常用配置 / Common Configuration

/gateway.yml（默认 ~/.dsh/profiles/web/gateway.yml）：

字段	默认	说明
`port`	`3443`	监听端口
`tls`	`off`	`auto` = 自签，`` = 真证书
`crypto`	`auto`	数据面自加密
`session`	`browser+2h`	浏览器在线，断线保存 2 小时可续
`refresh`	`12h`	"记住此设备"恢复凭据有效期
`tokenLifetime`	`permanent`	访问令牌自动轮换周期：`once` = 登录成功后立即轮换一次；时长档到期自动轮换；`permanent` = 不自动轮换。轮换不杀已保持会话，但会使已记住设备的免登录恢复失效

Field Default Description
port 3443 Listening port
tls off auto = self-signed, `

` = a real certificate |

| crypto | auto | Self-encryption of the data plane | | session | browser+2h | Browser-online sessions; resumable for 2 hours after disconnect | | refresh | 12h | Validity of the "Remember this device" recovery credential | | tokenLifetime | permanent | Automatic access-token rotation period: once = rotate once right after a successful login; a duration rotates on expiry; permanent = never rotate. Rotation keeps live sessions alive but invalidates "remembered device" auto-login |

重要提示：不配 TLS 的远程访问是明文 HTTP——数据内容是加密的，但页面本身无法防御主动中间人攻击。在不可信网络或传输敏感内容时，请先配置 tls: auto（自签证书）或真实证书。

Important: remote access without TLS is plaintext HTTP — the data content is encrypted, but the page itself cannot defend against an active man-in-the-middle. On untrusted networks or when transmitting sensitive content, configure tls: auto (self-signed) or a real certificate first.

remote-my-dsh

AI 分析

インストール

ドキュメント

常用配置 / Common Configuration