Introduction

DeepSeek Harness (DSH) listens only on the local loopback address by default, which prevents developers from accessing it directly from other devices. Exposing DSH’s Web port directly poses security risks. The dsh-remote-gateway plugin provides a secure reverse proxy solution: the DSH process itself always listens only on 127.0.0.1, while the gateway handles incoming remote requests and performs authentication before forwarding them.

Plugin Overview

This plugin is maintained by RyensX and is designed to address remote access to DSH. It uses a gateway mode to securely forward external requests to the local instance, and supports authentication, IP allowlists, HTTPS configuration, and other features.

Core Features

  • Secure forwarding: DSH itself always listens only on 127.0.0.1, and forwarding is handled by the gateway provided by the plugin.
  • Authentication mechanisms: Supports password authentication and IP allowlists. The source IP is read only from the TCP socket; proxied request headers are not trusted.
  • Real-time configuration: All settings on the settings page (such as listen address, port, allowlist, and password) take effect in real time after clicking “Save”, without restarting DSH.
  • HTTPS support: Supports configuring HTTPS certificates using PEM files on the host.
  • Interaction optimization: When adding a workspace via the gateway address, the host folder selector opens in the current browser instead of showing a dialog on the remote host.

Installation and Enablement

Install the plugin using the official command:

dsh plugin --profile web add github:RyensX/dsh-remote-gateway

After installation, find the plugin configuration on DSH’s settings page. On first use, you must access the settings page via local 127.0.0.1 and configure the password.

Typical Usage

Basic Access Flow

The browser flow for accessing local DSH through the gateway is as follows:

浏览器
  → dsh-remote-gateway（白名单 + 密码认证）
  → http://127.0.0.1:<DSH Web 端口>

LAN Access Configuration

If you need to access it within a local area network, change the “listen address” in the gateway configuration from the default 127.0.0.1 to 0.0.0.0 or a specific network interface address.

HTTPS Configuration

HTTPS uses PEM files on the host. Configure it as follows:

dsh-remote-gateway:
  tls:
    enabled: true
    certPath: /absolute/path/to/cert.pem
    keyPath: /absolute/path/to/key.pem

Notes:
* The certificate and private key paths must be absolute paths, and file sizes must not exceed 1 MiB.
* Overwriting only the certificate file at the same path will not trigger automatic loading; DSH must be restarted.
* If certificate reading fails, it will not fall back to HTTP; the existing listener continues serving.

IP Allowlist and Host Control

  • IP allowlist: It is recommended to enable this when access from specific devices is required. Supports exact IPv4, IPv6, and CIDR formats. Leaving it empty means source IP is unrestricted. After matching the allowlist, a password is still required.
  • Host allowlist: By default, the gateway only accepts the local machine IP and localhost. If you need to use a LAN domain name or an external IP behind NAT, you must explicitly add the exact domain name or IP to “Extra Allowed Hosts” (without protocol or port).

Applicable Scenarios and Notes

Applicable Scenarios

  • Developers who need to use DSH across multiple devices in a synchronized manner.
  • Scenarios where an AI development environment is built within a local area network.
  • Scenarios where local services need to be accessed via VPN or intranet penetration tools (such as Tailscale, ZeroTier, Cloudflare Tunnel).

Notes

  • Remote tool dependency: The plugin itself does not directly provide remote access service; it must be used with tools such as Tailscale or ZeroTier.
  • Security recommendations: HTTP mode is suitable only for trusted local area networks used temporarily. For long-term use or when listening on a non-loopback address, configure HTTPS and set up IP allowlists and host firewall rules.
  • Session management: Sessions expire independently on a sliding basis per token (default 180 minutes), with a maximum absolute lifetime of 7 days. Server push and heartbeat do not renew the session.
  • System editor: When opening configuration files through the gateway, DSH’s original system text editor is invoked.

Conclusion

dsh-remote-gateway solves the remote access pain points caused by the local-only operation of DSH through gateway mode while maintaining security. For users who need to use DeepSeek Harness across multiple terminals or in remote environments, this is a reliable solution.