📦 @goodandready/dsh-lanmode
⚡ Overview & Features
dsh-lanmode brings seamless and secure local network (LAN) and WAN remote access to DeepSeek Harness:
- 📱 Quick QR Popover: Tap the smartphone icon in the sidebar footer (
Quick QR in sidebar.footer / sidebar.rail) to open an interactive SVG QR code. Supports the /mobileqr chat tool and ASCII QR output.
- 📲 PWA & Standalone Mode: Serves
/dsh-lanmode/manifest.json with viewport-fit=cover for full-screen mobile experience.
- 🌐 Automatic mDNS (
dsh.local): Built-in UDP 5353 responder announces dsh.local across the LAN automatically.
- 🔐 Local Root CA & HTTPS: Generates a 10-year Root CA and trusted SAN certificates (
dsh.local, LAN IP, localhost). One-click download via /dsh-lanmode/ca.crt.
- 🔔 Background Web Push & Notifications API: Delivers system push notifications on agent turn end and approval requests.
- 🛡️ Comprehensive Security & Authentication:
- Authentication passwords support plaintext and scrypt key derivation. Verified in constant time via
timingSafeEqual.
- LAN PIN protection with plaintext or
PBKDF2 stretching (pbkdf2$sha512$100000$salt$hash). Auto-lockout for 15 minutes after 5 consecutive failures.
- Device and session tokens stored exclusively as salted
SHA-256 digests.
- Subnet role separation (
adminAllow and guestAllow). Guest subnets cannot mutate settings or revoke sessions.
- ☁️ Cloudflare WAN Tunnels & Tailscale Funnel:
- Supports zero-config
Quick Tunnels (trycloudflare.com) and persistent Named Tunnels via token (passed securely via TUNNEL_TOKEN env, hidden from ps aux).
- The
tunnelPin option enforces LAN PIN verification for all requests arriving over WAN tunnels.
- 1-click
Tailscale Funnel integration providing public HTTPS with automated trusted Let's Encrypt certificates.
- 📱 Device Registry & Session Revocation: Track connected devices and revoke active sessions individually or all-at-once.
📦 Installation
dsh plugin --profile web add @goodandready/dsh-lanmode
⚙️ Configuration (cordis.patch.yml)
- id: dsh-lanmode
config:
mode: direct
directPort: 3080
tunnel: off # off, quick, or named
tunnelPin: true
tailscaleFunnel: false
passwordAuth: false
📄 License
MIT © GooDAnDReaDY