dsh-local-hanaccount — access lock for DSH Web
Single-operator access gate for exposing DSH on the public internet: password, Passkey, IP whitelist/blacklist, block statistics, and optional Nginx integration.
Features (v2.2)
- Protect-all routes — wraps every plugin
webServer prefix by default
- Explicit expose —
excludePrefixes skips login only (IP rules still apply)
- Peer pairing — cross-device Token; outbound
fetch auto-injects Bearer
- API tokens — manual Bearer keys for scripts
Features (v2.1)
- Password login — first visit sets password; scrypt hash + lockout after 5 failures
- Passkey login — WebAuthn (HTTPS or localhost); fingerprint / Face ID in browser
- IP whitelist — trusted IPs pass IP gate without logging
- IP blacklist — permanent deny + block counter
- Security visitors — suspicious IPs from blocks / failed logins (not whitelisted traffic)
- SSH key login —
authorized_keys + challenge/verify (ed25519)
- Nginx snippet — copy-paste reverse proxy config with
X-Real-IP
- Nginx Basic passthrough — optional auto-login when
Authorization: Basic is present
- LAN mode — disable IP limits, password still required
Workspaces and sessions are native DSH — this plugin does not manage them.
Install
dsh plugin --profile web add dsh-local-hanaccount
# or from local checkout:
dsh plugin --profile web add /path/to/dsh-local-hanaccount
Restart DSH Web profile after install.
First run
- Open DSH in browser → set access password
- If your IP is not whitelisted, add it under Settings → 访问控制
- For public internet: put Nginx in front, bind DSH to
127.0.0.1, use the Nginx snippet from settings
Data directory
~/.dsh/storages/dsh-local-hanaccount/
| File | Purpose |
|---|
config.json | password hash, allow/deny lists, toggles |
state.json | sessions, lockouts |
authorized_keys | SSH public keys |
passkeys.json | Registered WebAuthn credentials |
security-visitors.json | block stats + suspicious IPs |
Login methods
| Method | When |
|---|
| Password | Always (first-time setup + fallback) |
| Passkey | HTTPS or http://127.0.0.1 / localhost — register in Settings after first login |
| SSH key | Settings → advanced; for CLI/scripts (manual sign flow) |
Passkey availability is detected from the current URL (isSecureContext), not from whether you have a domain.
SSH key (CLI)
For headless/CLI use, add an ssh-ed25519 public key under Settings → SSH 密钥.
License
MIT
