dsh-remote-access: Make the dsh Web Interface Listen on All Interfaces

Introduction¶

The DeepSeek Harness (DSH) Web interface (started with --profile web) is bound by default to the local loopback address (usually 127.0.0.1). To access the interface from another device on the LAN, the server’s listening address needs to be changed. The dsh-remote-access plugin uses environment-variable-based configuration overrides to allow the Web interface to listen on all network interfaces, while reusing DSH’s built-in browser authentication mechanism and avoiding the need for additional authentication plugins.

Purpose¶

This is an out-of-tree plugin maintained by sysit, part of DSH’s web-profile bundle. Its core purpose is:
* Lightweight: It contains only one configuration line and does not fork processes.
* Non-invasive authentication: It creates no new authentication logic and relies entirely on DSH’s built-in ?token= BrowserAuth.
* Upgrade-friendly: The configuration is declarative, takes effect on restart, and does not need to be reapplied.

Core Features¶

• Multi-interface listening: Allows the dsh --profile web GUI to listen on 0.0.0.0.
• Remote access: Allows the GUI to be opened from other devices on the LAN.
• Environment-variable control: Overrides the default webserver configuration item via the DSH_WEB_HOST environment variable.
• Automatic URL printing: When the server is bound to 0.0.0.0, the startup log automatically prints a URL containing the LAN address.
• Built-in authentication: Uses DSH’s built-in ?token= authentication mechanism and does not rely on the plugin itself to implement authentication.

Installation and Activation¶

To install this plugin, use DSH’s plugin management command. It adds @sysit/dsh-remote-access to the current profile’s dsh.profile.bundles.

dsh plugin --profile web install github:sysit/dsh-remote-access

After installation, the plugin injects a configuration line into dsh.profile.bundles that overrides the webserver host. Because it is a profile-level patch, the loader reads this configuration again at every DSH startup, so it does not need to be reapplied after upgrading the plugin or DSH.

Typical Usage¶

Control the listening address by setting the DSH_WEB_HOST environment variable. By default, if the environment variable is not set, the plugin sets the host to 0.0.0.0.

After a successful startup, the log displays both the local address and the LAN address:

dsh web: http://127.0.0.1:3080/?token=eqeU… (LAN: http://192.168.1.5:3080/?token=eqeU…)

On another device, open the URL after LAN: to access it directly.

Use Cases and Considerations¶

• Network exposure: Setting DSH_WEB_HOST to 0.0.0.0 exposes Harness on your network. Be sure to keep the printed token secure, and use the --no-open parameter for remote access to avoid automatically opening the browser.
• Security mechanisms: DSH’s cross-site / DNS rebinding defense (api-request-trust) remains enabled, and trustedHosts automatically recognizes LAN IPs. For untrusted networks, prefer SSH port forwarding or a VPN.
• API exposure: The exposure of the /api RPC interface depends on how you configure the host; the plugin itself does not configure this.
• Cross-process authentication: The token is process-scoped and changes on each restart; however, the browser cookie’s default validity period is 30 days, so already opened tabs usually remain usable after a restart.

Conclusion¶

dsh-remote-access provides a simple, standardized way to extend access to the DSH Web interface without introducing complex third-party authentication logic. It controls the listening address through an environment variable and leverages DSH’s built-in security mechanisms, making it suitable for development scenarios that require sharing the DSH Web UI within a LAN.

• Plugin Catalog Page
• GitHub Repository