Release notes

The public site currently serves The Gateway v2.16.0 for linux/amd64 and linux/arm64.

Installer maintenance — 7 October 2026

The hosted install.sh and install-gateway.sh now include missing runtime dependencies such as OpenVPN, diagnostics tools, and a distro-supported DHCP client. The full installer adds --with-bluetooth, enabled by default for rpi and full profiles. Update mode installs absent base packages with --no-upgrade before comparing binary versions, so a current installation can repair missing dependencies without replacing the daemon.

This does not change the v2.16.0 binaries or their checksums. The original compressed downloads, checksum verification, and historical release artifacts are preserved. See installation and update behavior.

Download paths

Path	Purpose
`/install.sh`	One-shot bootstrap installer. Downloads the verified binary and hands off to the full installer.
`/install-gateway.sh`	Full profile-driven installer for `rpi`, `vps`, `node`, `full`, and `custom` installs.
`/releases/latest/gatewayd-linux-amd64`	Stripped `amd64` compatibility build from the release tag.
`/releases/latest/gatewayd-linux-arm64`	Stripped `arm64` compatibility build from the release tag.
`/releases/latest/gatewayd-linux-{amd64,arm64}.gz`	Original upstream release archives; preferred by the bootstrap.
`/releases/latest/gwctl-linux-arm64.gz`	Original upstream arm64 CLI archive.
`/releases/latest/SHA256SUMS`	Checksums for every hosted file, including archives and raw compatibility builds.
`/releases/latest/UPSTREAM_SHA256SUMS`	Upstream checksums of the uncompressed original binaries.
`/releases/v2.10.0/`	Pinned v2.10.0 archive.
`/releases/v2.11.0/`	Pinned v2.11.0 archive.
`/releases/v2.12.0/`	Pinned v2.12.0 archive.
`/releases/v2.12.1/`	Pinned v2.12.1 archive.
`/releases/v2.13.1/`	Pinned v2.13.1 archive.
`/releases/v2.14.0/`	Pinned v2.14.0 archive.
`/releases/v2.15.0/`	Pinned v2.15.0 archive.
`/releases/v2.16.0/`	Pinned archive of the current release.

v2.16.0 summary

Released 3 October 2026. This release audits the admin interface against API data and node state, closes the project’s 55-item UI audit ledger, and adds controls for previously configuration-only settings.

Managed accounts: Settings → Users and gatewayd user add|list|del manage users beside the built-in admin. Deleting a user revokes its tokens; concurrent edits and reserved-name handling are fixed.
Static DHCP reservations: pin a MAC to an address from the DHCP page. Reserved addresses may be outside the dynamic pool; other clients cannot take them. DHCP settings now apply to the running server while retaining leases, rather than waiting for a daemon restart.
Restart enforcement: when reconciliation is disabled, initial device allow rules, per-class DoT blocks and chain-routing marks are still installed once at startup.
Privacy and WAN fixes: IPv6 block restoration no longer stacks duplicate rules or re-enables a disabled toggle. The WAN stall watchdog adds ARP handling, confirmation ping, recovery backoff and corrected cooldown accounting to avoid unnecessary interface bounces.
Role-aware controls: viewer writes are disabled with a reason; admin-only sections are labelled; operator access no longer blanks the application on a Secrets 403. API denial reasons remain visible.
More settings: static WAN address/gateway/subnet, AP subnet, WAN-side admin access, Pi-hole backend, per-interface gateway/DNS, and live reconciliation on/off and interval. Some network settings still require restart; see Settings reference.
Truthful status: corrected routing, WiFi, firewall, bridge and discovery counts; absent services no longer show live controls; hosts without a temperature sensor return cpu_temp: null. Audit-log paging and snapshot age are exposed.

The upstream primary-mode Raspberry Pi 4 record reports 208 value checks / 0 failures, 293 action checks / 0 failures with four review-only skips, 22 node checks / 0 failures, 9/9 leak checks, and 48/48 page sweeps for both regular and viewer roles. These are project-reported results, not an independent audit or a throughput benchmark. The embedded-mode VPS was still running v2.13.1: its read-only fixture checks passed 84 rows and failed 12 for fixes not yet deployed there. See release verification.

v2.16.0 artifacts

Original archives: daemon amd64, daemon arm64, CLI arm64. Manifests: hosted files and uncompressed upstream originals.

