dsh-totp

A personal DSH Web instance is open to anyone who knows the URL, which feels precarious in a shared LAN or behind a port-forwarded tunnel. dsh-totp solves this with a single, familiar mechanism: a standard TOTP six-digit code gate at the DSH entry point. No Google or Microsoft account is required, and no separate login server needs to be stood up. Once protection is on, every entry point—local, intranet, or public—demands a valid code before the workspace loads.

Binding happens entirely inside DSH's settings page: scan a QR code with Google Authenticator or Microsoft Authenticator, confirm with the current code, and you are done. The protection toggle can be flipped at any moment; a one-click lock revokes every active session instantly; and ten one-time recovery codes provide a safety net when a phone is lost or replaced. Under the hood, the plugin enforces replay protection, per-IP and global failure-rate limits, and page-session expiry, so a lightweight TOTP gate still carries real security weight.

It is built for the one-person, one-instance use case—no multi-user roles, no password-plus-TOTP two-factor ceremony, just a self-controlled door in front of DSH. It suits anyone who shares DSH on a local network, exposes it through a port mapping, or simply does not want a guessed URL to be an open invitation.