dsh-one-gateway

DSH One Gateway addresses a familiar self-hosting tension: you want to share a locally running DSH Web with a chosen few, without letting an entire LAN, Wi-Fi network, or accidentally exposed public address decide who gets in. Opening a port or binding beyond loopback can quietly turn reachability into permission, where one missed route exposes the app itself. This plugin places a gateway in front of DSH while keeping DSH on loopback, so requests must first pass through a private, identity-checked ingress before being forwarded.

Its strength is making zero trust practical for everyday DSH operations: an exact principal allowlist, a loopback-only HTTP/WebSocket proxy, fail-closed authorization, and adapters for common private networks. It does not push you toward a handcrafted password; with Tailscale Serve or Cloudflare Access, identity comes from the provider, while Headscale TCP Serve can use a generated gateway credential for transports without native HTTP identity. Setup previews the plan and refuses public or anonymous defaults, keeping convenience from becoming a new exposure surface.

It is a good fit for homelab operators who already run DSH Web locally and want access limited to selected admins or collaborators. If you distrust “same network” as a permission model, and prefer a narrow, auditable bridge that leaves DSH itself unmodified, this plugin is built around that principle.