The Gitea archives are mirrored unchanged and their decompressed SHA256 values match the release description. The bootstrap checks both the compressed and decompressed files. Existing raw daemon URLs serve separately built, stripped compatibility binaries from exact tag v2.16.0, source commit 17b154d4; they are not byte-identical to upstream originals and use the hosted-file manifest. The release provides an arm64 CLI archive, not an amd64 CLI archive. The full installer is unchanged and byte-identical to the release tag.

v2.16.0 upgrade changes

No configuration change is required. Migration 059 creates dhcp_reservations. With reconcile.disabled: true, startup now applies initial policy enforcement once: device rules, DoT blocks and chain-routing marks no longer wait for manual reconciliation. API clients must accept cpu_temp: null on hosts without a sensor. Back up the database and configuration before upgrading; changing website downloads does not upgrade any running gateway.

v2.15.0 summary

Released 1 October 2026. v2.15.0 adds optional weighted WAN load balancing on top of v2.14.0 failover. It is off by default: a single-uplink node or a node with balancing disabled retains the previous behaviour.

Enable network.wan_balance: true with wan_failover_mode: auto to install weighted multipath across healthy balancing-eligible uplinks. wans[].weight sets relative flow weight; this is not bonding or a guaranteed bandwidth ratio.
Set wans[].balance: false to keep a metered uplink eligible for failover but exclude it from balancing.
The manager installs the main default (metric 50), WAN-facing policy defaults, direct-egress grants and DNS pins together. Routine policy applies no longer flatten multipath routes.
A degraded leg is removed after its first failed probe; the checker runs on a five-second cadence. Primary changes still use the failover path before eligible legs are restored.
Interfaces → WAN Uplinks & Failover now includes balancing controls, editable per-uplink options, Save/Reset, validation warnings and installed egress state. The manager API adds egress and balanced.
Failback resolves the wan-failover alert. The stall watchdog follows configured uplinks every 30 seconds, without a restart for newly added interfaces.
Probe tables and marks remain stable per interface across priority edits. Removed uplinks leave the checker and their obsolete masquerade rules are removed.

The project’s Pi test used weights 3:1 and recorded an 8:4 spread over twelve destinations, stable across applies, 22 node checks passed / 0 failed and 9/9 leak checks. Five primary-link outages were tested under balancing; failover to a single leg was recorded at 21 seconds. These observations are not a distribution guarantee or an SLA.

Evidence limit: both test uplinks used the same router and public address. Asymmetric or independent ISPs were not exercised. Balancing remains disabled in the reference node’s normal single-WAN operation. See release verification.

Hosted artifacts

Download original archives: daemon amd64, daemon arm64, CLI arm64. Manifests: hosted files and uncompressed upstream originals.

Original Gitea .gz archives are hosted unchanged and checked against the release description’s uncompressed SHA256 values. The bootstrap verifies both the downloaded archive and the decompressed original binary.

The original daemon binaries exceed the static host’s per-file size limit when uncompressed. Existing raw download URLs therefore serve separately built, stripped compatibility binaries from tag v2.15.0, commit 3d3ca09d. Their checksums differ from the original upstream binaries; use SHA256SUMS for hosted files and UPSTREAM_SHA256SUMS for decompressed originals. The upstream release supplies an arm64 gwctl archive, not an amd64 CLI archive.

The full installer is unchanged in this application release and remains byte-identical to the tag. The website bootstrap adds verified compressed downloads while retaining support for older pinned raw-binary releases.

v2.14.0 summary

Released 30 September 2026. This release adds priority-based WAN failover and recovery, configured through network.wans or Interfaces → WAN Uplinks & Failover.

