dsh-mobile-access

The DSH web GUI listens on localhost by default. Want to check agent status or send a command from your phone during a subway commute, yet have no safe way to surface a local service to the internet -- third-party tunnels hand your traffic to someone else, while opening a port naked exposes the configuration plane. dsh-mobile-access closes that gap.

It starts a token gate as the sole authentication boundary, then opens a supervised ssh -N -R reverse tunnel that plugs the web server into Caddy behind your own domain. The tunnel reconnects with exponential backoff on every drop; WebSocket event streams negotiate permessage-deflate compression, and the browser client retries at 500 ms doubling to a 10 s cap, so a flaky signal does not blank the UI. Once the tunnel is up, the terminal prints the public URL and an optional QR code -- scan it and the GUI is on your phone, with no device registry to maintain.

Built for users who own a domain and have a reachable VPS, and who want the full chain on their own HTTPS without touching a third-party relay. A single script provisions Caddy and a restricted SSH user on the relay side; privileged configuration-plane methods stay pinned to loopback and are never reachable through the tunnel.