dsh-one-gateway: Adding a Loopback Zero Trust Gateway Layer to DSH Web

dsh-one-gateway is a DSH web plugin maintained by TiantianFlow, which places a zero-trust gateway that only listens on the loopback interface in front of DSH. It verifies identity using a precise principal allowlist and supports Tailscale Serve, Cloudflare Access, and Headscale TCP Serve. DSH always remains on 127.0.0.1, and joining a private network does not equate to authorization. This article introduces the installation commands, setup process, three configuration methods for entry points, and their applicable boundaries.