DeepSeek HarnessHub
플러그인 제출

bamboostrip/dsh-access-gate ↗★ 1

dsh-access-gate

DSH plugin: password gate for remote (non-loopback) /api access (passwordless by default), unblock the loopback-pinned privileged endpoints, restore everything on uninstall, and give the local 127.0.0.1 user the native OS folder picker for workspace selection. Zero residue by design. TypeScript source, compiled output.

AI 분석

核心用途是远程部署的安全防护。适合将 DSH 部署在公网或局域网服务器上，需要防止未授权访问的安全敏感用户。

integrations생산성
패키지
dsh-access-gate
버전
0.4.0
라이선스
MIT
최근 업데이트
2026. 8. 15.

설치

$npx -p @deepseek-ai/dsh dsh plugin --profile web add github:bamboostrip/dsh-access-gate

문서

전체 README 읽기 ↗

① 推荐：DSH 设置界面 → 插件配置 → 访问认证 卡片

使用

  • 默认无密码：远程（公网域名 / 局域网 IP）直接访问。
  • 设置密码后：本机 http://127.0.0.1:3080 免密；远程首次访问 302 到登录页，登录后 7 天内免登录（有效期可配）。
  • nginx 与 DSH 同机时（remote 恒为 127.0.0.1 但 Host 是域名）同样需要密码 —— 公网流量无法绕过认证。
  • 登录态在内存：DSH 进程重启后需重新登录。

公网 nginx 参考配置

server {
    listen 443 ssl;
    server_name codsh.famlife.top;
    # ssl_certificate ...; ssl_certificate_key ...;

    location / {
        proxy_pass http://10.144.144.7:3080;   # 家里 DSH
        proxy_http_version 1.1;                # ★ 必须（默认 1.0 会断 WS）
        proxy_set_header Host $host;           # 域名原样转发
        proxy_set_header Upgrade $http_upgrade;        # ★ WS 必需
        proxy_set_header Connection "upgrade";         # ★ WS 必需
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_buffering off;
    }
}

公网 403 排查清单见 NOTES.md。

可选配置（profiles/web/cordis.patch.yml 覆盖 auth-gate 行）

- id: auth-gate
  config:
    # password: 'xxx'                        # 可选：行配置密码（最高优先）
    trustedRemotePrefixes: ['10.144.144.0/24']   # 内网网段免密（IPv4 CIDR）
    tokenTtlMs: 604800000                  # 登录有效期，默认 7 天

① Recommended: DSH Settings → Plugin configuration → "Access authentication" card

Usage

  • Passwordless by default: remote access (public domain / LAN IP) works directly.
  • With a password: local http://127.0.0.1:3080 stays password-free; remote first visit is 302-redirected to the login page; logged-in sessions skip login for 7 days (configurable).
  • When nginx runs on the same host as DSH (remote is always 127.0.0.1 but Host is a domain), a password is still required — public traffic cannot bypass authentication.
  • Login state lives in memory: a DSH restart requires re-login.

Optional configuration (override the auth-gate row in profiles/web/cordis.patch.yml)

- id: auth-gate
  config:
    # password: 'xxx'                        # optional: row-level password (highest priority)
    trustedRemotePrefixes: ['10.144.144.0/24']   # password-free LAN CIDRs (IPv4)
    tokenTtlMs: 604800000                  # login TTL, default 7 days