dsh-web-pass

Sharing a DeepSeek Harness web interface over a LAN or the public internet has always been awkward: DSH expects loopback-only browser trust, its built-in token-and-cookie dance is opaque to casual visitors, and settings pages silently blank out the moment the URL stops being localhost. dsh-web-pass solves this by running a zero-dependency reverse proxy inside the DSH process itself. It rewrites Host and Origin headers to satisfy DSH's browser-trust check, stacks a cookie-based password gate on top, and—because it shares the same process—silently acquires and injects DSH's persistent authentication cookie into every forwarded request and WebSocket handshake. Visitors see exactly one password form and nothing else; DSH's internal auth stays fully transparent.

Beyond the password gate, the plugin ships a built-in access-log viewer at /dsh-logs/ that records only authentication-related requests (login success, password error, lockout, page view, logout, first-time setup). Visitor IPs are never stored raw: they are pseudonymized with HMAC-SHA256 and truncated to a network prefix (/24 for IPv4, /64 for IPv6), so logs remain aggregatable for abuse analysis without leaking personal data. Files rotate by size (default 1 MB per file, 7 files kept) giving the log a hard total cap of roughly 8 MB. Repeated password failures trigger a temporary lockout, and a Web Password tab in the DSH settings panel lets you change the access password or log out at any time.

This plugin is best suited for small teams or individuals who expose a DSH instance on a trusted LAN or behind a TLS-terminating tunnel, want a single shared-password gate without standing up nginx Basic Auth or a full identity provider, and value audit-ready logs that respect visitor privacy. There is no account database, no 2FA module—just one scrypt-hashed password, a 3-attempt lockout, and a size-bounded log file, all living under $DSH_HOME/dsh-web-pass/ so the plugin repository stays clean and upgrades are a simple file swap.