
		Apache License
		Version 2.0, January 2004
		http://www.apache.org/licenses/

		TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

		1. Definitions.

		"License" shall mean the terms and conditions for use, reproduction,
		and distribution as defined by Sections 1 through 9 of this document.

		"Licensor" shall mean the copyright owner or entity authorized by
		the copyright owner that is granting the License.

		"Legal Entity" shall mean the union of the acting entity and all
		other entities that control, are controlled by, or are under common
		control with that entity. For the purposes of this definition,
		"control" means (i) the power, direct or indirect, to cause the
		direction or management of such entity, whether by contract or
		otherwise, or (ii) ownership of fifty percent (50%) or more of the
		outstanding shares, or (iii) beneficial ownership of such entity.

		"You" (or "Your") shall mean an individual or Legal Entity
		exercising permissions granted by this License.

		"Source" form shall mean the preferred form for making modifications,
		including but not limited to software source code, documentation
		source, and configuration files.

		"Object" form shall mean any form resulting from mechanical
		transformation or translation of a Source form, including but
		not limited to compiled object code, generated documentation,
		and conversions to other media types.

		"Work" shall mean the work of authorship, whether in Source or
		Object form, made available under the License, as indicated by a
		copyright notice that is included in or attached to the work
		(an example is provided in the Appendix below).

		"Derivative Works" shall mean any work, whether in Source or Object
		form, that is based on (or derived from) the Work and for which the
		editorial revisions, annotations, elaborations, or other modifications
		represent, as a whole, an original work of authorship. For the purposes
		of this License, Derivative Works shall not include works that remain
		separable from, or merely link (or bind by name) to the interfaces of,
		the Work and Derivative Works thereof.

		"Contribution" shall mean any work of authorship, including
		the original version of the Work and any modifications or additions
		to that Work or Derivative Works thereof, that is intentionally
		submitted to Licensor for inclusion in the Work by the copyright owner
		or by an individual or Legal Entity authorized to submit on behalf of
		the copyright owner. For the purposes of this definition, "submitted"
		means any form of electronic, verbal, or written communication sent
		to the Licensor or its representatives, including but not limited to
		communication on electronic mailing lists, source code control systems,
		and issue tracking systems that are managed by, or on behalf of, the
		Licensor for the purpose of discussing and improving the Work, but
		excluding communication that is conspicuously marked or otherwise
		designated in writing by the copyright owner as "Not a Contribution."

		"Contributor" shall mean Licensor and any individual or Legal Entity
		on behalf of whom a Contribution has been received by Licensor and
		subsequently incorporated within the Work.

		2. Grant of Copyright License. Subject to the terms and conditions of
		this License, each Contributor hereby grants to You a perpetual,
		worldwide, non-exclusive, no-charge, royalty-free, irrevocable
		copyright license to reproduce, prepare Derivative Works of,
		publicly display, publicly perform, sublicense, and distribute the
		Work and such Derivative Works in Source or Object form.

		3. Grant of Patent License. Subject to the terms and conditions of
		this License, each Contributor hereby grants to You a perpetual,
		worldwide, non-exclusive, no-charge, royalty-free, irrevocable
		(except as stated in this section) patent license to make, have made,
		use, offer to sell, sell, import, and otherwise transfer the Work,
		where such license applies only to those patent claims licensable
		by such Contributor that are necessarily infringed by their
		Contribution(s) alone or by combination of their Contribution(s)
		with the Work to which such Contribution(s) was submitted. If You
		institute patent litigation against any entity (including a
		cross-claim or counterclaim in a lawsuit) alleging that the Work
		or a Contribution incorporated within the Work constitutes direct
		or contributory patent infringement, then any patent licenses
		granted to You under this License for that Work shall terminate
		as of the date such litigation is filed.

		4. Redistribution. You may reproduce and distribute copies of the
		Work or Derivative Works thereof in any medium, with or without
		modifications, and in Source or Object form, provided that You
		meet the following conditions:

		(a) You must give any other recipients of the Work or
		Derivative Works a copy of this License; and

		(b) You must cause any modified files to carry prominent notices
		stating that You changed the files; and

		(c) You must retain, in the Source form of any Derivative Works
		that You distribute, all copyright, patent, trademark, and
		attribution notices from the Source form of the Work,
		excluding those notices that do not pertain to any part of
		the Derivative Works; and

		(d) If the Work includes a "NOTICE" text file as part of its
		distribution, then any Derivative Works that You distribute must
		include a readable copy of the attribution notices contained
		within such NOTICE file, excluding those notices that do not
		pertain to any part of the Derivative Works, in at least one
		of the following places: within a NOTICE text file distributed
		as part of the Derivative Works; within the Source form or
		documentation, if provided along with the Derivative Works; or,
		within a display generated by the Derivative Works, if and
		wherever such third-party notices normally appear. The contents
		of the NOTICE file are for informational purposes only and
		do not modify the License. You may add Your own attribution
		notices within Derivative Works that You distribute, alongside
		or as an addendum to the NOTICE text from the Work, provided
		that such additional attribution notices cannot be construed
		as modifying the License.

