dsh-auth-tailscale
Run the following command in DeepSeek Harness:
dsh plugin install sperictao/dsh-auth-tailscale
Paste the following prompt into your AI chat to install this plugin:
Run dsh plugin install sperictao/dsh-auth-tailscale in the DeepSeek Harness terminal to install the plugin; the full source repository is at https://github.com/sperictao/dsh-auth-tailsclone. Source: https://github.com/sperictao/dsh-auth-tailscale
About this plugin
The hardest part of remote dsh connection authorization is moving identity verification off the untrusted public internet and into a controlled tailnet. dsh-auth-tailscale leverages Tailscale Serve to terminate HTTPS and inject tamper-proof Tailscale-User-Login, Tailscale-User-Name, and App Capability headers, so dsh can bind strictly to loopback while still receiving reliable user identity - no exposed ports, no public Funnel.
The plugin enforces two layers of access control: a comma-separated, case-sensitive login allowlist that pins exactly which identities may connect, and App Capability tiers that separate ordinary remote API/WS calls from privileged loopback management endpoints. Grants are managed directly in tailnet policy for clean, auditable governance. Missing identity, malformed RFC 2047 encoding, invalid capability JSON, or insufficient permissions all result in a fail-closed rejection with no fallback to anonymous access.
Ideal for ops and security teams already running dsh inside a tailnet who need per-user and per-capability control over remote access and administrative privileges. Custom App Capabilities require Tailscale 1.92 or later; tagged-device-only calls are automatically rejected since they lack a user identity header.
Use Cases
- Use Tailscale Serve to terminate HTTPS and restrict remote dsh connections via a login allowlist
- Separate ordinary API access from admin endpoints using App Capabilities managed in tailnet policy
- Bind dsh to loopback only and rely on Serve-injected identity headers for zero-exposure remote authz
Best For
- Ops teams already running dsh inside a Tailscale tailnet
- Security leads who need per-user and per-capability governance of remote access
- Platform engineers who prefer tailnet policy over IP allowlists or static API tokens for remote authz
Related Plugins
Adds an Auto approval mode on the official workspace-write sandbox, classifying semantic risks, asking when ambiguous, and denying destructive operations.
Undo/rollback system for DSH: config & plugin snapshots, one-click undo/redo/restore, message-level revert, secret masking, safe mode, and offline WebUI/GUI/CLI rescue tools for when DSH won't start.
Packages all 87 SKILL.md files from upstream reverse-skill as a DeepSeek Harness plugin that auto-registers them for authorized reverse engineering, penetration testing, and security research.
Dockyard DSH is a native DeepSeek Harness plugin that unifies official OAuth/client sessions for Codex, Antigravity, Grok, Claude, and Cursor, providing account pool, model catalog, and quota status.