GPL-3.0 auth gateway for DeepSeek Harness (dsh): login auth, automatic HTTPS, multi-tenant permissions & quotas, session authorization and encrypted audit logs, with host / npm / Docker install paths.
DSH integration
Compatible
Author-claimed
Safety audit
Unaudited
Last verified
2026-09-04
License
GPL-3.0
01What can it help you accomplish?
Add login & access control to a public dsh deployment
A gateway that shows only a login page to unauthenticated visitors and enforces per-account permissions and quotas after login
Operators who expose DeepSeek Harness (dsh) on a public network and need authentication, multi-tenant access and audit
Run dsh as a multi-tenant platform with audit
Per-subuser permissions (workspace allowlist, per-session grant, token/time caps, sandbox tiers, upload/download toggles, ban) and audit logs with SQLite static encryption
Teams and self-hosters needing quota, session authorization and a secure audit trail for shared dsh instances
02How to install into DeepSeek Harness
Prerequisites
- Node.js 22.19+ or 24+ with a working dsh and git (the plugin must share dsh host’s Node major version)
- For Docker: a `.env` containing at least `DEEPSEEK_API_KEY`
Installation steps
- 01
Linux / macOS one-line install: `curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash`
$ curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash
- 02
Any platform, npm global: `npm install -g dsh-passwords` then `dsh-passwords install`
$ npm install -g dsh-passwords
- 03
Docker: `docker run -d --name dsh-passwords --env-file .env -p 127.0.0.1:3088:3088 -v dsh-home:/data/dsh -v dsh-passwords-state:/data/dsh-passwords skywalker237234/dsh-passwords`
Verify the integration
Not specified by the author
Rollback
- Host uninstall: `node dist/cli.js uninstall` (or `dsh-passwords uninstall` for npm global) — only removes the dsh-passwords link/bundle and rolls back its dsh patch, keeping other plugins
03DSH integration and capability boundaries
Integrates with dsh through a compatibility layer + gateway: deploys a login-auth gateway in front of the dsh web UI and registers a dsh plugin applying a remote-settings patch.
Login authentication gateway
HTTP requests to the dsh web UI→Unauthenticated visitors see only a login page; sessions valid 12 hours; per-account permission & quota control after login
Automatic HTTPS
Public deployment with ports 80/443 reachable→Auto-issues and renews Let’s Encrypt certificates, redirects port 80 to 443, no manual configuration
Refuses to start (no plaintext downgrade) if certificate issuance failsMulti-tenant permissions & quotas
Main user plus sub-users managed in dsh settings→Workspace allowlist, per-session grant, hourly token cap, daily duration cap, 3 sandbox tiers, upload/download toggles, ban
Audit & security
Login and session events→Login rate-limiting & lockout, audit logs, SQLite static encryption, server-side session revocation on logout
04Who is it for? When not to use it?
Good for
- Operators who expose DeepSeek Harness (dsh) on a public network and need authentication, multi-tenant access and audit
- Teams and self-hosters needing quota, session authorization and a secure audit trail for shared dsh instances
Not for
- Public HTTPS needs ports 80/443 open for ACME and a domain (or uses `<IP>.sslip.io`); plain-IP HTTPS shows a hostname mismatch unless entered via port 80.
05Compatibility, maintenance and safety notes
- Public HTTPS needs ports 80/443 open for ACME and a domain (or uses `<IP>.sslip.io`); plain-IP HTTPS shows a hostname mismatch unless entered via port 80.
- Host install requires Node.js 22.19+ or 24+ on the same major line as dsh; on Linux, binding a port below 1024 without root requires switching to a high port.
- Uninstall does not delete the install dir, `.env`, database, TLS/ACME certs or other plugins — back up `.env` together with the database since the encryption key lives there.
GPL-3.0 · actively maintained (latest release v2.6.9, 2026-09-02)
06Frequently asked questions
How do I install dsh-passwords?
On Linux/macOS run the one-line installer `curl -fsSL https://raw.githubusercontent.com/slywalker2006/dsh-passwords/main/install.sh | bash`; on any platform use `npm install -g dsh-passwords` then `dsh-passwords install`; or run the published Docker image `skywalker237234/dsh-passwords`.
Does it require modifying dsh itself?
No. It runs a gateway in front of the dsh web UI and integrates by registering a dsh plugin and applying a remote-settings patch — it does not fork or modify dsh’s source.
How are credentials stored?
Account passwords are stored only as bcrypt hashes; usernames, IPs and audit records are encrypted at rest; certificate issuance failure refuses to start. Without the `.env` key the database cannot be decrypted.
What happens on uninstall?
Uninstall only removes dsh-passwords’ link/bundle from the dsh web profile and rolls back its managed dsh patch; it keeps the install dir, `.env`, database, TLS/ACME certs and other plugins.
Which dsh versions are supported?
v2.6.9 is verified against DSH `0.1.2-alpha.5`; the compatibility layer covers DSH `alpha.1` through `alpha.5`.
07Related DSH workflows
open-design
by nexu-io
🎨 Best DeepSeek Harness Design Plugin. The open-source Claude Design alternative. 🖥️ Local-first desktop app. 🖼️ Your coding agent becomes the design engine: prototypes, landing pages, dashboards, slides, images & video — real files, HTML/PDF/PPTX/MP4 export. 🤖 Claude Code / Codex / Cursor / DeepSeek Harness / OpenCode & 20+ CLIs via BYOK.
picgo
by molunerfinn
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosting services (S3, GitHub, Cloudflare R2, Imgur, Aliyun OSS...). Paste, upload, done.
dsh-desktop
by anywhere-labs
Modern desktop client for the DeepSeek Harness (dsh) plugin ecosystem. Everything is a plugin — even the desktop shell itself.
openbiliclaw
by whiteguo233
Local-first, open-source AI content discovery agent that learns your taste and proactively finds content across Bilibili, Douyin, YouTube, Reddit, X and the open web.
08Data and sources
dsh-passwords 在 dsh 前面运行一个网关：未登录访问只见到登录页，登录后按账号执行权限与配额控制。
当前版本 2.6.9。
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-09-04. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.