New / 新功能 • Protocol Routing: a new module that identifies the protocol from the first bytes of each connection, so HTTPS, SSH, RDP, OpenVPN and 20 protocols in total share one port without decryption. TLS is routed by SNI and ALPN, HTTP by Host, Minecraft by server address; SSH, RDP, SOCKS4/5, OpenVPN over TCP, XMPP, MQTT, PostgreSQL, RTSP, SIP, Redis, AMQP, SMB, Git, IRC, ADB and BitTorrent get one route each; a wait-timeout route serves server-first protocols such as VNC, and the detection timeout accepts tenths of a second. Per-route PROXY protocol and hit counters. / 协议分流：新模块，按连接的首个数据包识别协议，让 HTTPS、SSH、RDP、OpenVPN 等 20 种协议共用一个端口且不解密。TLS 按 SNI 与 ALPN、HTTP 按 Host、Minecraft 按服务器地址分流；SSH、RDP、SOCKS4/5、OpenVPN（TCP）、XMPP、MQTT、PostgreSQL、RTSP、SIP、Redis、AMQP、SMB、Git、IRC、ADB、BitTorrent 各一条路由；「等待超时」路由接收 VNC 等服务端先发言的协议，识别超时可精确到 0.1 秒。每条路由可单独发送 PROXY 协议并显示命中次数。 • Group and sort every list (#48): search, drag-and-drop sorting, bulk moves to a group, group renaming and merging across Dynamic DNS, port forwarding, protocol routing, sites, STUN, certificates, WAF, intrusion prevention, frp, tunnels, File Browser, mounts, Wake-on-LAN, cron, notifications, terminal connections and API tokens; DNS records inside a task can be grouped too. Regrouping never restarts a running instance. / 所有列表支持分组与排序（#48）：动态域名、端口转发、协议分流、站点、STUN、证书、WAF、入侵防护、frp、隧道、File Browser、存储挂载、网络唤醒、计划任务、通知、终端连接与 API 令牌统一支持搜索、拖动排序、批量移动到分组、重命名与合并分组；任务内的解析记录也可分组。调整分组不重启运行中的实例。 • STUN addresses in Dynamic DNS (#47): record values and Webhooks can use {STUN_rule_PORT}, {STUN_rule_IP}, {STUN_rule_ADDR} (by rule name or key); tasks sync as soon as the STUN address changes, and a Webhook-only reference still fires. / 动态域名引用 STUN 地址（#47）：记录值与 Webhook 可用 {STUN_规则名_PORT} 等变量（规则名或 key），STUN 地址变化后立即同步，只在 Webhook 中引用也会调用。 • STUN behind multiple NATs: with UPnP / NAT-PMP, the gateway's own external address is checked first; behind an outer NAT only the tunnel mapping is kept, so the public port stops drifting. / STUN 适配多层 NAT：开启 UPnP / NAT-PMP 时先查询网关外网地址，外层还有 NAT 时只保留通道端口映射，公网端口不再漂移。 • Delete a single record from a DDNS task card; single-row mobile terminal key bar that follows the on-screen keyboard; opaque home screen icons and a web app manifest; redesigned website home page and README. / DDNS 任务卡片可直接删除单条记录；手机 Web 终端按键栏改为单行并随软键盘显示；修复主屏幕图标透明并提供 Web App Manifest；官网首页与 README 改版。 Security / 安全加固 • While the default password is in use, security settings are read-only, including backup restore and rolling them back from history. / 仍在使用默认密码时安全配置只读，从备份恢复与回滚历史版本同样被拒绝。 • Read-only accounts and tokens get masked credentials, including URL passwords, query values, token-like path segments and URLs inside log text. / 只读账号与令牌读到的凭据一律打码，包括地址中的密码、查询参数、像令牌的路径段以及日志文本中的地址。 • Browsing files/ and sftp/ needs write access; password-only logins no longer reset the failure counter; stricter X-Forwarded-For / X-Real-IP handling; command-capable token scopes are marked "Runs commands"; UPnP control URLs must belong to the replying device. / 浏览 files/、sftp/ 需要写权限；只靠密码的登录不再清零失败计数；X-Forwarded-For 与 X-Real-IP 处理更严格；可执行命令的令牌权限会标注提醒；UPnP 控制地址必须属于应答设备。 Fixes / 修复 • Editing an intrusion prevention rule that has matched before failed with unknown field "lastSeen". / 入侵防护规则命中过后再编辑保存报 unknown field "lastSeen"。 • With several certificates for one domain, the one expiring last is used; list order and groups no longer change the served certificate. / 多张证书覆盖同一域名时使用到期最晚的一张，列表排序与分组不再影响实际使用的证书。 • Protocol Routing no longer forwards zero padding when a ClientHello times out half-way, and stopping a rule closes connections still being identified. / 协议分流在 ClientHello 中途超时时不再转发补零数据，停止规则时立即关闭识别中的连接。 • STUN variables in a JSON Webhook body were not replaced. / JSON 格式的 Webhook 正文中 STUN 变量未被替换。 Upgrading / 升级 • On first start, SNI routing rules in Port Forwarding move to Protocol Routing with their keys, names, groups and routes; the module stays off if Port Forwarding was off, and tokens with portforward access also get protoroute access. Use /api/protoroute/rules (routes instead of sniRoutes); /api/portforward/rules rejects mode. Metrics are now gately_protoroute_*. / 首次启动时端口转发中的 SNI 分流规则自动移到协议分流，key、名称、分组与路由保持不变；端口转发关闭的协议分流也关闭；有 portforward 权限的令牌同时获得 protoroute 权限。接口改用 /api/protoroute/rules（sniRoutes 改为 routes），/api/portforward/rules 不再接受 mode，指标改为 gately_protoroute_*。 • Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk. fnOS: install the new .fpk in the App Center. Other installs can upgrade online in Settings. / Docker 拉取新镜像后重建容器；OpenWrt 覆盖安装新的 .apk / .ipk；飞牛在应用中心安装新版 .fpk；其他部署方式可在「系统设置」中在线升级。 Release notes: https://gately.cn/en/news/v0.6.2 · 更新说明：https://gately.cn/news/v0.6.2

中文 新功能 • frp 多实例：可同时运行多个 frpc（各连一台 frps）与多个 frps 实例，各自独立进程、配置文件与日志；代理归属 frpc 实例，修改代理只重启受影响的实例；导入可指定已有或新建实例，Lucky 导入带上全部实例。旧版单个 frpc / frps 设置自动迁移为名为 frpc / frps 的实例。 • Web 服务按登录用户分流（#29）：开启基本 / 网页 / 转发认证的反代站点可把指定用户转发到各自后端（类似 nginx map $remote_user），可选 X-Remote-User 等请求头传递用户名，访客伪造的同名头总会被删除。 • 站点分组、排序与搜索（#28）：站点可设分组、折叠显示，排序模式可拖动站点、整组移动、调整监听顺序，搜索框按域名 / 名称 / 分组 / 后端 / 备注过滤。 • 转发 Gately 登录 Cookie（#30）：公网 Gately 只做 WAF 与访问控制，由内网 Gately 负责网页认证与单点登录。 • 显示已保存的密码：眼睛按钮从新的 .../secrets 接口取回明文，需要写权限，查看记入审计日志；Web 终端密钥需先通过终端二次验证；gately mcp 默认只读模式不提供这类接口。 修复 • 子域名单独托管在另一家 DNS 服务商时证书签发失败（#27）：主域名留空时按 SOA 查询权威区域，查到的区域比可注册域名还短时回退按域名推断；证书设置的 DNS 服务器只用于该证书。 • frp 启动时清理残留的含令牌配置文件；迁移结果保存失败不再阻止其他模块启动；删除 frpc 实例时代理在同一次保存中删除；导入到已有实例时校验结果。 升级提示 • 配置向后兼容，可直接升级；旧版生成的 frp/frpc.toml、frp/frps.toml 会被删除。 • 接口 /api/frp/client、/api/frp/server 已移除，改用 /api/frp/clients、/api/frp/servers、/api/frp/settings。 详见 https://gately.cn/news/v0.6.0 English New • Several frp instances: run several frpc instances (each connected to one frps) and several frps instances, each with its own process, config file and log; proxies belong to an frpc instance and changes restart only the affected instances; imports can target an existing or a new instance and the Lucky import brings in every instance. Old single frpc / frps settings migrate to instances named frpc / frps. • Route Web Service requests by signed-in user (#29): reverse proxy sites with basic, web or forward authentication can send listed users to their own backends (like nginx map $remote_user), optionally passing the user name in a header such as X-Remote-User; the same header sent by visitors is always removed. • Site groups, sorting and search (#28): collapsible site groups, a Sort mode to drag sites, move groups and reorder listeners, and a search box over domain, name, group, backend and remark. • Forward Gately sign-in cookies (#30): a public Gately runs only the WAF and access control in front of a LAN Gately that handles web authentication and single sign-on. • Show saved passwords: an eye button fetches the plain text from new .../secrets endpoints; write permission is required and every lookup is audited; web terminal secrets need the terminal's two-factor check; the default read-only mode of gately mcp does not offer them. Fixes • Certificates for subdomains hosted at another DNS provider failed (#27): with the zone left empty, the authoritative zone is found with an SOA query, a zone shorter than the registrable domain falls back to inference, and DNS servers set on a certificate apply to that certificate only. • frp removes leftover config files containing tokens on start; a failure to save the migrated config no longer stops other modules; deleting an frpc instance removes its proxies in the same save; importing into an existing instance validates the result. Upgrade notes • The config is backward compatible; frp/frpc.toml and frp/frps.toml written by older versions are removed. • /api/frp/client and /api/frp/server are removed in favor of /api/frp/clients, /api/frp/servers and /api/frp/settings. See https://gately.cn/en/news/v0.6.0

