Every field is optional, and every value has a default:

Field	Default	Meaning
`listenHost`	`'127.0.0.1'`	Bind host of the gateway. `'0.0.0.0'` exposes the plain-HTTP leg to the network; prefer loopback plus a tunnel.
`listenPort`	`8080`	Gateway port. `0` asks the OS for a free port.
`upstreamHost`	`'127.0.0.1'`	The harness web server's host.
`upstreamPort`	the running web server's port	Override only when the harness listens somewhere the plugin cannot read.
`loginPath`	`'/login'`	Login form path, and the setup form while no account exists.
`logoutPath`	`'/logout'`	Sign-out path.
`users`	`[]`	Declared accounts, each `{ username, passwordHash, totpSecret }`. An empty list means first-run setup.
`branding.issuer`	`'DeepSeek Harness'`	Product name on the login page.
`totp.digits`	`6`	Code length (`6` or `8`).
`totp.periodSeconds`	`30`	Seconds per time step.
`totp.algorithm`	`'sha1'`	`'sha1'`, `'sha256'`, or `'sha512'`.
`totp.windowSteps`	`1`	Steps accepted either side of the current one.
`session.maxAgeSeconds`	`43200` (12 h)	Session lifetime.
`session.cookieName`	`'dsh_login_session'`	Session cookie name.
`session.secure`	`'auto'`	`'auto'` marks the cookie `Secure` over HTTPS; `'always'` or `'never'` force it.
`rateLimit.maxFailures`	`5`	Failures within the window that trigger a lockout.
`rateLimit.windowSeconds`	`300`	Sliding window length.
`rateLimit.lockoutSeconds`	`300`	Lockout length.
`trustProxy`	`false`	Trust the first `X-Forwarded-For` hop as the client address for throttling.

dsh-login-gateway

同名パッケージの別リポジトリ