d26cf2

中文

定制构建

除端口转发、Web 服务与 SSL 证书三个核心模块外，其余 22 个模块都可以在编译时去掉，界面语言也可以只保留简体中文，或简体中文、繁体中文与英语三种：

  • 打开 build.gately.cn，勾选模块与语言（也可以从「仅核心」「路由器」「NAS」预设开始），页面实时估算体积，在线生成 Linux / Windows / macOS / FreeBSD 二进制、OpenWrt 与飞牛安装包，或 amd64、arm64、arm/v7 多架构 Docker 镜像；相同选项的产物会复用，不必重复构建；
  • 以 linux/arm64 为例：完整版 33.6 MB，只留核心约 19.9 MB，路由器预设加简体中文约 21.2 MB；路由器预设加简体中文的 Docker 镜像拉取约 18.7 MB（完整镜像 51.9 MB），未包含 Docker 管理时镜像不带 docker-cli 与 compose，未包含入侵防护与 STUN 时不带 nftables；
  • 没有编译进来的模块，配置文件原样保留，设置中的开关与 API 令牌权限照常有效，接口返回 404 并说明未包含在此构建中，界面隐藏对应页面与选项，换回完整版后恢复；
  • 「关于」页列出本构建去掉的模块，并附带用相同选项打开构建器的链接。定制构建不提供在线升级（在线升级下载的是完整版本），新版本发布后用相同选项重新生成，再上传升级包；
  • 自行编译时用 no_<模块> 与 lang_zh / lang_cjken build tag、前端的 GATELY_LOCALES，或 Dockerfile 的 GATELY_TAGS 等构建参数，tools/custombuild 可把选择换算成这些参数。

详见 模块总览 · 定制构建 与 从源码构建。

隐藏管理端口

「设置 → 访问控制」新增「未授权访问响应」，作用于被封禁的来源、开启仅内网访问时的外网访问，以及没有经过安全入口的请求：

  • 可选默认提示页、普通 404、空白页、断开连接、不响应直到超时，或自定义 HTML 页面（可指定状态码）；
  • 断开与不响应在建立连接时按来源判定，HTTPS 不发送证书，经可信代理转发的请求自动改为普通 404，避免前置代理露出错误页；挂起的连接有时长与数量上限；
  • 隐藏方式下响应不再带有管理界面特有的安全响应头，自定义页面在禁止脚本与外部资源的沙箱中显示。

端口本身仍可被扫描发现，彻底隐藏需配合防火墙。详见 安全加固清单。

站点错误页

  • Web 服务站点的「错误页」标签可以为 Gately 生成的 404 与 5xx 页面选择默认样式、10 种内置风格（极简、终端、霓虹、星空、报刊、粗野、极光、像素、蓝图、状态链路），或页面库中的自定义页面，每种风格都有缩略图与桌面 / 手机预览；
  • 页面库可以上传、粘贴 HTML 或引用服务器上的 .html 文件，保存时检查并清理脚本、事件属性与表单等内容，支持 {code}、{title}、{host}、{path} 等占位符，输出时带禁止脚本与外部资源的 CSP；
  • 反向代理站点可以拦截后端的指定状态码（如 404, 500-599），只替换浏览器打开页面的请求，接口请求保持原样；
  • 默认站点的设置同时用于未匹配任何站点的请求，「排序与批量」可以批量设置错误页风格。

详见 Web 服务 · 错误页。

其他改进

  • DDNS 搜索按记录过滤：任务的名称、分组、备注或服务商匹配时显示全部记录，否则只列出匹配的记录，搜索期间自动展开折叠的任务与分组；Web 服务搜索时自动展开折叠的监听；
  • 设置页的长标签自动换行，德语、俄语等语言下不再与输入框重叠；
  • 管理界面请求遇到非 JSON 响应（如会话过期后被安全入口拦截）时提示刷新或重新打开安全入口；
  • 默认错误页的「刷新」改为普通链接，在禁止脚本的 CSP 下同样可用；
  • 诊断包与 GET /api/status、GET /api/system/info 带上构建信息（是否定制、包含的模块与语言）；
  • CI 增加预设 build tag 组合的检查。

升级提示

  • Docker 拉取新镜像后重建容器，已挂载 Docker 套接字的也可以在 Gately 的 Docker 页面直接升级 Gately 自身；OpenWrt 覆盖安装新的 .apk / .ipk；飞牛在应用中心手动安装新版 .fpk；其他部署方式可在「关于」页在线升级。
  • 完整版用户无需任何操作，配置格式没有变化。

