idoall/dsh-lan-guard
Expose the desktop DSH Web UI to your LAN through a gated reverse proxy with self-signed HTTPS, a password gate and a QR code — without touching DSH's own binding.
DSH LAN Guard exposes the desktop DSH Web UI to your LAN safely through a gated reverse proxy: it relays HTTP and WebSocket end to end (including the official UI's /api/remote.mux long connection), rewrites Host/Origin, strips hop-by-hop headers and answers 502 when the upstream is down — all with self-signed HTTPS by default, a password gate, a QR code to open the UI on a phone and device pairing you can approve or block one by one. It binds 0.0.0.0 on the second listener, but the README is explicit that reachable is not the same as enterable, because the gate and pairing stand in front.
Install
dsh plugin --profile web add dsh-lan-guard@latestCopied verbatim from the README's Quick start. The README also documents a github: install (dsh plugin --profile web add "github:idoall/dsh-lan-guard"), a link:$(pwd) dev form and removal (dsh plugin --profile web remove dsh-lan-guard). It says 'One restart after install is all it takes — no hand-written configuration.'
Compatibility
The README states DSH serves its Web UI on 127.0.0.1 only and deliberately refuses to bind 0.0.0.0; this plugin leaves that binding alone and opens a second, gated listener on another port, so it modifies neither DSH source nor DSH's own listen binding and replaces no official layout. It registers one section in the official settings page and requires one restart after install.
Details
- Repo: idoall/dsh-lan-guard
- Category: Infrastructure & Deployment
- Stars: 2
- Version: GitHub repo idoall/dsh-lan-guard (MIT, per the README badge); npm package dsh-lan-guard at 0.7.1 (registry check 2026-10-07). The README badge names DeepSeek Harness 0.2.1-alpha.1.
FAQ
- Does it change DSH's own binding?
- No — the README says DSH keeps serving on 127.0.0.1 and the plugin opens a second, separate gated listener on another port.
- Is it HTTPS by default?
- Yes — the README says self-signed HTTPS is the default, with a QR code for opening the UI on a phone.
Alternatives
flymysql/dsh-remote · sorsama/deepseek-harness-mobile · lehhair/dsh-mobile