GPL-3.0 auth gateway for DeepSeek Harness (dsh): login auth, automatic HTTPS, multi-tenant permissions & quotas, session authorization and encrypted audit logs, with host / npm / Docker install paths.
DSH integration
Compatible
Author-claimed
Safety audit
Unaudited
Last verified
2026-09-04
License
GPL-3.0
01What can it help you accomplish?
Add login & access control to a public dsh deployment
A gateway that shows only a login page to unauthenticated visitors and enforces per-account permissions and quotas after login
Operators who expose DeepSeek Harness (dsh) on a public network and need authentication, multi-tenant access and audit
Run dsh as a multi-tenant platform with audit
Per-subuser permissions (workspace allowlist, per-session grant, token/time caps, sandbox tiers, upload/download toggles, ban) and audit logs with SQLite static encryption
Teams and self-hosters needing quota, session authorization and a secure audit trail for shared dsh instances
02How to install into DeepSeek Harness
Prerequisites
- Node.js 22.19+ or 24+ with a working dsh and git (the plugin must share dsh host’s Node major version)
- For Docker: a `.env` containing at least `DEEPSEEK_API_KEY`
Installation steps
- 01
Linux / macOS one-line install: `curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash`
$ curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash
- 02
Any platform, npm global: `npm install -g dsh-passwords` then `dsh-passwords install`
$ npm install -g dsh-passwords
- 03
Docker: `docker run -d --name dsh-passwords --env-file .env -p 127.0.0.1:3088:3088 -v dsh-home:/data/dsh -v dsh-passwords-state:/data/dsh-passwords skywalker237234/dsh-passwords`
Verify the integration
Not specified by the author
Rollback
- Host uninstall: `node dist/cli.js uninstall` (or `dsh-passwords uninstall` for npm global) — only removes the dsh-passwords link/bundle and rolls back its dsh patch, keeping other plugins
03DSH integration and capability boundaries
Integrates with dsh through a compatibility layer + gateway: deploys a login-auth gateway in front of the dsh web UI and registers a dsh plugin applying a remote-settings patch.
Login authentication gateway
HTTP requests to the dsh web UI→Unauthenticated visitors see only a login page; sessions valid 12 hours; per-account permission & quota control after login
Automatic HTTPS
Public deployment with ports 80/443 reachable→Auto-issues and renews Let’s Encrypt certificates, redirects port 80 to 443, no manual configuration
Refuses to start (no plaintext downgrade) if certificate issuance failsMulti-tenant permissions & quotas
Main user plus sub-users managed in dsh settings→Workspace allowlist, per-session grant, hourly token cap, daily duration cap, 3 sandbox tiers, upload/download toggles, ban
Audit & security
Login and session events→Login rate-limiting & lockout, audit logs, SQLite static encryption, server-side session revocation on logout
04Who is it for? When not to use it?
Good for
- Operators who expose DeepSeek Harness (dsh) on a public network and need authentication, multi-tenant access and audit
- Teams and self-hosters needing quota, session authorization and a secure audit trail for shared dsh instances
Not for
- Public HTTPS needs ports 80/443 open for ACME and a domain (or uses `<IP>.sslip.io`); plain-IP HTTPS shows a hostname mismatch unless entered via port 80.
05Compatibility, maintenance and safety notes
- Public HTTPS needs ports 80/443 open for ACME and a domain (or uses `<IP>.sslip.io`); plain-IP HTTPS shows a hostname mismatch unless entered via port 80.
- Host install requires Node.js 22.19+ or 24+ on the same major line as dsh; on Linux, binding a port below 1024 without root requires switching to a high port.
- Uninstall does not delete the install dir, `.env`, database, TLS/ACME certs or other plugins — back up `.env` together with the database since the encryption key lives there.
GPL-3.0 · actively maintained (latest release v2.6.9, 2026-09-02)
06Frequently asked questions
How do I install dsh-passwords?
On Linux/macOS run the one-line installer `curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash`; on any platform use `npm install -g dsh-passwords` then `dsh-passwords install`; or run the published Docker image `skywalker237234/dsh-passwords`.
Does it require modifying dsh itself?
No. It runs a gateway in front of the dsh web UI and integrates by registering a dsh plugin and applying a remote-settings patch — it does not fork or modify dsh’s source.
How are credentials stored?
Account passwords are stored only as bcrypt hashes; usernames, IPs and audit records are encrypted at rest; certificate issuance failure refuses to start. Without the `.env` key the database cannot be decrypted.
What happens on uninstall?
Uninstall only removes dsh-passwords’ link/bundle from the dsh web profile and rolls back its managed dsh patch; it keeps the install dir, `.env`, database, TLS/ACME certs and other plugins.
Which dsh versions are supported?
v2.6.9 is verified against DSH `0.1.2-alpha.5`; the compatibility layer covers DSH `alpha.1` through `alpha.5`.
07Related DSH workflows
open-design
by nexu-io
The 1st Collaborative AI Design Agent Workspace. Local-first and open source. Create motion, prototypes, websites, apps, dashboards, presentations, images, and videos with your team and AI agents. Share work, exchange feedback, and iterate together in one workspace.
dsh-desktop
by anywhere-labs
Modern desktop client for the DeepSeek Harness (dsh) plugin ecosystem. Everything is a plugin — even the desktop shell itself.
picgo
by molunerfinn
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosting services (S3, GitHub, Cloudflare R2, Imgur, Aliyun OSS...). Paste, upload, done.
dsh-desktop
by dataelement
Modern desktop client for the DeepSeek Harness (dsh) plugin ecosystem.
08Data and sources
dsh-passwords 在 dsh 前面运行一个网关：未登录访问只见到登录页，登录后按账号执行权限与配额控制。
当前版本 2.6.9。
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-09-04. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.