dsh-auth-gateway
保护 DeepSeek Harness Web 应用的 Passkey (WebAuthn) 反向代理网关
AI 分析
核心用途是为 DSH 提供基于 Passkey 的安全身份验证。适合需要通过反向代理保护 Web 访问，并使用 WebAuthn 凭证进行免密登录的安全部署任务。
安装
此插件尚未提供可验证的 bundle，或兼容性检查未通过。请先阅读仓库说明。 阅读完整 README ↗
说明文档
阅读完整 README ↗Configuration (environment)
| Var | Default | Meaning |
|---|---|---|
DSH_GW_RP_ID | ds.tokencv.com | WebAuthn Relying Party ID — the exact public host in the address bar. Passkeys are scoped to it. |
DSH_GW_ORIGIN | https:// | Expected origin of WebAuthn responses. |
DSH_GW_RP_NAME | DeepSeek Harness | Display name in the OS passkey picker and login page. |
DSH_GW_TARGET | http://127.0.0.1:3080 | The dsh web app to proxy authed traffic to. |
DSH_GW_HOST / DSH_GW_PORT | 127.0.0.1 / 3090 | Where the gateway listens. |
DSH_GW_STATE_DIR | ~/.dsh-gateway/state | Credentials, sessions, signing secret. dsh-approve must be given the same value. |
DSH_GW_PUBLIC_DIR | ` | |
| /public` | Login page assets. | |
DSH_GW_USER_NAME / DSH_GW_USER_DISPLAY | herb / Herb | The single account passkeys enrol under. |
DSH_GW_COOKIE_NAME | dsh_auth | Session cookie name. |
DSH_SESSION_TTL_HOURS | 24 | Cookie freshness before the passkey must be re-proven. |
DSH_BIND_SESSION_IP | 0 | 1 refuses a cookie replayed from a different IP (off by default — roaming changes IPs). |