Single-operator access gate for exposing DSH on the public internet: password, Passkey, IP whitelist/blacklist, block statistics, and optional Nginx integration.

• Protect-all routes — wraps every plugin webServer prefix by default
• Explicit expose — excludePrefixes skips login only (IP rules still apply)
• Peer pairing — cross-device Token; outbound fetch auto-injects Bearer
• API tokens — manual Bearer keys for scripts

• Password login — first visit sets password; scrypt hash + lockout after 5 failures
• Passkey login — WebAuthn (HTTPS or localhost); fingerprint / Face ID in browser
• IP whitelist — trusted IPs pass IP gate without logging
• IP blacklist — permanent deny + block counter
• Security visitors — suspicious IPs from blocks / failed logins (not whitelisted traffic)
• SSH key login — authorized_keys + challenge/verify (ed25519)
• Nginx snippet — copy-paste reverse proxy config with X-Real-IP
• Nginx Basic passthrough — optional auto-login when Authorization: Basic is present
• LAN mode — disable IP limits, password still required

Workspaces and sessions are native DSH — this plugin does not manage them.

dsh plugin --profile web add dsh-local-hanaccount
# or from local checkout:
dsh plugin --profile web add /path/to/dsh-local-hanaccount

Restart DSH Web profile after install.

1. Open DSH in browser → set access password
2. If your IP is not whitelisted, add it under Settings → 访问控制
3. For public internet: put Nginx in front, bind DSH to 127.0.0.1, use the Nginx snippet from settings

~/.dsh/storages/dsh-local-hanaccount/

Passkey availability is detected from the current URL (isSecureContext), not from whether you have a domain.

For headless/CLI use, add an ssh-ed25519 public key under Settings → SSH 密钥.

MIT