		You may add Your own copyright statement to Your modifications and
		may provide additional or different license terms and conditions
		for use, reproduction, or distribution of Your modifications, or
		for any such Derivative Works as a whole, provided Your use,
		reproduction, and distribution of the Work otherwise complies with
		the conditions stated in this License.

		5. Submission of Contributions. Unless You explicitly state otherwise,
		any Contribution intentionally submitted for inclusion in the Work
		by You to the Licensor shall be under the terms and conditions of
		this License, without any additional terms or conditions.
		Notwithstanding the above, nothing herein shall supersede or modify
		the terms of any separate license agreement you may have executed
		with Licensor regarding such Contributions.

		6. Trademarks. This License does not grant permission to use the trade
		names, trademarks, service marks, or product names of the Licensor,
		except as required for reasonable and customary use in describing the
		origin of the Work and reproducing the content of the NOTICE file.

		7. Disclaimer of Warranty. Unless required by applicable law or
		agreed to in writing, Licensor provides the Work (and each
		Contributor provides its Contributions) on an "AS IS" BASIS,
		WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
		implied, including, without limitation, any warranties or conditions
		of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
		PARTICULAR PURPOSE. You are solely responsible for determining the
		appropriateness of using or redistributing the Work and assume any
		risks associated with Your exercise of permissions under this License.

		8. Limitation of Liability. In no event and under no legal theory,
		whether in tort (including negligence), contract, or otherwise,
		unless required by applicable law (such as deliberate and grossly
		negligent acts) or agreed to in writing, shall any Contributor be
		liable to You for damages, including any direct, indirect, special,
		incidental, or consequential damages of any character arising as a
		result of this License or out of the use or inability to use the
		Work (including but not limited to damages for loss of goodwill,
		work stoppage, computer failure or malfunction, or any and all
		other commercial damages or losses), even if such Contributor
		has been advised of the possibility of such damages.

		9. Accepting Warranty or Additional Liability. While redistributing
		the Work or Derivative Works thereof, You may choose to offer,
		and charge a fee for, acceptance of support, warranty, indemnity,
		or other liability obligations and/or rights consistent with this
		License. However, in accepting such obligations, You may act only
		on Your own behalf and on Your sole responsibility, not on behalf
		of any other Contributor, and only if You agree to indemnify,
		defend, and hold each Contributor harmless for any liability
		incurred by, or claims asserted against, such Contributor by reason
		of your accepting any such warranty or additional liability.

		END OF TERMS AND CONDITIONS

		APPENDIX: How to apply the Apache License to your work.

		To apply the Apache License to your work, attach the following
		boilerplate notice, with the fields enclosed by brackets "[]"
		replaced with your own identifying information. (Don't include
		the brackets!) The text should be enclosed in the appropriate
		comment syntax for the file format. We also recommend that a
		file or class name and description of purpose be included on the
		same "printed page" as the copyright notice for easier
		identification within third-party archives.

		Copyright [yyyy] [name of copyright owner]

		Licensed under the Apache License, Version 2.0 (the "License");
		you may not use this file except in compliance with the License.
		You may obtain a copy of the License at

		http://www.apache.org/licenses/LICENSE-2.0

		Unless required by applicable law or agreed to in writing, software
		distributed under the License is distributed on an "AS IS" BASIS,
		WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		See the License for the specific language governing permissions and
		limitations under the License.

vendor/caddy/linux-arm64/caddy

Sorry, the diff of this file is not supported yet

vendor/caddy/linux-x64/caddy

Sorry, the diff of this file is not supported yet

+20

vendor/caddy/manifest.json

		{
		"schemaVersion": 1,
		"caddyVersion": "2.11.4",
		"packageRevision": "dsh.1",
		"licenseSha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
		"platforms": {
		"linux-x64": {
		"executable": "linux-x64/caddy",
		"binarySha256": "b7105518e3ed1c0761f232e44fc09345535533c9cb0abf0e12809416c7ac64d9",
		"upstreamArchive": "caddy_2.11.4_linux_amd64.tar.gz",
		"upstreamUrl": "https://github.com/caddyserver/caddy/releases/download/v2.11.4/caddy_2.11.4_linux_amd64.tar.gz"
		},
		"linux-arm64": {
		"executable": "linux-arm64/caddy",
		"binarySha256": "e1f904038fc11ca897ac5a12fdacfb2a7add02a8720c426d562a37f6fdad2afe",
		"upstreamArchive": "caddy_2.11.4_linux_arm64.tar.gz",
		"upstreamUrl": "https://github.com/caddyserver/caddy/releases/download/v2.11.4/caddy_2.11.4_linux_arm64.tar.gz"
		}
		}
		}

vendor/caddy/manifest.sha256

Sorry, the diff of this file is not supported yet

+1

vendor/caddy/THIRD_PARTY.md

This package redistributes the unmodified official Caddy binaries and LICENSE from https://github.com/caddyserver/caddy.

