dsh-lan-gate

English | 中文

Password gate + CIDR allowlist + proxy-header deny for DeepSeek Harness web.

dsh web --host 0.0.0.0 is rejected by the CLI. This bundle sets webserver.host to 0.0.0.0 through the official composition layer, then requires a password before the UI or /api is reachable from the LAN.

Install

dsh plugin --profile web add dsh-lan-gate

Or from GitHub:

dsh plugin --profile web add github:maxesisnclaw/dsh-lan-gate

Then open http://127.0.0.1:3080/dsh-lan-full/login and set a password (loopback only). After that, LAN clients get the login page.

Settings → LAN access / LAN 访问 edits CIDRs, proxy-header policy, and the password. The settings section and login page follow dsh's official zh/en locale.

What it does

Control	Default
Listen on all interfaces	yes (bundle patch)
Password	unset until you set it from loopback
Inbound IPv4 CIDRs	10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Reject X-Forwarded-* / Forwarded / Via	yes
Loopback bypasses password	yes (recovery)

Policy file: $DSH_HOME/lan-gate.json (mode 0600). The password is stored as a scrypt verifier, never as plaintext. Session tokens are random 32-byte values; only their SHA-256 is kept in memory.

Residual risk

This is not a TLS terminator. On plain HTTP a LAN observer can still sniff the password and cookie. Do not put this on the public internet. Do not sit it behind a reverse proxy that adds forwarding headers — those requests are rejected on purpose.

See SECURITY.md.

License

MIT