DeepSeek HarnessHub
Submit plugin

Luawig/dsh-cloudflare-access ↗★ 0

dsh-cloudflare-access

Cloudflare Access JWT verification and remote DSH privileged authorization

AI Analysis

核心用途是保护暴露在公网的 DSH 实例，利用 Cloudflare Access 进行身份验证。适合将 DSH 部署在云端并通过安全网关进行远程访问的团队或个人。

integrations
Package
dsh-cloudflare-access
Version
0.1.0
License
MIT
Last updated
Aug 27, 2026

Install

$npx -p @deepseek-ai/dsh dsh plugin --profile web add github:Luawig/dsh-cloudflare-access

README

Read the full README ↗

Cloudflare Access configuration

  1. Put the DSH Web origin behind a Cloudflare Access application.
  2. Copy the application Audience (aud) and your team domain, for example https://example.cloudflareaccess.com.
  3. Cloudflare injects Cf-Access-Jwt-Assertion on authenticated requests. The plugin verifies that header only. It does not trust the CF_Authorization cookie.

Issuer and JWKS URL are derived:

issuer  = teamDomain
JWKS    = /cdn-cgi/access/certs

You do not configure issuer or jwksUrl separately. Multiple audiences are supported.

DSH configuration

Pin team domain and audiences with environment variables in production. Env locks the trust root so a remote Settings session cannot retarget another Cloudflare team.

dsh --profile web --trusted-host dsh.example.com
VariableMeaning
DSH_CF_ACCESS_TEAM_DOMAINTeam domain / issuer
DSH_CF_ACCESS_AUDIENCESComma-separated audiences
DSH_CF_ACCESS_ORDINARY_MODEoff | optional | required

If a variable exists, even as an empty string, that field is locked. Environment variables override Cordis / bundle config.

Cordis overlay (only used when the matching env var is unset):

cloudflare:
  teamDomain: https://example.cloudflareaccess.com
  audiences:
    - xxxxxxxxxxxxxxxxx
auth:
  ordinary: off

Missing teamDomain or audiences: the plugin still starts, loopback is unchanged, remote privileged APIs are denied.