+15

-0

CHANGELOG.md

		# Changelog

		## v0.1.15

		Changes since [v0.1.14](https://github.com/hxy91819/dsh-auth/compare/v0.1.14...v0.1.15).

		### Changes

		- docs: record live systemd acceptance for bundled Caddy 0.1.15 (`7381c4a`). Thanks masonxhuang.
		- merge: incorporate main Caddy self-contained docs contract (`d499c2a`). Thanks masonxhuang.
		- fix: start DynamicUser Caddy without a root-owned state directory (`4f5c39d`). Thanks masonxhuang.
		- feat: ship official Caddy binaries inside the dsh-auth tarball (`92e5234`). Thanks masonxhuang.

		### Contributors

		Thanks masonxhuang for this release.

		## v0.1.14
		@@ -4,0 +19,0 @@

+1

-1

deploy/docker/README.md

		@@ -12,2 +12,2 @@ # Docker image integration

		The install step runs with `--network=none`, disables automatic peer installation, and writes the Web profile under `/opt/dsh-home`. The base image supplies the optional Cordis, DSH WebServer, and DSH Settings peers. Run DSH as the same image user that owns this directory, bind it only to loopback when Caddy shares the container, or to an internal non-published container address when Caddy is a separate service. In a two-container deployment, assign Caddy a stable private IP and pass that literal address through `DSH_AUTH_TRUSTED_PROXY_ADDRESSES`; do not trust an entire shared container subnet. Install the matching `dsh-auth-caddy-linux-*@2.11.4-dsh.1` platform package in the image; setup never downloads Caddy.
		The install step runs with `--network=none`, disables automatic peer installation, and writes the Web profile under `/opt/dsh-home`. The base image supplies the optional Cordis, DSH WebServer, and DSH Settings peers. Run DSH as the same image user that owns this directory, bind it only to loopback when Caddy shares the container, or to an internal non-published container address when Caddy is a separate service. In a two-container deployment, assign Caddy a stable private IP and pass that literal address through `DSH_AUTH_TRUSTED_PROXY_ADDRESSES`; do not trust an entire shared container subnet. The `dsh-auth` tarball already contains linux-x64 and linux-arm64 Caddy binaries; setup never downloads Caddy.

+6

-11

docs/installer.md

		# Installer architecture

		Read this document before changing `setup`, `plan`, `doctor`, `reset-password`, `uninstall`, Caddy platform-package verification, systemd integration, managed paths, JSON output, or installer exit codes.
		Read this document before changing `setup`, `plan`, `doctor`, `reset-password`, `uninstall`, bundled Caddy verification, systemd integration, managed paths, JSON output, or installer exit codes.

		@@ -59,3 +59,3 @@ ## Public surface
		\| `/usr/lib/dsh-auth` \| `0755` \| directory that holds the verified Caddy binary \|
		\| `/usr/lib/dsh-auth/caddy` \| `0755` \| checksum-verified Caddy `v2.11.4` from the platform package \|
		\| `/usr/lib/dsh-auth/caddy` \| `0755` \| checksum-verified Caddy `v2.11.4` copied from the bundled vendor tree \|
		\| `/etc/systemd/system/dsh-auth-caddy.service` \| `0644` \| independent DynamicUser edge unit \|
		@@ -68,3 +68,3 @@ \| `/var/lib/dsh-auth-caddy` \| systemd \| automatic TLS and Caddy runtime state \|

		Existing target files without a valid state record are conflicts. Existing DSH profile installations of `dsh-auth` are also conflicts because setup cannot claim ownership retroactively. Directories shared with systemd are removed only when setup created them and they are empty.
		Existing target files without a valid state record are conflicts. Existing DSH profile installations of `dsh-auth` are also conflicts because setup cannot claim ownership retroactively. Directories shared with systemd are removed only when setup created them and they are empty. System setup never creates `/var/lib/dsh-auth-caddy`; DynamicUser `StateDirectory` creates `/var/lib/private/dsh-auth-caddy` at enable time, and a root-owned `/var/lib/dsh-auth-caddy` makes systemd fail with `STATE_DIRECTORY`. The unit bind-mounts the `0644` Caddyfile into `RuntimeDirectory` because DynamicUser cannot search `0750` `/etc/dsh-auth`. Manual TLS setup validates a temporary Caddyfile rendered against the source certificate paths, then deletes it, because systemd credential paths do not exist until the unit starts.

