wuwuzhige-sudo/dsh-remote-acces
One-command setup for password-protected remote access to the DeepSeek Harness (dsh) web UI — dsh privileged-m
dsh web binds to 127.0.0.1 only, and a hardcoded set of privileged methods (settings., credentials., agentPreset.*, llm.discoverModels and others) is loopback-only by design until a real authentication layer exists. dsh-remote-access makes full-featured remote access practical today with one command: it patches that privileged-methods fence for trusted hosts, stands up a Caddy reverse proxy with bcrypt basic auth in front of the loopback server, installs a systemd user service so the proxy auto-starts and restarts, and prints the Tailscale Serve command so you can open https://<machine>.<tailnet>.ts.net and reach the full dsh UI — settings, agent presets, credentials and model discovery included — from another device.
Install
git clone https://github.com/wuwuzhige-sudo/dsh-remote-access && cd dsh-remote-access && ./scripts/setup-remote-access.sh --password '<password>' --user dsh --trusted-host <tailnet-host>The script takes --password, --user and --trusted-host (your Tailscale DNS name) and is followed by 'sudo tailscale serve --bg 3081' and 'systemctl --user restart dsh-web'. The README describes what it does to your machine: it patches the dsh privileged-methods fence (one line, idempotent, keeps a .bak backup) so trusted hosts are allowed instead of loopback-only; installs the official Caddy (apt or direct binary) with a bcrypt-basic-auth Caddyfile that reverse-proxies to the loopback dsh server; installs a systemd user service for the auth proxy (auto-start, crash-restart, journald logs); and prints the Tailscale Serve command and access URL. The README notes that Caddy (the reverse proxy) and the TLS layer are separate processes outside the DSH plugin system.
Compatibility
Linux host with systemd and Tailscale; installs the official Caddy. Two of the three moving parts — the Caddy reverse proxy and the TLS layer — are ordinary processes outside the DSH plugin system. The README's architecture is browser -> TLS (Tailscale Serve / reverse proxy) -> Caddy (password auth) -> dsh (loopback).
Details
- Repo: wuwuzhige-sudo/dsh-remote-acces
- Category: Web UI Enhancements
- Stars: 2
- Version: GitHub repo wuwuzhige-sudo/dsh-remote-access (setup script + Caddy + systemd; not an npm package)
- Last push: 2026-08-14
- First seen: 2026-08-14
FAQ
- How do I set up remote access to dsh?
- Clone the repo and run './scripts/setup-remote-access.sh --password '<pw>' --user dsh --trusted-host <tailnet-host>', then 'sudo tailscale serve --bg 3081' and 'systemctl --user restart dsh-web'.
- Is Caddy part of the dsh plugin system?
- No — the README is explicit that Caddy (the reverse proxy) is a separate process; dsh plugins only run inside the dsh process.
- What does the script change?
- It patches the dsh privileged-methods fence (one line, idempotent, keeps a .bak backup), installs Caddy with bcrypt basic auth, and installs a systemd user service for the auth proxy.
Alternatives
CrazyShout/dsh-ssh-remote · evanfang0054/dsh-tailscale-console · morluto/leantoken