dsh-totp-proxy：为 DSH 增加 TOTP 与可吊销会话的反向代理
dsh-totp-proxy 是 realjhen123 维护的 DSH/Cordis 插件与反向代理，在 Nginx 与 DSH 3080 之间监听 3090，用 TOTP 或固定 token 登录后向浏览器签发可吊销的 dsg_session，原始 dsh-auth cookie 留在服务端。需 Node.js 22+，凭据存于 ~/.dsh/dsh-totp-proxy/。部署时仅暴露反代到 3090，3080 本机可达；HTTPS 下设置 COOKIE_SECURE。MIT 0.2.0。
Read Moredsh-public-origin：解决 DSH 插件在反向代理下的回环地址问题
dsh-public-origin 是一个 DSH 插件，旨在解决第三方插件在公网反向代理部署下因回环地址限制而失效的问题。它通过改写 Host 头、处理 iframe 拒绝、集成 DSH 认证机制及修复安全漏洞，实现了在不修改上游代码前提下的安全兼容。安装后需配合 DSH 的 `--trusted-host` 参数及正确的 Nginx 反向代理配置（含 X-Forwarded-* 头）使用。
Read Moredsh-trusted-host-is-loopback: Fixing Host-backed Setting Failures in Reverse Proxy Environments
The DeepSeek Harness (DSH) plugin `dsh-trusted-host-is-loopback` addresses issues where certain features fail when the authenticated Web UI is accessed through a reverse proxy because requests are incorrectly identified as remote. By modifying the client-side determination logic to mark the authentication page as a local loopback request, the plugin restores the availability of Host-backed settings (such as model configuration and API key settings) in reverse proxy scenarios. After installation, restart DSH; no additional configuration is required.
Read Moredsh-remote-trust: Fixing the DeepSeek Harness Settings Interface Behind a Reverse Proxy
When DSH Harness is accessed via a domain name, client-side security policies may classify the request as non-local, rendering the settings page unusable. The `dsh-remote-trust` plugin injects a script that modifies `globalThis` to mark the current domain as a “trusted local” origin, thereby bypassing the `isLoopback` check and restoring normal operation of features such as image persistence. The plugin does not modify source code and supports silent fallback; however, it relaxes security controls and is only suitable for private deployments that have `--trusted-host` configured and are protected by additional authentication.
Read Moredsh-lan-guard: Securely Expose the DSH Web UI to the LAN
dsh-lan-guard is a LAN access plugin for DeepSeek Harness. It forwards the official UI to the LAN through a reverse proxy, providing self-signed HTTPS and QR code access by default. The plugin features gated reverse proxy, device pairing, blocking mechanisms, and dual password authentication. It is simple to configure, requires no source code modifications, and can be used after installation and restart.
Read MoreDeepSeek Harness LAN Reverse Proxy Plugin
To address issues such as the settings panel failing to open and WebSocket disconnections when accessing DeepSeek Harness (DSH) through a reverse proxy, community developer xchannel1987 has provided the dsh-reverse-proxy-xc plugin. This plugin runs as a standalone service (default 0.0.0.0:3090), forwards LAN requests to the main DSH service, and automatically handles header rewriting, authentication injection, and environment compatibility issues, ensuring that the mobile experience is consistent with local usage. Installation requires the CLI command `dsh plugin --profile web add dsh-reverse-proxy-xc`; after enabling the plugin, it can be accessed via your internal IP address. This solution is intended for internal network environments only and should not be exposed to the public internet.
Read Moredsh-remote-gateway: A Secure Reverse Proxy for Remote Access to DeepSeek Harness
The `dsh-remote-gateway` plugin is maintained by RyensX and aims to provide a secure remote access solution for DeepSeek Harness (DSH). It adopts a reverse proxy model: the gateway receives remote requests and handles authentication—including password and IP whitelist support—as well as HTTPS configuration, while the DSH process always listens only on the local `127.0.0.1`, ensuring security. Core features include real-time configuration updates, HTTPS certificate support, IP whitelisting, and Host control. Users need to install it using the official command and configure a password locally on first use. After installation, DSH can be accessed through the gateway address, supporting access via LAN, VPN, or similar tools. This solution is suitable for developers who need to use DSH across multiple devices, but note the dependency on remote tools.
Read MoreDeepSeek Harness (DSH) Plugin: dsh-web-auth
The DSH web process binds to 127.0.0.1 by default, and access exposed via frp is blocked by the host trust fence. The dsh-web-auth plugin runs a reverse proxy inside the DSH process to provide token login and HttpOnly session management for public internet access. It supports token login, cookieless access, WebSocket pass-through, and IP rate limiting for consecutive failures. Installation requires adding the repository to bundles and generating a token file. Configuration is optional, and it listens on port 3081 by default. During deployment, frpc must be used to forward traffic to this gate port. The plugin has zero external dependencies and uses a fail-closed mechanism to ensure the security of the DSH core.
Read MoreDeepSeek Harness Plugin: dsh-https-fix
dsh-https-fix is a plugin that provides external HTTPS access for DeepSeek Harness (DSH). It addresses public network access and secure configuration issues through a built-in reverse proxy, certificate management, and hot-patching. The plugin supports automatic self-signed or user-provided certificates and provides independent Web login authentication. To use it, enter a domain name or IP address on the configuration page and apply the patch with one click. It becomes active after passing 12 validation checks. However, the plugin is high-risk because it modifies the DSH source code at runtime, requiring strict version compatibility. The plugin must be uninstalled before upgrading DSH, and the default password should be changed to prevent security risks.
