AI Agent Hub
Back to plugins
🧩

dsh-auth-tailscale

admin-security Updated 2026.08.25

Run the following command in DeepSeek Harness:

dsh plugin install sperictao/dsh-auth-tailscale

Paste the following prompt into your AI chat to install this plugin:

Run dsh plugin install sperictao/dsh-auth-tailscale in the DeepSeek Harness terminal to install the plugin; the full source repository is at https://github.com/sperictao/dsh-auth-tailsclone. Source: https://github.com/sperictao/dsh-auth-tailscale

About this plugin

The hardest part of remote dsh connection authorization is moving identity verification off the untrusted public internet and into a controlled tailnet. dsh-auth-tailscale leverages Tailscale Serve to terminate HTTPS and inject tamper-proof Tailscale-User-Login, Tailscale-User-Name, and App Capability headers, so dsh can bind strictly to loopback while still receiving reliable user identity - no exposed ports, no public Funnel.

The plugin enforces two layers of access control: a comma-separated, case-sensitive login allowlist that pins exactly which identities may connect, and App Capability tiers that separate ordinary remote API/WS calls from privileged loopback management endpoints. Grants are managed directly in tailnet policy for clean, auditable governance. Missing identity, malformed RFC 2047 encoding, invalid capability JSON, or insufficient permissions all result in a fail-closed rejection with no fallback to anonymous access.

Ideal for ops and security teams already running dsh inside a tailnet who need per-user and per-capability control over remote access and administrative privileges. Custom App Capabilities require Tailscale 1.92 or later; tagged-device-only calls are automatically rejected since they lack a user identity header.

Use Cases

  • Use Tailscale Serve to terminate HTTPS and restrict remote dsh connections via a login allowlist
  • Separate ordinary API access from admin endpoints using App Capabilities managed in tailnet policy
  • Bind dsh to loopback only and rely on Serve-injected identity headers for zero-exposure remote authz

Best For

  • Ops teams already running dsh inside a Tailscale tailnet
  • Security leads who need per-user and per-capability governance of remote access
  • Platform engineers who prefer tailnet policy over IP allowlists or static API tokens for remote authz