dsh-tailscale-access

LIMITATIONS

Known limitations

- This plugin opens the external entry DSH itself refuses. It is off by default and should be enabled deliberately. - `quick` mode URLs are public and world-reachable, change on every start, and will be found by scanners. The password (plus optional CIDRs) is the only gate, so leaving `quick` on permanently is not recommended. Named tunnels with a stable hostname and Cloudflare Access are not implemented. - Passwords are stored in the settings document in plaintext; only a `passwordSet` boolean is reported anywhere. Salted-hash storage is not implemented. - In `none` and `quick` mode the password crosses the loopback hop as plain HTTP; the external hop is HTTPS (tailscale or cloudflared). - On a remote page, DSH's own settings pages still show defaults. Only language, appearance and font size can be applied, through the button described above. - Tailscale Funnel and tagged nodes are rejected because they carry no identity header. - There is no account system or permission tier: the allowlist or password is a single gate, and anyone past it can execute commands through the GUI. - Remote approval needs at least one client online and answers first-come, first-served; a suspended phone will not answer later. - DSH's own security caveats still apply: the harness is not security-audited, and sandboxing or approvals are not a guarantee of isolation.