Foreword¶

DSH itself only listens on loopback and does not accept a wildcard --host, so the Web GUI is only accessible locally by default. To open the panel on a phone or tablet on the local area network, you must either manually add --trusted-host or start an HTTP proxy that rewrites the Host header. The former is prone to misconfiguration, while the latter adds an extra layer of maintenance.

The miiy/dsh-access-gateway introduced below is designed for this scenario: it starts a password-protected listening port on the local machine, and after successful login, forwards the browser to the GUI on loopback, automatically carrying the current process’s launch token.

What is it¶

dsh-access-gateway is maintained by miiy and distributed via the community directory skillhub.cn. The repository is at https://github.com/miiy/dsh-access-gateway, licensed under MIT, and the current version is 0.1.0. It solves a single problem: allowing other devices on the local area network to access the DSH Web GUI without needing to manually pass around tokens.

DSH’s ecosystem philosophy is “everything is a plugin.” This plugin is a client bundle that registers runtime behavior with the host process. The directory site is an independent site and has no official affiliation with DeepSeek / Hypothesis.

Core Features¶

1. Password-gated listening: By default, it listens on port 3081. Requests without the gateway cookie first receive a password page. Upon passing, it returns a 302 to /?token=<launch token> and writes a cookie to the browser.
2. Token not handled by end devices: The current DSH process’s launch token is used for forwarding, so phones and tablets do not need to know this token.
3. Byte-pipe forwarding: For each connection, only the headers of the first request are read. After verification, subsequent traffic is moved directly by bytes. Consequently, HTTP keep-alive and WebSocket upgrades work normally, and the gateway does not need to understand these protocols.
4. Runtime registration of trusted sources: When the plugin starts, it registers its listening address into the Host’s accepted-authority list. Therefore, /api and WebSocket accept the Host header sent by the browser, and the host does not require extra startup parameters. When set to 0.0.0.0, all interface addresses will be registered.
5. Login page follows GUI theme: The login page inlines the Web GUI theme’s token, follows the system’s light/dark mode, and outputs Chinese or English text based on Accept-Language.
6. Password stored as hash: The Host only stores the scrypt hash, not the plaintext; when the password is incorrect, it waits for 600 ms before replying.

Installation and Activation¶

There are two ways to install, differing in whether it is enabled simultaneously.

The first way is to let the agent call the host’s installBundle, completing installation, writing to dsh.profile.bundles, and taking effect hot in one step:

install the plugin 'github:miiy/dsh-access-gateway'

You can also paste the same spec into the installation box in Settings → Plugins.

The second way is to install via CLI. This step only installs the package and does not combine it into the profile:

dsh plugin --profile <profile> add github:miiy/dsh-access-gateway

After that, you need to go to Settings → Plugins to toggle the switch for it to be added to dsh.profile.bundles; if the switch does not take effect in real-time, restart dsh web. Installation from a local checkout is also possible:

dsh plugin --profile <profile> add /path/to/dsh-access-gateway

This bundle is pure JavaScript with no build scripts, so allowBuilds approval is not needed when installing from git.

After installation, just start the host as usual; no extra startup parameters are needed.

Typical Usage¶

After installation, enable it in Settings → Plugins, then go to the Web GUI Settings page and find the Access section. This section displays whether the listener is online and the entry URL. It also creates buttons for local network interface addresses below the address bar; clicking one fills it in without needing to remember or type the IP.

The four items to change are address, port, session duration, and password. There is a save button for each form. After saving, the listener restarts immediately without needing to restart the Host.

After setting up, open the entry address from another device on the local area network (e.g., http://192.168.0.10:3081), log in with the password once, and the session will be retained for 30 days by default. The default port is 3081 and needs to be distinguished from the Web GUI’s own port.

If no password is set, the login page does not appear: any request that can connect to the address enters the GUI directly. This is most convenient on a fully trusted network, but is incorrect on an untrusted network.

To completely skip gateway verification, you can use --trusted-host to manually specify the source. If the plugin detects that the host does not have an extensible accepted-authority list, it will log the result:

dsh --profile web --trusted-host 192.168.0.10

Configuration Options¶

The configuration saved in the Settings page is written to ~/.dsh/dsh-access-gateway/settings.json, taking precedence over the default values below:

The upstream address is read from the webServer service, so the GUI’s port does not appear in this configuration.

Security and Limitations¶

Points to be clear about:

1. Listening is plaintext HTTP; it should only be used for trusted networks or VPNs; if exposing externally, add TLS in front yourself.
2. The password is the only barrier between the trusted network and the GUI; if no password is set, the Host will log a warning, and the entry will be marked as open in Settings.
3. The gateway runs inside the Host process, so it can read the launch token; it does not hold other credentials, and the password is stored as a hash only.
4. The gateway cookie’s signing key is in ~/.dsh/dsh-access-gateway/secret.json (permissions 0600), so the logged-in state remains valid after the host restarts.
5. Each profile only supports one address; to have two interfaces respond simultaneously, you need two lines, each with a different bind and port.
6. No TLS, no tunnel, no QR code. It is an entry point for an already trusted network, not a tool to publish the GUI to the public internet.

Use Cases and Precautions¶

Suitable for: People running DSH on a local network at home or the office who want to open the Web GUI on a phone, tablet, or second computer for viewing and configuration; people who don’t want to manually maintain --trusted-host or run a separate proxy for remote access.

Pre-installation recommendation: This plugin runs with the permissions of the current DSH process and can read the launch token inside the process. Before installing, check the source code in the repository first. The license is MIT, so please confirm there are no unexpected behaviors before enabling; the same applies to installation specs obtained from third-party sources. The repository currently has 0 stars, few users, and if you encounter problems, it is recommended to report them directly on GitHub Issues.

Conclusion¶

This plugin is designed to be concise: it does not touch protocol semantics, only performs one password check and one byte forwarding, incidentally solving the Host header availability issue. If you only need a LAN entry point, it is one step simpler than manually configuring --trusted-host and one layer of maintenance less than a full HTTP proxy.

• Directory page: https://www.skillhub.cn/plugins/miiy/dsh-access-gateway
• Repository: https://github.com/miiy/dsh-access-gateway