dsh-cftunnel

The DeepSeek Harness web UI binds to 127.0.0.1:3080 by design, which means the moment you step away from your machine the interface is unreachable. dsh-cftunnel bridges that gap with a single Cloudflare Tunnel that safely publishes the local port to the public internet. The plugin downloads and caches cloudflared on its own at first Connect, so there is no package manager, no manual binary placement, and no service restart to worry about.

Three modes cover the full spectrum of use. Quick tunnel requires no Cloudflare account and hands back a random trycloudflare.com URL in seconds; Tunnel token plugs into a tunnel you already provisioned in the Zero Trust dashboard; API token lets the plugin create the tunnel, ingress rules, DNS CNAME, and even an Access email-OTP policy for you through the Cloudflare HTTP API. Every request transits a loopback reverse proxy that rewrites the Host header and strips Origin so the harness trust fence accepts it fully, while an access-token gate and an optional Cloudflare Access OTP layer keep remote visitors in check.

This plugin is a good fit for solo developers and small teams who run dsh web locally but occasionally need to share the interface with a colleague, debug from a different machine, or spin up a quick demo link. One install, a few fields in Settings, and a single Connect click turns an otherwise local-only UI into a safe, shareable remote endpoint.