zephaniahwang94-cmyk/dsh-auth-gate

安装

**Important correction**: `EXPOSE` alone exposes nothing, and Docker port publishing cannot normally reach a process bound only to the container's loopback interface. The risk appears only when DSH is configured/patched to bind `0.0.0.0`, or when another process inside the container proxies a container-facing port to DSH. Publishing that port without host-IP restriction (for example `-p 3080:3080`) then exposes the full Agent control plane to reachable networks.

**Root cause**: No authentication layer. The trust fence only validates request headers, not caller identity.

### Scenario 2: Reverse proxy (Nginx / Caddy)

把 zephaniahwang94-cmyk/dsh-auth-gate 加入你的 DSH 配置（web profile）即可启用。