		@@ -84,11 +84,6 @@ The state parser validates mode, root ownership under `/etc`, schema v2 fields, exact fixed system/output paths, safe service/profile inputs, executable paths, and that `createdPaths` is a duplicate-free subset of the derived managed paths before any deletion or command execution. System doctor and uninstall reject output-mode records.

		## Caddy platform packages
		## Bundled Caddy

		Caddy is the only public listener. The installer never downloads a binary and never probes, reloads, or reuses a system Caddy or Nginx. It resolves one exact optional platform package from `process.platform` and `process.arch`:
		Caddy is the only public listener. The installer never downloads a binary and never probes, reloads, or reuses a system Caddy or Nginx. The published `dsh-auth` tarball already contains unmodified official Caddy `v2.11.4` binaries for `linux-x64` and `linux-arm64` under `vendor/caddy/`, plus `manifest.json`, `manifest.sha256`, `LICENSE`, and `THIRD_PARTY.md`. Setup selects the current architecture from `process.platform` and `process.arch`, verifies the combined manifest checksum, selected binary SHA-256, and license files, then copies that binary to the managed path. Missing vendor files, unsupported platforms, revision drift, checksum mismatch, or missing licenses are prerequisite failures. Reinstall `dsh-auth` from the official tarball when bundled Caddy is incomplete; do not add a second npm package.

		- `dsh-auth-caddy-linux-x64@2.11.4-dsh.1`
		- `dsh-auth-caddy-linux-arm64@2.11.4-dsh.1`

		Each package must contain the unmodified official Caddy binary, `package.json` with that name and version, `manifest.json` plus `manifest.sha256`, `LICENSE`, and `THIRD_PARTY.md`. Setup verifies package version, manifest checksum, binary SHA-256, and license files, then copies the binary to the managed path. Missing packages, unsupported platforms, version drift, checksum mismatch, or missing licenses are prerequisite failures.

		## Change map
		@@ -102,3 +97,3 @@
		- Systemd and container issue-input resolution: `src/installer/issue-login-token.ts`, `tests/installer-cli.spec.ts`.
		- Caddy rendering, platform-package verification, TLS, and ports: `src/installer/caddy.ts`, `tests/caddy-installer.spec.ts`, `scripts/check-caddy.mjs`.
		- Caddy rendering, bundled-binary verification, TLS, and ports: `src/installer/caddy.ts`, `tests/caddy-installer.spec.ts`, `scripts/check-caddy.mjs`.
		- OS, systemd, and DSH service discovery: `src/installer/discovery.ts`.
		@@ -105,0 +100,0 @@ - Fingerprints, plans, conflicts, state parsing: `src/installer/config-files.ts`, `src/installer/plan.ts`.

+1

-1

lib/installer/caddy.d.ts

		@@ -18,4 +18,4 @@ import { type InstallerHost, type ManagedPaths, type SetupRequest } from './types.js';
		export declare function renderCaddyUnit(request: SetupRequest, paths: ManagedPaths): string;
		/** Resolve and verify the exact local platform package. Never downloads a binary. */
		/** Resolve and verify the Caddy binary bundled in this dsh-auth package. Never downloads. */
		export declare function resolveCaddyPackage(host: InstallerHost): CaddyPackage;
		export declare function assertPublicPortsFree(host: InstallerHost, request: SetupRequest): void;

