Introduction

The Web UI of DeepSeek Harness (DSH) is usually accessed via 127.0.0.1. When users access authenticated Web UI pages through a reverse proxy (instead of directly accessing the local address), DSH classifies them as remote requests, causing some Host-dependent features to work incorrectly. The dsh-trusted-host-is-loopback plugin modifies the client-side determination logic so that these pages are recognized as local access in reverse proxy scenarios, restoring the availability of the related features.

Plugin Introduction

This is a DSH Bundle maintained by Exagone313. Its core purpose is to treat authenticated Web UI pages as loopback (local). This allows Host-backed settings (such as model configuration in Settings, the first-run API-key step, preview notifications, etc.) to work correctly when accessing DSH through a reverse proxy.

Core Features

  • Marks authenticated Web UI pages as loopback.
  • Enables Host-backed settings so they take effect when accessed via a reverse proxy instead of 127.0.0.1.

Installation and Enablement

After installing the plugin, restart the DSH process.

dsh plugin --profile web add @exagone313/dsh-trusted-host-is-loopback

After installation, restart dsh to apply it.

Notes

  • No configuration required: This plugin does not require any additional configuration file.
  • Host/Origin trust boundary: This is a security boundary. Only origins that you declare as trusted via --trusted-host or trustedHosts can access the Web UI.
  • Hook source: The webserver/index-inject hook belongs to the @deepseek-ai/dsh-host-webserver plugin. If this hook name changes in the future, you must wait for an update to this plugin.
  • Tested version: This plugin has been tested with DSH version 0.2.0-rc.2.

Summary

This plugin only modifies the client-side Host categorization (ownsHost); it does not change server-side authentication logic or the Host/Origin trust boundary. It provides a simple solution for scenarios where the DSH Web UI needs to be accessed through a reverse proxy. Source code: https://github.com/Exagone313/dsh-trusted-host-is-loopback