Internet-reachability probes use per-uplink, device-bound TCP connections rather than relying on first-hop ICMP. Default targets are 1.1.1.1:443 and 8.8.8.8:443; per-uplink probe targets are supported.
A single WAN manager chooses the preferred usable uplink, with a 60-second failback hold, a 30-second minimum dwell and flap pinning after three flaps in ten minutes.
A shared transition updates the default route, policy uplink routes, NAT, tunnel binding, conntrack and DNS pins.
The UI and API expose editable uplinks, manual/automatic mode, health, active/standby state, reasons and timings.
Standby addressing, per-uplink firewall scopes and fail-closed handling are covered. Single-uplink nodes retain their previous behaviour.
Privacy-rule restoration no longer temporarily clears DoH/DoT and STUN block toggles. Other fixes cover a fail-open routing table, missing leak-monitor tunnel information and OpenVPN route-pin cleanup.

The upstream release record reports three primary-link outages on a Raspberry Pi 4: down detection in 20–22 seconds, failover in 21–24 seconds, and 22 passed / 0 failed node checks, with 9/9 leak checks, on the standby. Protected traffic and gateway DNS pause for approximately 10 seconds while tunnels rebind. These are observations from that configuration, not an SLA or an independent audit.

Not included: WAN load balancing or bonding. weight is stored but not used for distribution. The failover alert is not automatically resolved on failback, and a newly added uplink enters the stall watchdog’s watched set after a daemon restart.

The site’s binaries are stripped builds from tag v2.14.0 (source commit fd2d2ffe). Their SHA256SUMS identify these hosted builds, not the artifacts used on the project’s reference node. See Dual-WAN failover for the supported setup.

v2.13.1 summary

v2.13.1 is a verification-driven patch release on top of v2.13.0. Its fixes came from running the product’s own node and leak checks against live reference deployments.

The important operator-facing fixes are:

dns.upstream_mode now reaches the DNS plane, so configured DoT/DoH is actually applied at boot.
Privacy mode no longer downgrades a configured encrypted DNS upstream to cleartext.
Leak checks understand encrypted upstreams instead of reporting them as ISP leaks.
/whoami redacts API keys, bearer tokens, cookies, and proxy credentials.
The node verifier no longer risks disabling Pi-hole while checking role scope.
Automatic rollback stops the service and atomically swaps the binary, avoiding ETXTBSY false-successes.
Release tooling now checks the embedded UI, installer heredocs, installer embeds, shell syntax, builds, vet, and tests together.
Both reference nodes passed 18/18 verification checks and 9/9 leak checks.

Upgrade notes

Before upgrading a live gateway:

Take a backup before replacing the binary.
No configuration change is required for single-uplink or failover-only operation. For a staged rollout, start with wan_failover_mode: manual and balancing off. After checking health and proposed decisions, use auto; opt into wan_balance: true only when intended. Keep a recovery path and allow for session/DNS interruption during a move.
Create a diagnostics-role API key at /root/.gateway-api-key before running scripts/verify-node.sh; without it, API-gated checks are skipped.

Prefer the update mode for an already-installed node:

curl -fsSL https://thegateway.pro/install.sh | sudo env GATEWAY_UPDATE=1 bash

Verify checksums

For the original amd64 release binary:

curl -fsSLO https://thegateway.pro/releases/v2.16.0/SHA256SUMS
curl -fsSLO https://thegateway.pro/releases/v2.16.0/UPSTREAM_SHA256SUMS
curl -fsSLO https://thegateway.pro/releases/v2.16.0/gatewayd-linux-amd64.gz
sha256sum --ignore-missing -c SHA256SUMS
gzip -dk gatewayd-linux-amd64.gz
sha256sum --ignore-missing -c UPSTREAM_SHA256SUMS

For arm64, substitute gatewayd-linux-arm64.gz. Download into an empty directory and require the requested file to report OK. Do not compare a raw compatibility download against the upstream-original manifest.

Installation — install and update commands.
Security disclosure — how to report a security issue.
Operations playbook — routine operational checks.
Performance evidence & release verification — scope of current and historical release results and a reproducible test method.
Troubleshooting — diagnostics for common failures.