+40

-40

lib/installer/caddy.js

		@@ -86,2 +86,3 @@ import { createHash } from 'node:crypto';
		: '';
		// DynamicUser cannot search 0750 /etc/dsh-auth, so bind the 0644 Caddyfile into RuntimeDirectory.
		return `[Unit]
		@@ -103,6 +104,7 @@ Description=dsh-auth Caddy public edge
		StateDirectory=dsh-auth-caddy
		ReadWritePaths=${paths.caddyStateDirectory}
		${credentials}ExecStartPre=${paths.caddyBinary} validate --config ${paths.caddyfile}
		ExecStart=${paths.caddyBinary} run --config ${paths.caddyfile} --adapter caddyfile
		ExecReload=${paths.caddyBinary} reload --config ${paths.caddyfile} --adapter caddyfile
		RuntimeDirectory=dsh-auth-caddy
		BindReadOnlyPaths=${paths.caddyfile}:/run/dsh-auth-caddy/Caddyfile
		${credentials}ExecStartPre=${paths.caddyBinary} validate --config /run/dsh-auth-caddy/Caddyfile
		ExecStart=${paths.caddyBinary} run --config /run/dsh-auth-caddy/Caddyfile --adapter caddyfile
		ExecReload=${paths.caddyBinary} reload --config /run/dsh-auth-caddy/Caddyfile --adapter caddyfile
		Restart=on-failure
		@@ -114,10 +116,10 @@
		}
		function caddyPackageName(platform, arch) {
		function caddyPlatform(platform, arch) {
		if (platform !== 'linux')
		prerequisite('Caddy platform packages are published for Linux only.', 'CADDY_UNSUPPORTED_PLATFORM', 'Use a Linux x64 or ARM64 host, or --output-dir on a matching image.');
		prerequisite('Bundled Caddy is published for Linux only.', 'CADDY_UNSUPPORTED_PLATFORM', 'Use a Linux x64 or ARM64 host, or --output-dir on a matching image.');
		if (arch === 'x64')
		return 'dsh-auth-caddy-linux-x64';
		return 'linux-x64';
		if (arch === 'arm64')
		return 'dsh-auth-caddy-linux-arm64';
		prerequisite(`Unsupported architecture ${arch}.`, 'CADDY_UNSUPPORTED_ARCH', 'Install on linux-x64 or linux-arm64.');
		return 'linux-arm64';
		prerequisite(`Unsupported architecture ${arch}.`, 'CADDY_UNSUPPORTED_ARCH', 'Install dsh-auth on linux-x64 or linux-arm64.');
		}
		@@ -127,7 +129,7 @@ function readManifest(host, directory) {
		if (!host.regularFile(path))
		prerequisite('Caddy platform package is missing manifest.json.', 'CADDY_PACKAGE_INVALID', 'Reinstall the matching dsh-auth-caddy platform package.');
		prerequisite('Bundled Caddy is missing manifest.json.', 'CADDY_PACKAGE_INVALID', 'Reinstall dsh-auth. Setup never downloads Caddy.');
		const checksumFile = join(directory, 'manifest.sha256');
		const bytes = host.readFileBytes(path);
		if (!host.regularFile(checksumFile) \|\| host.readFile(checksumFile).trim() !== digest(bytes)) {
		prerequisite('Caddy platform package manifest checksum does not match.', 'CADDY_MANIFEST_CHECKSUM', 'Reinstall the matching dsh-auth-caddy platform package; setup never downloads Caddy.');
		prerequisite('Bundled Caddy manifest checksum does not match.', 'CADDY_MANIFEST_CHECKSUM', 'Reinstall dsh-auth. Setup never downloads Caddy.');
		}
		@@ -139,45 +141,43 @@ let parsed;
		catch {
		prerequisite('Caddy platform package manifest is not JSON.', 'CADDY_PACKAGE_INVALID', 'Reinstall the matching dsh-auth-caddy platform package.');
		prerequisite('Bundled Caddy manifest is not JSON.', 'CADDY_PACKAGE_INVALID', 'Reinstall dsh-auth.');
		}
		if (parsed === null \|\| typeof parsed !== 'object' \|\| Array.isArray(parsed)) {
		prerequisite('Caddy platform package manifest is invalid.', 'CADDY_PACKAGE_INVALID', 'Reinstall the matching dsh-auth-caddy platform package.');
		prerequisite('Bundled Caddy manifest is invalid.', 'CADDY_PACKAGE_INVALID', 'Reinstall dsh-auth.');
		}
		return parsed;
		}
		/** Resolve and verify the exact local platform package. Never downloads a binary. */
		/** Resolve and verify the Caddy binary bundled in this dsh-auth package. Never downloads. */
		export function resolveCaddyPackage(host) {
		const name = caddyPackageName(host.platform, host.arch);
		let directory;
		try {
		directory = host.resolveModulePackage(name);
		const directory = host.resolveBundledCaddyRoot();
		const selected = caddyPlatform(host.platform, host.arch);
		if (!host.regularFile(join(directory, 'manifest.json'))) {
		prerequisite('Bundled Caddy is missing from this dsh-auth install.', 'CADDY_PACKAGE_MISSING', 'Reinstall dsh-auth from the official tarball. Setup never downloads Caddy from the network.');