Read Moredsh-remote-access: TLS Proxy Plugin for Secure Remote Access to DeepSeek Harness
dsh-remote-access is a DSH plugin that acts as a TLS edge entry point for the DSH web service, solving its default local-only access limitation. It provides independent port listening, automatic self-signed certificate generation, username and password login, and session protection. It supports hot configuration of TLS, ports, and accounts via the GUI, as well as transparent HTTP/WebSocket reverse proxying. Users can expose it remotely over LAN or through tunnels such as FRP or Cloudflare. After installation, configure the username and password in the GUI settings panel and start it, then access `https://127.0.0.1:3081`.
Read Moredsh-lan-proxy: Reverse Proxy Plugin Inside the dsh Process
dsh-lan-proxy is an ESM plugin that runs within the dsh process to address the issue that DSH cannot use `--host 0.0.0.0` by default. It provides HTTP/HTTPS dual-stack listening and reverse proxy functionality, supporting TLS, passwordless access via IP whitelisting, one-time login codes, and device management. Configuration can be overridden with a YAML file, and the process must be restarted after installation. Note that it depends on internal implementation details, is compatible with specific versions only, and requires manual cleanup of access logs.
Read Moredsh-web-auth: Password Gate and Reverse Proxy Authentication for DSH Web
`dsh-web-auth` is a security plugin for DSH Web that provides site-wide access control via a login page and an HttpOnly signed cookie, with support for WebSocket and reverse-proxy environments. It includes brute-force protection, session management, remote settings unlocking, and listening-address switching, and stores password data encrypted using scrypt. After installation, you must set a password immediately and enable remote settings via SSH port forwarding or a configuration file to reduce the risk of exposing the web interface directly to the public internet.
Read Moredsh-auth-proxy: A Token Authentication Reverse Proxy Plugin for DSH Web GUI
dsh-auth-proxy is a plugin that provides static token authentication and access control for the DeepSeek Harness (DSH) Web GUI. It listens on a local port, uses a built-in login page and SHA-256 verification, and forwards traffic to the DSH service. The plugin supports HttpOnly session cookies, IP allowlisting, failure lockout, real-time configuration hot reloading, and branding-layer rewriting, and can be deployed without modifying the source code. Note that it does not handle TLS itself; external access requires use with a reverse proxy.
Read Moreomdsh-remctrl: Adding a Remote Access Entry Point to DeepSeek Harness
`omdsh-remctrl` is a remote control plugin for DeepSeek Harness, designed to address the inconvenience of operating from mobile devices. By using a reverse proxy and a Cloudflared tunnel, it exposes the full DSH interface to the public internet, allowing users to view sessions, approve requests, and assign tasks from a phone. Core features include HTTP/WebSocket forwarding, password authentication, automatic tunnel generation, and mobile optimization. The plugin is disabled by default and must be manually enabled in the Plugin Center. Security relies on DSH’s session mechanism and rate limiting. Installation requires a Node.js environment, involves minimal configuration options, and supports using either the default Cloudflare tunnel address or a custom domain.
Read Moredsh-login-gateway: Adds login gatekeeper and reverse proxy for DSH Web UI
dsh-login-gateway is a DeepSeek Harness plugin developed by runfali, designed to provide controlled external access to the dsh Web UI, which listens exclusively on the local loopback interface. The plugin provides a username/password login interface at 0.0.0.0:3081; upon successful authentication, it performs full reverse proxying of HTTP and WebSocket requests to the local 3080 port while automatically rewriting request headers to pass dsh's trust verification. Built on Node.js 22+, the project features zero runtime dependencies and is released under the MIT license. It employs a zero-intrusion design, ensuring the installation process does not modify any existing dsh files or configurations. Core security features include login rate limiting based on IP and username, User-Agent session binding, and automatic credential revocation upon password changes.
Read Morerice-awa/dsh-lan-gateway: A plugin to securely expose the DSH Web GUI to the LAN / Public Network
`rice-awa/dsh-lan-gateway` is a DSH plugin designed to securely expose the DSH Web GUI to a local area network (LAN) or the public internet. It resolves the security trade-off where DSH binds exclusively to 127.0.0.1 (preventing access from other devices) versus directly listening on 0.0.0.0 (which poses security risks) by employing a reverse proxy gateway. The plugin maintains DSH's local binding and establishes a separate gateway to forward requests, implementing a source-based access control strategy: LAN and local sources have password-free access, while non-LAN sources require verification via a login page and HMAC session cookies. The plugin supports optional TLS (with self-signed or custom certificates), rate limiting, CSRF protection, and hot configuration management. Users can enable, configure passwords, and monitor status via the `lan_gateway` command or DSH chat.
Read MoreNginx Load Balancing: Simple Configuration for Multi-Server Traffic Distribution
This article introduces Nginx load balancing configuration to solve the problem of excessive load on a single server. At least two backend servers running the same service are required, with Nginx installed and the backend ports open. The core configuration consists of two steps: first, define the backend server group using `upstream` (supporting round-robin, weight, and health checks, e.g., `server 192.168.1.100:8080 weight=2;` or `max_fails=2 fail_timeout=10s`); second, configure `proxy_pass` to this group in the `server` block, passing the client's `Host` and real IP (`proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr;`). Verification involves running `nginx -t` to check syntax, `nginx -s reload` to restart, and testing access to confirm request distribution. Common issues such as unresponsive backends or configuration errors can be resolved by checking firewalls and logs. Advanced strategies include IP hashing (`ip_hash`) and URL hashing (requires additional module).
Read More