remote-my-dsh

常用配置 / Common Configuration

/gateway.yml（默认 ~/.dsh/profiles/web/gateway.yml）：

字段	默认	说明
port	3443	监听端口
tls	off	auto = 自签，`` = 真证书
crypto	auto	数据面自加密
session	browser+2h	浏览器在线，断线保存 2 小时可续
refresh	12h	"记住此设备"恢复凭据有效期
tokenLifetime	permanent	访问令牌自动轮换周期：once = 登录成功后立即轮换一次；时长档到期自动轮换；permanent = 不自动轮换。轮换不杀已保持会话，但会使已记住设备的免登录恢复失效

Field	Default	Description
port	3443	Listening port
tls	off	auto = self-signed, `

` = a real certificate |

| crypto | auto | Self-encryption of the data plane | | session | browser+2h | Browser-online sessions; resumable for 2 hours after disconnect | | refresh | 12h | Validity of the "Remember this device" recovery credential | | tokenLifetime | permanent | Automatic access-token rotation period: once = rotate once right after a successful login; a duration rotates on expiry; permanent = never rotate. Rotation keeps live sessions alive but invalidates "remembered device" auto-login |

重要提示：不配 TLS 的远程访问是明文 HTTP——数据内容是加密的，但页面本身无法防御主动中间人攻击。在不可信网络或传输敏感内容时，请先配置 tls: auto（自签证书）或真实证书。

Important: remote access without TLS is plaintext HTTP — the data content is encrypted, but the page itself cannot defend against an active man-in-the-middle. On untrusted networks or when transmitting sensitive content, configure tls: auto (self-signed) or a real certificate first.