dsh-one-gateway
Private loopback DSH Web gateway for Tailscale Serve, Cloudflare Access, and Headscale TCP Serve, with exact principal allowlists and guided fail-closed setup.
为 DeepSeek Harness Web 提供仅回环的私有网关，支持 Tailscale Serve、Cloudflare Access 与 Headscale TCP Serve，精确主体白名单，引导式 fail-closed 配置。
How to install
dsh plugin add github:TiantianFlow/dsh-one-gateway About
DSH One Gateway A DeepSeek Harness (DSH) plugin that puts a private, zero-trust gateway in front of DSH Web. Callers authenticate through Tailscale Serve, Cloudflare Access, or — on Headscale — a generated gateway credential in front of private TCP Serve. One private allowlist decides who gets in. There is no user-chosen password to manage. The gateway and DSH stay on loopback. Tailscale Serve, Cloudflare Tunnel with Cloudflare Access, or Headscale via Tailscale TCP Serve is only the private ingress. Joining that private network is **never** an authorization decision. Every request must resolv…
Recommendation signals
Meta
- License
- MIT
- Language
- JavaScript
- GitHub stars
- 12
- mo. downloads
- –
- Last push
- 2026-08-21
- Created
- 2026-08-16
Links
Basic safety check
- Findings
- curated 收录但无 npm 包/安装命令
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- deepseek-harness, dsh, dsh-plugin, remote-access, security, tailscale, tailscale-serve, websocket
Related plugins
dsh-web
zhu1090093659/dsh-web-ui/tree/main/packages/dsh-remote-web-ui
Remote control of a dsh web workspace from phone or PC: QR-code pairing through a token-gated channel, SSE real-time sync, and separate mobile and full desktop GUI modes.
dsh-Remote
Blank-not-black/dsh-Remote
DSH Remote · 口袋里的 DSH 控制台 会话 · 审批 · 提问 · 文件传输，局域网 / Tailscale 直连 多服务器自动选优，聊天记录离线可看 带 Token 鉴权，数据只在你的设备之间流动 Sessions · approvals · questions · file transfer over LAN / Tailscale. Automatic fastest-server selection. Chat history available offline. Token-authenticated — your data flows only between your devices.
dsh-mobile
cindyguyuehu123/dsh-mobile
Use DSH from iPhone/iPad: an explicit-opt-in LAN reverse proxy (Host/Origin rewrite through the loopback trust fence, WebSocket upgrades included), iOS PWA chrome (home-screen icon, standalone meta, viewport-fit), and touch/mobile CSS (safe areas, keyboard lifting, composer row fit).
dsh-mobile
saya-ch/dsh-mobile
Use DeepSeek Harness from your phone over a protected LAN: a dedicated mobile UI, secure HTTPS pairing, and /mobile conversation customization.