dsh-auth

The DeepSeek Harness web UI is packed with power but ships with no access control at all: whoever finds the port can read settings, manage files, and invoke plugins. dsh-auth fixes that by putting a username-and-password gate in front of every HTTP, API, and WebSocket connection, turning a self-hosted instance into one that is no longer wide open on your LAN.

After the login page, a practical set of session controls is at your fingertips: configurable idle-timeout auto-logout, a maximum session lifetime you can set in minutes, and a single-sign-on mode that instantly invalidates all other sessions on every new login, sending kicked clients back to the login screen with a clear warning. Passwords are stored as scrypt salted hashes and encrypted at rest with AES-256-GCM, requiring zero runtime dependencies. The Settings > Auth panel lets you change the username and password, fine-tune timeouts, and review the last 50 login events with IP, timestamp, and GeoIP location, while one-liner CLI shortcuts make credential resets effortless.

A detail that pays off in real deployments is the built-in LAN reverse proxy: dsh stays bound to 127.0.0.1, while the plugin listens on 0.0.0.0 (default port 3080), correctly forwarding WebSocket upgrade frames and rewriting Host/Origin headers so every /api RPC works out of the box for LAN clients. The UI follows the client language and adapts to light and dark themes automatically. If you run DeepSeek Harness on a local network and want to share the web admin panel with your team without exposing it to the open internet, dsh-auth is the lightest path to a properly gated instance.