		}
		catch {
		prerequisite(`Caddy platform package ${name}@${CADDY_PACKAGE_VERSION} is not installed.`, 'CADDY_PACKAGE_MISSING', `Install optional dependency ${name}@${CADDY_PACKAGE_VERSION}. Setup never downloads Caddy from the network.`);
		const manifest = readManifest(host, directory);
		if (manifest.caddyVersion !== CADDY_VERSION \|\| manifest.packageRevision !== 'dsh.1') {
		prerequisite('Bundled Caddy revision does not match the frozen edge runtime.', 'CADDY_PACKAGE_VERSION', `Use dsh-auth with Caddy ${CADDY_VERSION} (dsh.1).`);
		}
		const packageJsonPath = join(directory, 'package.json');
		if (!host.regularFile(packageJsonPath)) {
		prerequisite('Caddy platform package is incomplete.', 'CADDY_PACKAGE_INVALID', 'Reinstall the matching dsh-auth-caddy platform package.');
		if (!host.regularFile(join(directory, 'LICENSE')) \|\| !host.regularFile(join(directory, 'THIRD_PARTY.md'))) {
		prerequisite('Bundled Caddy is missing LICENSE or third-party notices.', 'CADDY_LICENSE_MISSING', 'Reinstall dsh-auth.');
		}
		let pkg;
		try {
		pkg = JSON.parse(host.readFile(packageJsonPath));
		if (typeof manifest.licenseSha256 !== 'string' \|\| !sha256Hex(manifest.licenseSha256) \|\| digest(host.readFileBytes(join(directory, 'LICENSE'))) !== manifest.licenseSha256) {
		prerequisite('Bundled Caddy LICENSE does not match the manifest checksum.', 'CADDY_LICENSE_MISSING', 'Reinstall dsh-auth.');
		}
		catch {
		prerequisite('Caddy platform package.json is invalid.', 'CADDY_PACKAGE_INVALID', 'Reinstall the matching dsh-auth-caddy platform package.');
		const platforms = manifest.platforms;
		if (platforms === null \|\| typeof platforms !== 'object' \|\| Array.isArray(platforms)) {
		prerequisite('Bundled Caddy manifest platforms are invalid.', 'CADDY_PACKAGE_INVALID', 'Reinstall dsh-auth.');
		}
		if (pkg.name !== name \|\| pkg.version !== CADDY_PACKAGE_VERSION) {
		prerequisite('Caddy platform package version does not match the frozen edge runtime.', 'CADDY_PACKAGE_VERSION', `Use ${name}@${CADDY_PACKAGE_VERSION}.`);
		const entry = platforms[selected];
		if (entry === null \|\| typeof entry !== 'object' \|\| Array.isArray(entry)) {
		prerequisite('Bundled Caddy is missing the current architecture.', 'CADDY_PACKAGE_INVALID', 'Reinstall the complete dsh-auth tarball that includes linux-x64 and linux-arm64 binaries.');
		}
		const manifest = readManifest(host, directory);
		if (manifest.caddyVersion !== CADDY_VERSION \|\| manifest.executable !== 'caddy' \|\| typeof manifest.binarySha256 !== 'string' \|\| !sha256Hex(manifest.binarySha256)) {
		prerequisite('Caddy platform package manifest fields are invalid.', 'CADDY_PACKAGE_INVALID', 'Reinstall the matching dsh-auth-caddy platform package.');
		const platformEntry = entry;
		if (platformEntry.executable !== `${selected}/caddy` \|\| typeof platformEntry.binarySha256 !== 'string' \|\| !sha256Hex(platformEntry.binarySha256)) {
		prerequisite('Bundled Caddy manifest fields are invalid.', 'CADDY_PACKAGE_INVALID', 'Reinstall dsh-auth.');
		}
		if (!host.regularFile(join(directory, 'LICENSE')) \|\| !host.regularFile(join(directory, 'THIRD_PARTY.md'))) {
		prerequisite('Caddy platform package is missing LICENSE or third-party notices.', 'CADDY_LICENSE_MISSING', 'Reinstall the complete platform package.');
		const executable = join(directory, selected, 'caddy');
		if (!host.regularFile(executable) \|\| digest(host.readFileBytes(executable)) !== platformEntry.binarySha256) {
		prerequisite('Bundled Caddy binary is missing or does not match the checksum.', 'CADDY_BINARY_CHECKSUM', 'Reinstall dsh-auth. Setup never downloads Caddy.');
		}
		const executable = join(directory, 'caddy');
		if (!host.regularFile(executable) \|\| digest(host.readFileBytes(executable)) !== manifest.binarySha256) {
		prerequisite('Caddy binary is missing or does not match the platform package checksum.', 'CADDY_BINARY_CHECKSUM', 'Reinstall the matching dsh-auth-caddy platform package; setup never downloads Caddy.');
		}
		return { name, directory, executable, binarySha256: manifest.binarySha256 };
		return { name: selected, directory, executable, binarySha256: platformEntry.binarySha256 };
		}
		@@ -184,0 +184,0 @@ function publicPorts(request) {