Features / 新功能 • File Browser hosted as a managed program: runs FileBrowser Quantum (the maintained fork; the original filebrowser was archived) with a listen address and port, base path, shared directories (each can be read-only), password / reverse-proxy header / no sign-in, language and session lifetime; the admin password is passed by environment variable and never written to a file. (#23) / 托管 File Browser：运行仍在维护的 FileBrowser Quantum（原版已归档），可设置监听地址与端口、访问路径、共享目录（可只读）、账号密码 / 反向代理用户名头 / 不登录、界面语言与登录有效期；管理员密码经环境变量传递，不写入文件。（#23） • IP address and short-lived certificates: ACME certificates get a certificate profile (CA default, Let's Encrypt shortlived or any profile name); public IPv4/IPv6 addresses can be entered next to domains, validated with HTTP-01; TLS connections without SNI get the matching IP certificate; short-lived certificates renew hours before expiry and retry hourly. (#24) / IP 地址证书与短期证书：ACME 证书新增证书配置（CA 默认、Let's Encrypt 短期证书或其他配置名）；域名列表可填公网 IPv4/IPv6，经 HTTP-01 验证签发；无 SNI 的 TLS 连接使用匹配的 IP 证书；短期证书按小时提前续签，失败每小时重试。（#24） • Online install, update, rollback and uninstall for frp, cloudflared, Tailscale (Linux only) and File Browser: latest or a given version, SHA-256 verified and test-run before replacing, per-program download proxy, the last 3 replaced versions kept in bin/.versions/ for rollback, and Restore defaults in the page header. Programs are now looked up in the set path, then bin/, then PATH. / frp、cloudflared、Tailscale（仅 Linux）、File Browser 支持在线安装、更新、回滚与卸载：最新版或指定版本，校验 SHA-256 并试运行后才替换，每个程序可单独设置下载代理，替换下的最近 3 个版本保存在 bin/.versions/ 可回滚，页头可恢复默认配置。程序查找顺序改为：填写的路径 → bin/ → PATH。 • File service shared users move to their own File shared users page and the new GET/PUT /api/fileusers with fileusers:read / fileusers:write token permissions; the old /api/<service>/shared-users endpoints keep working. / 文件服务共享用户改到独立的「文件共享用户」页面，新增接口 GET/PUT /api/fileusers 与令牌权限 fileusers:read / fileusers:write，旧接口继续可用。 Fixes from review / 发布前审查修复 • On Windows, uninstalling or reinstalling the same version of a running program no longer fails; install, rollback and uninstall are mutually exclusive; staging files left by an interrupted install are cleaned up. / Windows 上程序运行时卸载或重装同一版本不再失败；安装、回滚、卸载互斥；中断安装残留的临时文件会被清理。 • IPv6 addresses with a zone and malformed IP addresses are rejected instead of being saved as domains; the short-lived renewal lead time is capped at 80 hours; requests without a Host are not redirected to an invalid HTTPS address. / 带区域标识的 IPv6 与格式错误的 IP 地址会被拒绝，不再当作域名保存；短期证书续签提前量上限 80 小时；不带 Host 的请求不再被跳转到无效的 HTTPS 地址。 • File services turned off under Feature modules no longer block saving the shared users; a new File Browser instance cannot use the masked password placeholder. / 已关闭的文件服务不再阻止保存共享用户；新建 File Browser 实例不能把脱敏占位符当作密码。 Upgrading / 升级 • The config format is backward compatible and existing certificates are not reissued. A program of the same name in bin/ under the config directory now takes precedence over PATH. / 配置向后兼容，已有证书不会重新签发。配置目录 bin/ 下的同名程序现在优先于 PATH 中的程序。 • Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one. Other installs can upgrade online in Settings. / Docker 拉取新镜像后重建容器；OpenWrt 覆盖安装新的 .apk / .ipk；其他部署方式可在「系统设置」中在线升级。 Release notes: https://gately.cn/en/news/v0.5.9 · 更新说明：https://gately.cn/news/v0.5.9