dsh-auth-gate

DeepSeek Harness ships its Web UI bound to 127.0.0.1 by design. The moment you need to expose it on a LAN or the public internet, you are left with no built-in identity check whatsoever. dsh-auth-gate fills exactly that gap: it inserts a login gate in front of the UI and exposes a set of /auth endpoints that feed directly into Nginx auth_request, giving you full authentication and brute-force protection without altering a single line of DSH core code.

The authentication pipeline spans an SVG captcha, dual-axis brute-force locking (per-IP and per-account), and server-side session management with sliding expiry, single-session enforcement, and optional IP binding. Passwords are stored as bcrypt (12-round) hashes; every login or password-change failure is captured in an audit log. On the host side the plugin registers /auth/* routes; on the client side it injects a login page through DSH's native Slot system. The two layers are independent by design: Nginx rejects unauthenticated requests with 401 before they ever reach DSH, while the plugin layer shields the UI itself—so even a direct /api call is guarded by the auth_request sub-request.

This plugin is for anyone deploying DSH on a trusted internal network or behind a public HTTPS endpoint who does not want to fork or patch the core. Out of the box you see a working login page in seconds; the forced first-login rename-and-password-change tightens the attack surface immediately. Pair it with the Nginx examples in the repo (public HTTPS or LAN HTTP) and you can move from local development to production with minimal friction.