dsh-login-gateway: Add TOTP Login to the DeepSeek Harness Web UI
`dsh-login-gateway` is a security authentication plugin for DeepSeek Harness (DSH) that adds username, password, and TOTP two-factor authentication in front of the Web UI. It listens on a dedicated port, performs server-side token exchange with Harness using an HMAC cookie, and supports traffic forwarding, rate limiting, and initial setup. It must be placed behind a reverse proxy (such as Caddy), and accounts should be managed using scripts. Installation requires specific environment prerequisites; if build issues occur during installation, configure `allowBuilds`. This plugin addresses the security risks associated with exposing DSH's default authentication mechanisms to the public internet.
Read Moredsh-login-gateway: Adds login gatekeeper and reverse proxy for DSH Web UI
dsh-login-gateway is a DeepSeek Harness plugin developed by runfali, designed to provide controlled external access to the dsh Web UI, which listens exclusively on the local loopback interface. The plugin provides a username/password login interface at 0.0.0.0:3081; upon successful authentication, it performs full reverse proxying of HTTP and WebSocket requests to the local 3080 port while automatically rewriting request headers to pass dsh's trust verification. Built on Node.js 22+, the project features zero runtime dependencies and is released under the MIT license. It employs a zero-intrusion design, ensuring the installation process does not modify any existing dsh files or configurations. Core security features include login rate limiting based on IP and username, User-Agent session binding, and automatic credential revocation upon password changes.
Read More