Preface¶

The DSH Web GUI is primarily designed for local access. When developers wish to access the Harness from LAN devices or the public internet, three things need to be addressed: the Web GUI’s binding address, NAT traversal, and password authentication for the access entry point.

chicheng-gate is a DSH Web GUI plugin that brings remote access control, frpc NAT traversal, panel password authentication, and mobile UI adaptation into a single settings panel. By performing security confirmation first, then configuring passwords and access methods, it reduces the steps of manually editing configurations and manually managing processes.

What Is This¶

chicheng-gate is positioned as: DSH Web GUI plugin: remote access control + frpc NAT traversal + panel password authentication + mobile UI adaptation.

The maintainer is 534119219, and the license is MIT. It primarily addresses the following issues:

• The Web GUI was originally designed for local access only, requiring binding address changes when enabling remote access.
• When exposing the panel to the public internet via frpc, the panel needs to pass through a password gateway before being forwarded.
• Non-local access requires password verification while preserving the convenience of local access.
• Mobile device access requires mobile CSS adaptation.

Core Features¶

Remote Access Switch¶

The remote access switch is used to toggle the Web GUI’s binding address:

• When enabled, it switches the Web GUI to bind to 0.0.0.0, allowing access from LAN devices.
• When disabled, it reverts the related modifications.

Note that enabling remote access binds the Web GUI to 0.0.0.0. At this point, any device on the LAN can access the Web GUI, so this should only be used on trusted networks.

frpc NAT Traversal¶

frpc NAT traversal is used to expose the panel to a public frps server. The plugin automatically downloads and launches frpc, and also supports real-time enabling or stopping.

frpc configuration options include:

• Server address
• Port
• Token authentication
• Local port
• Remote port

The automatic frpc download includes SHA256 verification; if the download fails, it can fall back to a manual path.

Panel Password Authentication¶

Panel password authentication requires non-local access to pass password verification first. Non-local access includes:

• LAN access
• frpc tunnel access

Local 127.0.0.1 access does not require a password.

Passwords are stored using scrypt salted hashing, with no plaintext saved. The password gateway also includes:

• Session cookies
• Login rate limiting: 5 attempts/min/IP
• 7-day sessions

Independent Password Gateway¶

The frpc tunnel does not directly forward to the DSH main port. Access requests first go through a local password gateway, which forwards to the DSH main port only after verification passes.

This ensures that public tunnel access must also enter the panel password, while not affecting password-free access from local 127.0.0.1.

Mobile UI Adaptation¶

The plugin injects mobile-adaptive CSS to improve the interface display when accessing the Web GUI from mobile devices.

First-Time Security Confirmation and randomUUID Patch¶

On first use, you need to read and confirm the security risks before the relevant switches are unlocked.

The plugin also includes a crypto.randomUUID patch to fix the missing randomUUID issue in LAN HTTP environments.

Installation and Enablement¶

Execute the following command in the shell to add chicheng-gate to the web profile:

dsh plugin --profile web add github:534119219/chicheng-gate

After installation, go to the Web GUI’s settings page and select “ChiCheng Gateway” in the sidebar to see the relevant configuration cards.

Typical Usage¶

Below is a set of steps that can be performed in sequence.

1. Open the Web GUI, go to “Settings,” and select “ChiCheng Gateway” in the sidebar.

2. On first entry, check “I have read and understood the above security risks,” then click “Agree.”

3. In the “Panel Password” card, enter a password of at least 8 characters and save.

4. If public internet access is needed, fill in the “NAT Traversal (frpc)” card with:

• Server address
• Port
• Token
• Local port
• Remote port

5. Enable switches based on the access scope:

• LAN access: enable the “Remote Access” switch.
• Public internet access: enable “Enable frpc.”

6. After changes to remote access and frpc configurations, you need to restart dsh web.

The frpc enable/disable switch itself takes effect in real time, but changes to frpc configuration options and remote access configurations require a restart of dsh web to take effect.

7. Access using the corresponding addresses:

• LAN access: http://<local-IP>:3080
• Public frpc tunnel access: http://<frps-public-IP>:<remote-port>

Public frpc tunnel access will require entering the panel password on first attempt.

Applicable Scenarios and Notes¶

Suitable for the following scenarios:

• Want to access the DSH Web GUI from within the LAN.
• Want to access the DSH Web GUI from the public internet via frpc tunnels.
• Want to add password authentication for non-local access.
• Want mobile CSS adaptation when accessing the Web GUI from mobile devices.

Notes before use:

• Enabling remote access binds the Web GUI to 0.0.0.0, allowing any device on the LAN to access it.
• Enabling frpc NAT traversal exposes the panel to the public internet.
• Non-local access includes LAN access and frpc tunnel access, both of which require password verification first.
• Local 127.0.0.1 access does not require a password.
• Login rate limiting is 5 attempts/min/IP.
• The frpc enable/disable switch takes effect in real time, but frpc configuration and remote access configuration changes require a restart of dsh web.
• Automatic frpc download includes SHA256 verification; on failure, it can fall back to a manual path.
• The plugin runs with the permissions of the current dsh process; you should review the source code and license before installation.

Related Links¶

• GitHub: https://github.com/534119219/chicheng-gate
• Directory page: https://www.skillhub.cn/plugins/534119219/chicheng-gate