dsh-full-remote

Usage

Starting and stopping

On the settings page, press Start proxy to start the listener and Stop proxy to stop it.

Listen address

Bind	Purpose
127.0.0.1 (default)	The tunnel runs on the same machine
192.168.x.x	A device on the same network, without a tunnel
0.0.0.0 / ::	Bind every interface. This is not an address to open; the panel reports a separate reachable address.

The listen address can be changed at runtime and persists across restarts. If a new address fails to bind, the proxy rolls back to the previous working address.

The copyable tunnel target (and any extra reachable URL the panel lists) is what a remote client should open. Binding 0.0.0.0 only listens; it is not a URL.

backendHost is the address the proxy connects to, not the address it listens on. Keep it at 127.0.0.1.

Phone invite

The QR encodes a one-time login URL. Public / reachable Origin is the host the scanning device will request: the tunnel's https://…, or the LAN URL from the panel. Leave it empty only when the tunnel target above is already that address.

Do not put 127.0.0.1 in Origin. That address is the Harness machine; a phone would open its own loopback and never reach the proxy.

Then press Generate invite. After a scan (or opening the link) the login page submits once. The invite expires in 15 minutes, works once, and does not contain the standing token.

Upgrade

dsh plugin forwards to pnpm. If you installed with an exact pin such as add dsh-full-remote@0.2.4, a bare update dsh-full-remote reports Already up to date and stays on the old version. To jump to the latest npm release:

dsh plugin --profile web update --latest dsh-full-remote

Then restart dsh web. --latest ignores the current range, installs the newest version, and rewrites package.json. For a specific version use dsh plugin --profile web update dsh-full-remote@0.2.5.

Configuration

Common options:

- id: reverse-proxy
  name: dsh-full-remote
  config:
    listenHost: 127.0.0.1
    listenPort: 3081
    approvalMode: false          # true: approve each new device locally
    allowedCidrs: []             # e.g. ["192.168.1.0/24"]; empty: any IP after login
    trustForwardedFor: false     # true: trust CF-Connecting-IP / rightmost X-Forwarded-For from a trusted local tunnel
    upgradeMaxAttempts: 10       # failed WebSocket upgrades before lockout
    upgradeLockoutSeconds: 300   # lockout for repeated failed WebSocket upgrades
    headersTimeoutMs: 15000      # timeout for request headers
    requestTimeoutMs: 120000     # timeout for the complete request; effective value is >= headersTimeoutMs
    sessionIdleSeconds: 0        # 0: off; otherwise idle timeout in seconds
    auditLog: true
    allowTokenRead: true         # false: token only returned on rotation
    tlsCertFile: ""              # optional local HTTPS
    tlsKeyFile: ""

The complete option list, with defaults and validation, is defined in the package Config schema (src/index.ts).

Two points to note:

• Installing the plugin pins the in-app directory picker so that a phone can add workspaces. Do not re-enable the stock directory-picker row in the same profile.
• backendHost must remain a loopback address. A wildcard or non-loopback value is rejected at load time.