DeepSeek Harness (DSH) is designed to keep privileged browser capabilities local (loopback). A plain reverse proxy can remotely render pages, but it usually fails when handling settings, plugin packages, WebSocket connections, or native directory selection. The jiachi5533/dsh-remote-gateway plugin provides a compatibility gateway that patches only the necessary connection modules and proxies traffic to the internal DSH service without directly exposing the DSH web server.

Plugin Positioning

  • Name: jiachi5533/dsh-remote-gateway
  • Description: A source-filtered remote gateway for accessing DeepSeek Harness through an authenticated reverse proxy.
  • Maintainer: Jiachi5533
  • License: MIT

Core Features

This plugin mainly addresses compatibility issues during remote access while maintaining security:

  • Protocol Support: Proxies HTTP, SSE, and WebSocket traffic.
  • Source Address Filtering: Accepts only requests from explicitly listed source IP addresses.
  • Network Isolation: The internal DSH web server is always bound to 127.0.0.1 and does not listen on external interfaces.
  • Request Rewriting: Rewrites the Host and Origin of upstream requests to internal loopback authority.
  • Header Stripping: Removes edge authentication and client identity forwarding headers before requests enter DSH, such as Authorization, Proxy-Authorization, Forwarded, X-Forwarded-*, and X-Real-IP.
  • Precise Patching: Patches only the specific dsh-client-connection capability probing module; all other plugin package content is forwarded byte-for-byte.
  • Directory Selection: Replaces the host’s native directory dialog with DSH’s built-in filesystem browser.
  • Lifecycle: Starts and stops with the DSH plugin lifecycle and is managed uniformly by the DSH supervisor, such as systemd.

Installation and Configuration

Prerequisites:
* DSH Web configuration profile
* Node.js 22.19 or a newer version
* A reverse proxy that supports WebSocket forwarding and authentication

  1. Install the plugin:
    Use the official CLI command to install from GitHub:
    dsh plugin --profile web add github:Jiachi5533/dsh-remote-gateway
  1. Edit the configuration file:
    After installation, edit the generated remote-gateway configuration entry located at ~/.dsh/profiles/web/cordis.patch.yml:
    - id: remote-gateway
      name: '@jiachi/dsh-remote-gateway'
      config:
        host: 0.0.0.0
        port: 3080
        allowedSources:
          - 192.0.2.10 # exact LAN address of the reverse proxy
          - 127.0.0.1  # optional local health checks
  1. Restart the service:
    Restart the DSH Web process after the initial installation.

Typical Usage

  1. Configure the reverse proxy:
    Forward the reverse proxy’s HTTP and WebSocket traffic to the DSH host’s LAN address and port 3080:
    http://DSH_HOST_LAN_IP:3080

  2. Enable the security layer:
    Enable HTTPS and user authentication at the reverse proxy. TLS and user authentication terminate here.

  3. Health checks:
    Allow listed monitoring systems to access the GET /_dsh-remote-gateway/health endpoint. This endpoint returns 200 ok, does not send a request to upstream DSH, and is used to verify the gateway process and source address policy.

Security Model and Notes

The plugin’s security model consists of multiple layers of defense:

  • Reverse proxy as the boundary: TLS and user authentication terminate at the reverse proxy.
  • Source address whitelist: The gateway accepts only the reverse proxy’s LAN address. Note that the current implementation supports only exact IPv4 or IPv6 addresses and does not support CIDR ranges.
  • Loopback isolation: The internal DSH web server always listens only on the local loopback address.
  • Header cleaning: Forwarded headers are removed to prevent information leakage or privilege escalation.

Important Warnings:
* Never expose port 3080 directly to the internet.
* Do not add broad network ranges, such as 0.0.0.0/0, to allowedSources, because this cannot protect the internal service.
* The plugin runs with the privileges of the DSH process. Before installing any third-party plugin, be sure to review its source code and license.

The plugin patches only specific connection compatibility modules and leaves the rest of the plugin package content unchanged, so most standard plugins can work normally in a remote environment.