DeepSeek Harness (DSH) Web UI is bound to 127.0.0.1 by default and cannot be accessed directly from other devices on the local area network. The dsh-lan-guard plugin opens a gated reverse proxy on an additional port to forward access to the official UI. It uses self-signed HTTPS by default and provides a QR-code access method.
Plugin Introduction¶
dsh-lan-guard is a DeepSeek Harness community plugin maintained by idoall. Its core purpose is to add a secure local area network access entry point without modifying DSH source code or its own listening configuration. It implements access control through a gated reverse proxy and provides self-signed HTTPS certificates and QR-code access by default.
Core Features¶
- Gated reverse proxy: The plugin starts a listener in addition to the DSH port, forwarding HTTP and WebSocket traffic—including the official UI’s
/api/remote.muxlong-lived connection—and handling Host/Origin rewriting and header stripping. If the upstream service is unavailable, it returns a 502 error. - Self-signed HTTPS and CA trust: It generates a
DSH LAN Guard CAby default and issues a certificate for the current network adapter address. Changing the IP only reissues the leaf certificate, without requiring the CA to be retrusted. - QR-code access and device pairing: Provides a scan-to-access entry. A device that first verifies the access password is paired and receives an HttpOnly device identity cookie. Authorized devices can be viewed, revoked, or permanently blocked.
- Dual password mechanism: Uses PBKDF2-SHA256 with 600,000 iterations. The access password is used for device sign-in, while the administrator password unlocks the admin console in the settings page. A no-password link is provided by default, but configuring a password is recommended.
- Settings within the official page: All configuration is available in the “LAN Access” section of DSH’s official settings page, without replacing the official layout.
Installation and Enablement¶
Install the plugin using the official command:
dsh plugin --profile web add dsh-lan-guard@latest
After installation, DSH must be restarted to activate the plugin.
Configuration and Usage¶
In the “LAN Access” section of DSH’s official settings page, there are usually four tabs. The configuration steps are as follows:
- Set the access password: Under the “Security Authentication” tab, set an access password (recommended length is at least 8 characters). Before a password is set, the gateway denies all device access.
- Check the listening scope: Under the “Connection and Certificates” tab, confirm the listening scope (default is LAN
0.0.0.0). This setting determines the externally exposed IP address and the addresses covered by the self-signed certificate. - Access via QR code: Under the “QR Access” tab, scan the generated QR code. When opening the link in a mobile browser, trust the
DSH LAN Guard CAcertificate the first time, then enter the access password and name the device.
Notes¶
- Remote devices are read-only by default: Remote devices default to
adminPolicy: local_onlyand cannot modify plugin settings. If mobile management is required, the policy must be changed on the desktop client. - Restart required: DSH must be restarted after installation for the changes to take effect.
- No manual configuration required: The plugin does not require hand-written configuration files to run.
Conclusion¶
dsh-lan-guard provides developers with a way to use DSH over a local area network without complex network configuration. Its device pairing and blocking mechanisms provide a basic security boundary. For more details, please refer to the GitHub repository or the plugin catalog.
