Introduction

In the plugin-based usage of DeepSeek Harness (DSH), some scenarios require accessing the local dsh Web UI from other machines. The dsh Web UI defaults to listening on 127.0.0.1:3080 and does not provide a direct entry point to the outside. dsh-login-gateway, maintained by runfali, adds an external login entry; after successful login, it reverse proxies requests to the local dsh Web UI.

What is this

dsh-login-gateway is the DeepSeek Harness (dsh) login gatekeeper plugin. It provides a login entry on 0.0.0.0:3081 by default; after visitors log in with a username and password, HTTP and WebSocket requests are fully reverse proxied to the dsh Web UI on 127.0.0.1:3080.

Verified information indicates the project license is MIT, the package.json declares version 0.2.0, requires Node 22+ ESM, and declares zero runtime dependencies, using only Node.js built-in modules. It does not modify any files in the dsh installation directory, nor does it alter dsh’s own configuration logic; installation/uninstallation only affects the profile directory and requires a restart of dsh to take effect.

Core Features

  • External Entry: Provides a login entry on 0.0.0.0:3081 by default.
  • Username/Password Login: After successful login, an HttpOnly + SameSite=Strict session cookie is set.
  • Full Reverse Proxy: After login, proxies to 127.0.0.1:3080, supporting HTTP and WebSocket.
  • Request Header Rewriting: Rewrites Host, Origin, and Sec-Fetch-Site to a loopback form during reverse proxy so dsh trusts and allows the traffic.
  • One-time Initialization: No default account on fresh install; create an admin via /setup and a one-time token.
  • Rate Limiting and Throttling: Limits login and initialization by both IP and username dimensions; can lock failed attempts. There is also a global authentication throttle.
  • Session Control: Sessions bind to User-Agent; password changes automatically revoke other sessions.
  • Optional Security Items: Self-signed TLS, secureCookie, audit logs, security response headers, and anti-request-smuggling handling for reverse proxy.
  • Zero Intrusion: Does not modify files in the dsh installation directory, nor does it change dsh’s own configuration logic.

Installation and Enablement

Install using the local directory. Replace /path/to/dsh-login-gateway with the actual plugin directory:

dsh plugin --profile web add /path/to/dsh-login-gateway

Restart dsh after installation.

There is no default account for a fresh install; you must first complete the one-time initialization. You can read the token file:

cat ~/.dsh-login-gateway/setup-token.txt

The token file has permissions 0600.

Then open in a browser:

http://<host>:3081/setup

Enter the token, admin username, password, and confirm password.

Accessing / before initialization redirects (302) to /setup; after initialization completes, /setup returns 410, and setup-token.txt is deleted.

After completing initialization, the login entry is:

http://<host>:3081/

Enter the username and password to access the dsh Web UI.

Typical Usage

After successful login, the session cookie is set, and subsequent accesses use the reverse proxy.

Logout can be done via the page floating bar; without an interface, you can also call:

curl -X POST http://<host>:3081/logout

Uninstall the plugin:

dsh plugin --profile web remove dsh-login-gateway

After restarting dsh, the service on 3081 stops. If you need to clean up the gatekeeper’s user data directory:

rm -rf ~/.dsh-login-gateway/

Security and Notes

  • Exposing to the public network or the same link involves risks of plaintext HTTP; it is recommended to terminate TLS upstream or enable the gatekeeper’s own TLS, combined with secureCookie.
  • For direct connection scenarios, it is recommended to keep trustProxy: false to avoid bypassing rate limiting by forging X-Forwarded-For.
  • Session binding to User-Agent is enabled by default; if the browser upgrades or changes the UA, you need to log in again.
  • Personalized configuration patches replace the config section in full; when overwriting, you must write out all configuration items.
  • The user data file is located at ~/.dsh-login-gateway/users.json by default, using scrypt hashing.
  • The plugin runs with the privileges of the current dsh process; you should check the source code and license before installing.

Conclusion

The value of dsh-login-gateway lies in: keeping the dsh Web UI listening on loopback, while gaining controlled access via an external login entry and reverse proxy.

Project Repository:

  • https://github.com/runfali/dsh-login-gateway