DeepSeek Harnesses the Cloudflare Zero Trust Access Plugin

Introduction¶

DeepSeek Harness (DSH) allows users to deploy models locally. Remote access usually requires a public IP address or open inbound ports. This plugin provides authentication and routing through Cloudflare Zero Trust without requiring a public IP address.

Plugin Role¶

sevoniva-labs/dsh-cloudflare-access is a Cloudflare Zero Trust access plugin for DSH. It authenticates through Cloudflare Access and routes through Cloudflare Tunnel, without requiring a public IP address or open inbound ports. The plugin manages Access application, Tunnel, and DNS configurations, while sign-in is handled by Cloudflare.

Installation and Enablement¶

Install the plugin and start DSH:

dsh plugin --profile web add github:sevoniva-labs/dsh-cloudflare-access#v0.1.0-alpha.12
dsh --profile web --host 127.0.0.1

Prerequisites¶

• Official DSH 0.1.6-alpha.2 is required, using Node.js 22.19.0 or later.
• An initialized Cloudflare Zero Trust account and a managed domain are required.
• The Harness host must be able to connect to Cloudflare and remain running during remote use.

Core Features¶

• Cloudflare Access authentication
• Cloudflare Tunnel configuration
• DNS configuration
• No public IP required
• File directory browsing
• Model configuration management
• Connection recovery

Configuration Workflow¶

1. Open the local startup link printed by DSH and go to Settings → Cloudflare Zero Trust Access.
2. Install cloudflared, or specify the path to an existing official executable.
3. Enter the Cloudflare API Token, select a domain, enter the access subdomain, and choose the sign-in method.
4. Enter allowed email addresses. If trusted device restriction is required, enter an existing device check ID.
5. Click “Check Configuration”, verify the resources and access permissions, enter the full access domain, and then click “Publish Configuration”.
6. Wait for the tunnel to connect successfully, then sign in through the HTTPS domain.

The API Token is used only for configuration operations and is not saved persistently. The plugin does not overwrite DNS, Access applications, or Tunnels from other deployments. Device checks must be configured in advance in Cloudflare Zero Trust.

Local configuration override example (cordis.patch.yml):

- id: dsh-cloudflare-access
  name: '@sevoniva/dsh-cloudflare-access'
  config:
    instance: web
    gatewayPort: 3082
    maxTokenAgeSeconds: 7200

Applicable Scenarios and Notes¶

• Permission model: Intended for host owners and trusted administrators only. All authorized users share the same Harness sessions, files, and tool permissions; user isolation is not provided.
• Compatibility: Requires DSH 0.1.6-alpha.2 and Node.js 22.19.0 or later. Automatic installation is not supported on Windows yet.
• Resource isolation: The plugin does not modify official files and only adapts at the local gateway layer. Features must be verified after upgrading DSH.
• Security: The API Token is used only for configuration operations and is not saved persistently. Device checks must be configured in advance in Cloudflare.

Update and Uninstallation¶

When updating, check the compatibility notes for the target Release, replace #v0.1.0-alpha.12 in the install command with the target version, and restart DSH after installation.

For complete uninstallation:
1. Disable the entry point in the plugin settings.
2. Re-enter the API Token, enter the current subdomain, and delete the configuration.
3. After successful deletion, uninstall the plugin: dsh plugin --profile web remove @sevoniva/dsh-cloudflare-access.

A direct uninstallation does not clean up Cloudflare resources.

Ecosystem and License¶

This is an independent community plugin and is not an official DeepSeek or Cloudflare product. It uses the MIT License. The source code is available on GitHub.