dsh-auth-tailscale
Tailscale Serve authentication adapter for DeepSeek Harness client connection authorization.
Install
$ dsh plugin --profile web add \Plugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Parses and verifies Tailscale Serve identity headers (Tailscale-User-Login and Tailscale-User-Name)
- Enforces case-sensitive user login allowlists via DSH_TAILSCALE_ALLOWED_LOGINS
- Validates Tailscale App Capability grants for standard user and admin operations
- Decodes RFC 2047 Q-encoded identity headers with strict validation
- Executes fail-closed authorization when identity, capability grants, or format validations fail
Useful For
- Securing DeepSeek Harness web endpoints over a private Tailscale tailnet
- Restricting administrative or loopback DSH actions to authenticated tailnet admins with specific capability grants
- Enforcing user allowlists and capability-based access controls on remote DeepSeek Harness instances
Who It Fits
- System administrators deploying DeepSeek Harness in private networks
- Developers needing secure remote access to DSH web profiles over Tailscale
Documented Limitations
- Requires Tailscale 1.92+ for App Capability grant support
- Does not support tagged devices that do not populate user login headers
- Login matching is strictly case-sensitive
- Must be paired with dsh-client-connection-authz and Tailscale Serve running on loopback
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 1 runtime, 6 development, 2 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as MIT.
A root package.json was captured and can be inspected by the registry.
package.json declares a prepare lifecycle script that may run during relevant package installation workflows.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- sperictao/dsh-auth-tailscale
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- d2ddce1 · 2026-09-24
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 0GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-09-22
- Last release
- No release detected
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Local cross-agent memory and session history recall integration for DeepSeek Harness.
View plugin →Full office suite integration for DeepSeek Harness supporting spreadsheets, docs, slides, bases, and canvases.
View plugin →Import and resume conversation histories from 25+ AI coding agents directly into DeepSeek Harness.
View plugin →Agent-native multi-market trading terminal and quantitative research plugin bundle for DeepSeek Harness.
View plugin →