dsh-web-lan-access

Usage

The plugin is self-contained: its bundle patch sets the webserver bind host to 0.0.0.0 directly (the CLI flag --host 0.0.0.0 is hard-rejected for safety on newer harness versions, but the webserver config still accepts it — so no source changes and no --host flag are needed; the CLI --port flag still works).

1. Install the plugin, then start normally — without --host:

   dsh --profile web --port 3080
   

   When bound to 0.0.0.0, the harness automatically adds every local non-internal IPv4 to the /api trust fence (resolveLanTrust) — LAN IP access needs no extra config.

   If you prefer NOT to let the plugin take over the bind host (e.g. you want loopback + a port forward), keep the webserver row override out of your tree and instead forward a port (socat / rinetd / Tailscale serve) from 127.0.0.1:3080, adding the forwarded address to trustedHosts manually.

2. Domains / remote (e.g. Tailscale) — add your own authorities to trustedHosts:

   - id: web-runtime
     config:
       trustedHosts:
         -             # e.g. myhost — MUST be listed separately!
         - .tailXXXX.ts.net  # full domain
         - 100.x.x.x               # tailnet IP
   

   ⚠️ The fence compares the Host header literally: a MagicDNS short name (http://myhost:3080) is not the full domain — list the short name on its own line, or every /api call returns 403 (page shell loads, sessions/models absent).