+21

-2

lib/installer/executor.js

		@@ -104,2 +104,15 @@ import { dirname } from 'node:path';
		}
		function caddyValidationConfig(host, state) {
		if (state.request.tls !== 'manual' \|\| state.request.certificate === undefined \|\| state.request.certificateKey === undefined) {
		return { path: state.paths.caddyfile, temporary: false };
		}
		// DynamicUser units load certs through systemd credentials. Those paths do not exist until
		// enable, so setup validates the same Caddyfile rendered against the source certificate files.
		const path = join(state.paths.configDirectory, 'Caddyfile.validate');
		if (host.fileExists(path))
		host.removeFile(path);
		host.writeNewFile(path, renderCaddyfile(state.request, false), 0o600);
		host.chmod(path, 0o600);
		return { path, temporary: true };
		}
		function activateSystem(host, initial) {
		@@ -111,3 +124,10 @@ const systemctlPath = systemctl(host);
		throw new InstallerError('service activation journal is missing', ExitCode.execution);
		runChecked(host, { executable: state.paths.caddyBinary, args: ['validate', '--config', state.paths.caddyfile] }, 'CADDY_CONFIG_VALIDATE_FAILED');
		const validation = caddyValidationConfig(host, state);
		try {
		runChecked(host, { executable: state.paths.caddyBinary, args: ['validate', '--config', validation.path] }, 'CADDY_CONFIG_VALIDATE_FAILED');
		}
		finally {
		if (validation.temporary && host.fileExists(validation.path))
		host.removeFile(validation.path);
		}
		state = updateState(host, state, { activation: { ...activation, daemonReloadAttempted: true } });
		@@ -253,3 +273,2 @@ runChecked(host, { executable: systemctlPath, args: ['daemon-reload'] }, 'SYSTEMD_DAEMON_RELOAD_FAILED');
		state = ensureDirectory(host, state, binaryDirectory, 0o755, 0, 0);
		state = ensureDirectory(host, state, paths.caddyStateDirectory, 0o700, 0, 0);
		state = ensureDirectory(host, state, paths.systemdDropInDirectory, 0o755, 0, 0);
		@@ -256,0 +275,0 @@ }

+1

-1

lib/installer/host.d.ts

		@@ -28,4 +28,4 @@ import type { CommandResult, CommandSpec, InstallerHost } from './types.js';
		randomBytes(size: number): Buffer;
		resolveModulePackage(name: string): string;
		resolveBundledCaddyRoot(): string;
		portBusy(address: string, port: number): boolean;
		}

+2

-4

lib/installer/host.js

		import { randomBytes } from 'node:crypto';
		import { closeSync, constants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, chmodSync, chownSync } from 'node:fs';
		import { createRequire } from 'node:module';
		import { dirname, join } from 'node:path';
		import { spawnSync } from 'node:child_process';
		import { fileURLToPath } from 'node:url';
		const requirePackage = createRequire(fileURLToPath(import.meta.url));
		function snapshotStat(path) {
		@@ -127,4 +125,4 @@ const value = lstatSync(path);
		}
		resolveModulePackage(name) {
		return dirname(requirePackage.resolve(`${name}/package.json`));
		resolveBundledCaddyRoot() {
		return join(fileURLToPath(new URL('../..', import.meta.url)), 'vendor/caddy');
		}
		@@ -131,0 +129,0 @@ portBusy(address, port) {

+1

-1

lib/installer/plan.js

		@@ -385,3 +385,3 @@ import { dirname, isAbsolute, join } from 'node:path';
		{ id: 'create-config-directory', kind: 'create-directory', description: 'Create the permission-restricted configuration directory.', target: paths.configDirectory },
		{ id: 'install-caddy-binary', kind: 'write-file', description: 'Copy the checksum-verified Caddy binary from the platform package.', target: paths.caddyBinary },
		{ id: 'install-caddy-binary', kind: 'write-file', description: 'Copy the checksum-verified Caddy binary bundled in this dsh-auth package.', target: paths.caddyBinary },
		{ id: 'write-session-secret', kind: 'write-file', description: 'Generate and write a new session-signing secret.', target: paths.sessionSecretFile, sensitive: true },
		@@ -388,0 +388,0 @@ ...passwordAction,

+1

-1

lib/installer/types.d.ts

		@@ -196,4 +196,4 @@ /** Stable installer exit codes for automation. */
		randomBytes(size: number): Buffer;
		resolveModulePackage(name: string): string;
		resolveBundledCaddyRoot(): string;
		portBusy(address: string, port: number): boolean;
		}

+11

-3

package.json

		{
		"name": "dsh-auth",
		"version": "0.1.14",
		"version": "0.1.15",
		"description": "Caddy-fronted single-account authentication bundle for DeepSeek Harness",
		@@ -39,3 +39,5 @@ "type": "module",
		"cordis.overlay.yml",
		"deploy/",
		"deploy/caddy/",
		"deploy/docker/",
		"deploy/dsh-auth.env.example",
		"docs/installer.md",
		@@ -45,3 +47,9 @@ "CHANGELOG.md",
		"SECURITY.md",
		"LICENSE"
		"LICENSE",
		"vendor/caddy/manifest.json",
		"vendor/caddy/manifest.sha256",
		"vendor/caddy/LICENSE",
		"vendor/caddy/THIRD_PARTY.md",
		"vendor/caddy/linux-x64/caddy",
		"vendor/caddy/linux-arm64/caddy"
		],
		@@ -48,0 +56,0 @@ "dsh": {

