Overview

DeepSeek Harness (DSH) uses a plugin-based architecture and supports remote management through a Web client. To securely perform operations such as Settings, Credentials, Agent Preset management, and model discovery under remote access (for example, https://dsh.example.com), the legitimacy of the request source must be verified.

dsh-cloudflare-access is a plugin that runs inside the DSH process. It does not replace Cloudflare Access; instead, it acts as the Origin-side verification layer that reads and validates the Cf-Access-Jwt-Assertion header injected by Cloudflare Access. After successful validation, DSH uses it as an authentication token to allow remote privileged operations.

Plugin Introduction

  • Name: dsh-cloudflare-access
  • Maintainer: Luawig
  • License: MIT
  • Core Features:
    • Validates Cloudflare Access JWT at the DSH Origin.
    • Implements remote privileged authorization for Settings, Credentials, Agent Preset management, and model discovery.
    • Provides a Profile Bundle + Web Client dual mode.
    • Does not provide a login page, password storage, MFA, session tables, or a Cloudflare API client.

Installation and Enablement

This plugin must be used with the Web profile.

Use the following command to install it:

dsh plugin --profile web add dsh-cloudflare-access

To uninstall it:

dsh plugin --profile web remove dsh-cloudflare-access

After installation, restart the DSH process. Plugin version 2.0.x targets DeepSeek Harness 0.1.5-alpha.1.

Configuration Notes

  1. Place the DSH Web origin behind a Cloudflare Access application.
  2. Configure the Team Domain and Audiences using environment variables.

Environment Variables

Variable Description Example
DSH_CF_ACCESS_TEAM_DOMAIN Team domain / Issuer https://example.cloudflareaccess.com
DSH_CF_ACCESS_AUDIENCES Access application audience(s) (comma-separated) your-access-application-aud

systemd Example

Lock these values in the systemd service configuration:

[Service]
Environment=DSH_CF_ACCESS_TEAM_DOMAIN=https://example.cloudflareaccess.com
Environment=DSH_CF_ACCESS_AUDIENCES=your-access-application-aud
Environment=DSH_CF_ACCESS_ORDINARY_MODE=off
ExecStart=/usr/bin/dsh --profile web --trusted-host dsh.example.com

Verify the Configuration

Run the following command to confirm that the plugin has been loaded and configured correctly:

dsh --profile web --dump-config

The output should include a layer named dsh-cloudflare-access and a plugin line with id: cloudflare-access.

Authentication Modes

For remote non-privileged APIs (such as /api/remote.mux), the auth.ordinary mode determines whether a JWT is required.

Mode Without JWT With Valid JWT With Invalid JWT
off (default) Original DSH policy JWT ignored JWT ignored
optional Original DSH policy Allowed Denied
required Denied Allowed Denied

Note: Regardless of the above mode settings, remote privileged APIs always require a valid JWT (v2.0). In addition, loopback addresses such as localhost, 127.0.0.1, and ::1 do not require a JWT.

Architecture and Security

  • Runtime Location: The plugin runs inside the DSH process and does not modify DSH itself.
  • Header Handling: The plugin passes through Host, Origin, and Cf-Access-Jwt-Assertion; it does not remove this header.
  • Security Model: Remote privileged requests must satisfy DSH’s Host/Origin checks (--trusted-host) and provide a valid Cloudflare Access JWT.
  • Network Isolation: It is recommended to allow only Cloudflare (or an equivalent ingress) to access the DSH Origin. Installing this plugin is not a reason to expose DSH to the public internet.

Important Notes

  1. Do Not Edit Configuration Files: Do not manually edit $DSH_HOME/profiles/web/cordis.patch.yml.
  2. Loopback Limitation: Loopback access does not require a JWT, which keeps local debugging methods such as SSH tunnels available.
  3. Version Compatibility: Do not assume compatibility with other DSH versions; check the compatibility matrix.

Summary

dsh-cloudflare-access provides DeepSeek Harness with Cloudflare Access-based remote authentication. By validating JWTs at the Origin, it solves the authorization challenge for remote management via the Web profile while keeping the DSH process lightweight and plugin-oriented.

Plugin Directory
GitHub Repository