Introduction

The DeepSeek Harness (DSH) Web GUI restricts access scope by default. When a user is on a virtual LAN (such as EasyTier, Tailscale, etc.) or only needs to access Harness over a trusted local network (home/office), the default restrictions can prevent direct access. The dsh-lan-access plugin removes these restrictions, allows the Web service to bind to all interfaces, and configures trust only for a specific LAN authority.

Core Features

This plugin mainly provides the following capabilities:

  • Bind to all interfaces: When enabled, the Web server binds to 0.0.0.0 instead of only the local loopback address.
  • Controlled trust fence: The /api browser trust fence only accepts configured authorities. If no authorities are configured, it falls back to DSH’s automatic LAN trust mechanism.
  • Startup information: The system prints the LAN URL with token at startup.
  • Configuration interface: Provides a settings tab for selecting the LAN IP used for access.

Installation and Enabling

Use the official command to install the plugin:

dsh plugin --profile web add github:longisland-icetea/dsh-lan-access

After installation, restart the dsh web process for the plugin to take effect.

Typical Usage

  1. Open the settings and navigate to the “LAN Access” tab.
  2. Enable the plugin.
  3. Enter the LAN IP address (or select it from the detected list).
  4. Save and restart dsh web.
  5. Use dsh plugin --profile web update dsh-lan-access to upgrade.

Use Cases and Notes

  • Use cases: Users who already have a virtual LAN environment, or who only want to access Harness within a controlled local network (such as a home or office).
  • Security warning: Enabling LAN access means anyone who can access that address can operate Harness (remote code execution). Only enable it on networks you control. Do not enable it on public Wi-Fi, campus, or shared lab networks. Do not share the tokenized URL printed at startup.
  • Maintenance note: This plugin was generated by an AI coding agent; the author has not reviewed it line by line. Check cordis.patch.yml and lib/client.js before making changes. Settings changes require a restart.
  • Mechanism details: In noAuth mode, sessionDays is meaningless. Cookies are based on the access address and remain valid after dsh web restarts.

Short Conclusion

This plugin enables secure access within a controlled LAN by configuring interface binding and the trust fence. It is recommended to use it only on your own network and to periodically check source updates.

GitHub: https://github.com/longisland-icetea/dsh-lan-access