+5

-6

README.md

		@@ -15,7 +15,6 @@ # dsh-auth

		Install the published CLI and the matching Caddy platform package, then start from an existing DSH Web systemd service whose upstream listens only on loopback:
		Install the published CLI, then start from an existing DSH Web systemd service whose upstream listens only on loopback:

		```sh
		sudo npm install -g dsh-auth
		sudo npm install -g dsh-auth-caddy-linux-x64@2.11.4-dsh.1 # or dsh-auth-caddy-linux-arm64@2.11.4-dsh.1
		sudo dsh-auth setup
		@@ -27,8 +26,8 @@ ```
		```sh
		sudo npm install -g dsh-auth@0.1.14
		sudo npm install -g dsh-auth@0.1.15
		```

		The interactive installer asks for the exact DSH service, administrator initialization method, HTTPS hostname, and TLS mode; shows a secret-free plan; and changes the system only after you type the exact confirmation. It installs the pinned bundle into the selected DSH profile, copies a checksum-verified Caddy binary, writes permission-restricted authentication state, and enables an independent `dsh-auth-caddy.service`. It never stores a plaintext password and never downloads Caddy at setup time.
		The interactive installer asks for the exact DSH service, administrator initialization method, HTTPS hostname, and TLS mode; shows a secret-free plan; and changes the system only after you type the exact confirmation. It installs the pinned bundle into the selected DSH profile, copies a checksum-verified Caddy binary bundled in the same package, writes permission-restricted authentication state, and enables an independent `dsh-auth-caddy.service`. It never stores a plaintext password and never downloads Caddy at setup time.

		Normal deployment requires Linux x64 or ARM64, systemd, Node.js 24.7 or newer, DSH Web 0.1.0-rc.7, and the matching `dsh-auth-caddy-*@2.11.4-dsh.1` optional package. Automatic TLS is the HTTPS default. Manual TLS requires an existing certificate and key.
		Normal deployment requires Linux x64 or ARM64, systemd, Node.js 24.7 or newer, and DSH Web 0.1.0-rc.7. Automatic TLS is the HTTPS default. Manual TLS requires an existing certificate and key.

		@@ -284,3 +283,3 @@ ```text

		The output directory contains `dsh-auth.env`, file-backed credentials, authentication state, a login-token directory, and a Caddyfile. Copy or mount them into fixed image paths and explicitly wire the environment file and Caddy config. Place the matching platform Caddy package in the image; setup never downloads the binary. [`deploy/docker/Dockerfile.install`](deploy/docker/Dockerfile.install) shows the offline profile layer.
		The output directory contains `dsh-auth.env`, file-backed credentials, authentication state, a login-token directory, and a Caddyfile. Copy or mount them into fixed image paths and explicitly wire the environment file and Caddy config. The same tarball already contains linux-x64 and linux-arm64 Caddy binaries; setup copies the current architecture after checksum verification and never downloads a binary. [`deploy/docker/Dockerfile.install`](deploy/docker/Dockerfile.install) shows the offline profile layer.

		@@ -287,0 +286,0 @@ ## Security behavior and limits

+2

-2

SECURITY.md

		@@ -49,3 +49,3 @@ # Security policy

		- Caddy is the sole externally reachable listener and uses the project-owned `v2.11.4` binary from the matching platform package.
		- Caddy is the sole externally reachable listener and uses the project-owned `v2.11.4` binary bundled in the installed `dsh-auth` package.
		- Harness listens on the exact configured loopback upstream and is not reachable through any bypass path.
		@@ -99,3 +99,3 @@ - HTTPS is used with a valid certificate and key, TLS 1.2 or newer, and the configured public hostname. TLS must not be silently downgraded between the browser and Caddy.

		Review `dsh-auth plan` before authorizing setup. Caddy is installed only from the exact optional platform package already present on the host. Setup never downloads a binary and never probes, reloads, or reuses a user Caddy or Nginx service.
		Review `dsh-auth plan` before authorizing setup. Caddy is installed only from the exact binaries already bundled in the installed `dsh-auth` package. Setup never downloads a binary and never probes, reloads, or reuses a user Caddy or Nginx service.

		@@ -102,0 +102,0 @@ The installer owns only paths recorded in its validated state. Existing files or packages that it cannot prove ownership of are conflicts. Do not edit managed files in place or fabricate an ownership record. Use `--output-dir` when building images or generating artifacts without granting service-manager or host-filesystem authority.

deploy/nginx/dsh-auth.conf.template

Sorry, the diff of this file is not supported yet

dsh-auth - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics