dsh-auth-gateway
Passkey (WebAuthn) reverse-proxy gateway that guards a DeepSeek Harness web app 核心用途是为 DSH 提供基于 Passkey 的安全身份验证。适合需要通过反向代理保护 Web 访问，并使用 WebAuthn 凭证进行免密登录的安全部署任务。
Other repositories with this package name
Install
This plugin has no verified bundle, or compatibility checks failed. Read the repository notes first. Read the full README ↗
README
Read the full README ↗Configuration (environment)
| Var | Default | Meaning |
|---|---|---|
DSH_GW_RP_ID | ds.tokencv.com | WebAuthn Relying Party ID — the exact public host in the address bar. Passkeys are scoped to it. |
DSH_GW_ORIGIN | https:// | Expected origin of WebAuthn responses. |
DSH_GW_RP_NAME | DeepSeek Harness | Display name in the OS passkey picker and login page. |
DSH_GW_TARGET | http://127.0.0.1:3080 | The dsh web app to proxy authed traffic to. |
DSH_GW_HOST / DSH_GW_PORT | 127.0.0.1 / 3090 | Where the gateway listens. |
DSH_GW_STATE_DIR | ~/.dsh-gateway/state | Credentials, sessions, signing secret. dsh-approve must be given the same value. |
DSH_GW_PUBLIC_DIR | ` | |
| /public` | Login page assets. | |
DSH_GW_USER_NAME / DSH_GW_USER_DISPLAY | herb / Herb | The single account passkeys enrol under. |
DSH_GW_COOKIE_NAME | dsh_auth | Session cookie name. |
DSH_SESSION_TTL_HOURS | 24 | Cookie freshness before the passkey must be re-proven. |
DSH_BIND_SESSION_IP | 0 | 1 refuses a cookie replayed from a different IP (off by default — roaming changes IPs). |