dsh-web-pass

Once a DeepSeek Harness web interface is reachable via a LAN IP or a public domain, it lacks a dedicated password gate of its own. DSH's built-in browser authentication requires visitors to juggle tokens and cookies, and the settings pages go blank when the URL is not loopback. dsh-web-pass runs a zero-dependency reverse proxy inside the DSH process, overlays cookie-based password authentication on top, and automatically acquires and injects DSH's persistent cookie so that visitors only ever face one password prompt while DSH's internal auth stays completely transparent.

Key capabilities include: a forced initial password setup, automatic temporary lockout after repeated failures, a built-in /dsh-logs/ viewer that records only password-verification requests with visitor IPs pseudonymized via HMAC-SHA256 plus a network prefix, size-based log rotation with a hard total-size cap, and full settings-page availability when accessed through a non-loopback address. The plugin also adds a dedicated Web Password tab in the DSH settings for changing the access password and logging out.

It is aimed at teams or individuals who want to share a DSH instance over a LAN or the public web without adding nginx Basic Auth, who need a lightweight yet auditable access gate that never exposes real visitor IPs, and who want a simple shared-password model without a full account directory. All runtime data lives under $DSH_HOME/dsh-web-pass/, keeping the plugin repository itself free of sensitive material.