dsh-login-gateway

The dsh Web UI listens on 127.0.0.1:3080 by default, which correctly blocks external access but makes remote use a headache. Rethinking dsh to bind 0.0.0.0 would expose the entire console to the open internet. dsh-login-gateway takes a minimal approach: it opens a separate login gateway on its own port, authenticates visitors with username and password, then reverse-proxies every request—HTTP and WebSocket alike—straight to dsh's loopback address with zero feature loss. The plugin has zero runtime dependencies, uses only Node.js built-in modules, installs into the profile in one command, and leaves dsh untouched whether you keep it or remove it.

Security coverage is thorough: dual-dimension rate limiting (per-IP and per-username lockout), global authentication throttling to protect CPU, scrypt with constant-time comparison to prevent timing oracles, session binding to User-Agent so a sniffed cookie is useless on a different client, and full audit logging. For plain-HTTP setups you can generate a self-signed cert in one line to put the gateway behind its own TLS, eliminating plaintext sniffing. It also transparently adapts to dsh 0.1.2's host browser-authentication scheme—the one-time token never leaves the gateway→dsh hop, the browser never sees it, and expired cookies are auto-healed without user intervention.

The ideal use case: you run dsh on a VPS, home server, or office workstation and want to reach its admin panel from a laptop, phone, or another machine—securely, with no third-party proxy in between. Lightweight, zero-dependency, and ready the moment you restart dsh, it is the most natural remote-access layer for the platform.