English

Custom builds

Apart from the three core modules (Port Forwarding, Web Services and SSL Certificates), the other 22 modules can be left out at compile time, and the UI languages can be limited to Simplified Chinese, or to Simplified Chinese, Traditional Chinese and English:

  • Open build.gately.cn, tick the modules and languages (or start from the "Core only", "Router" or "NAS" preset), and the page estimates the size as you go and generates Linux / Windows / macOS / FreeBSD binaries, OpenWrt and fnOS packages, or a multi-arch Docker image for amd64, arm64 and arm/v7 online; artifacts for the same options are reused instead of being built again;
  • On linux/arm64, for example: the full edition is 33.6 MB, core only is about 19.9 MB, and the Router preset with Simplified Chinese is about 21.2 MB; the Docker image for the Router preset with Simplified Chinese is about 18.7 MB to pull (full image 51.9 MB), and an image without Docker management leaves out docker-cli and compose, and one without Intrusion Prevention and STUN leaves out nftables;
  • For modules not compiled in, configuration files stay untouched, their switches in Settings and API token scopes remain valid, their APIs return 404 saying the module is not included in this build, and the UI hides their pages and options; switching back to the full edition restores them;
  • The About page lists the modules left out of this build, with a link that opens the builder with the same options. Custom builds do not offer online upgrade (online upgrade downloads the full edition); when a new version is released, generate it again with the same options and use "Upload upgrade package";
  • When compiling yourself, use the no_<module> and lang_zh / lang_cjken build tags, GATELY_LOCALES for the frontend, or Dockerfile build arguments such as GATELY_TAGS; tools/custombuild turns a selection into these parameters.

See Modules Overview · Custom builds and Build from source.

Hiding the admin port

"Settings → Access Control" adds "Unauthorized response", which applies to banned sources, public access while LAN-only access is on, and requests that did not go through the secure entry path:

  • Choose the default notice page, a plain 404, a blank page, close connection, no response until timeout, or a custom HTML page (with a status code of your choice);
  • Close connection and no response decide by source when the connection is established, so HTTPS sends no certificate; requests forwarded by a trusted proxy automatically get a plain 404 instead, so the front proxy does not show its own error page; held connections are limited in duration and number;
  • In the hiding modes, responses no longer carry the security headers specific to the admin console, and custom pages are shown in a sandbox that blocks scripts and external resources.

The port itself can still be found by scanning; hiding it completely requires a firewall. See Hardening Guide.

Site error pages

  • The "Error pages" tab of a Web Services site can choose, for the 404 and 5xx pages Gately generates, the default style, one of 10 built-in styles (Minimal, Terminal, Neon, Starry sky, Newspaper, Brutalist, Aurora, Pixel, Blueprint, Status chain), or a custom page from the page library; every style has a thumbnail and desktop / mobile preview;
  • The page library accepts uploaded or pasted HTML or a reference to an .html file on the server; saving checks and removes scripts, event attributes, forms and similar content, placeholders such as {code}, {title}, {host} and {path} are supported, and pages are served with a CSP that blocks scripts and external resources;
  • Reverse proxy sites can intercept specific backend status codes (such as 404, 500-599) and replace only requests from browsers opening a page, leaving API requests as they are;
  • The default site's settings also apply to requests that match no site, and "Sort & batch" can set the error page style for many sites at once.

See Web Services · Error pages.

Other improvements

  • Dynamic DNS search filters by record: when a task's name, group, remark or provider matches, all its records are shown, otherwise only the matching records are listed, and collapsed tasks and groups expand during the search; Web Services search expands collapsed listeners automatically;
  • Long labels on the Settings page wrap automatically and no longer overlap the input boxes in languages such as German and Russian;
  • When an admin console request gets a non-JSON response (for example, blocked by the secure entry path after the session expired), the console asks you to refresh or reopen the secure entry path;
  • "Refresh" on the default error page is now a plain link, so it also works under a CSP that blocks scripts;
  • Diagnostic bundles, GET /api/status and GET /api/system/info include build information (whether it is a custom build, and the included modules and languages);
  • CI checks the build tag combinations of the presets.

Upgrade notes

  • Docker: pull the new image and recreate the container; when the Docker socket is mounted, Gately can also upgrade itself from its Docker page. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk manually in the App Center. Other deployments can upgrade online on the About page.
  • Users of the full edition need to do nothing; the configuration format is unchanged.
Assets 31
Loading