Deployment Guide

Get the gateway running in five minutes

Install with one command, complete two setup steps in the admin console, then send employees a single link. No external database — it runs fully inside your intranet.

One-command installBuilt-in SQLite, zero dependenciesData stays on-prem

Deployment flow

Install and start the gateway

Install globally, then start it from any directory. The first start creates the ./data directory and a bootstrap admin.

bash

npm i -g dsh-enterprise-gateway
dsh-enterprise-gateway

The initial admin password is printed once in the startup log — save it immediately. The gateway then listens on http://127.0.0.1:8899. Prefer no global install? Use npx dsh-enterprise-gateway; relocate the data directory via ENT_DATA_DIR / ENT_DB_PATH.

127.0.0.1:8899/admin

Admin sign-in · the initial password is printed once in the gateway console log

Complete two steps in the admin console

Open /admin and sign in. Two actions make it serve traffic:

Providers & Models: add an AI provider (baseUrl + API key)
User Management: create enterprise accounts for employees

Provider keys can also go into data/.env, one per line: ENT_PROV_<NAME>_KEY=sk-xxx. Most policy changes hot-apply from the admin console, no restart.

Send employees the link

The enterprise plugin isn't installed standalone — it runs inside DSH Desktop and requires the gateway. The gateway ships a built-in setup page; the admin just sends the gateway URL:

text

http://<gateway-ip>:8899/

Opening it redirects to the setup page; the user follows the on-screen steps and copies one command:

Detects Windows / Mac automatically; the command carries the gateway address — nothing to type
Install scripts are served by the gateway itself, so intranets work without public internet
Installs the latest DSH Desktop + enterprise plugin + all presets, then opens on the sign-in page
Idempotent: re-run freely if anything fails; never touches user session data

<gateway-ip>:8899

Setup page · per-OS steps, command pre-filled with the gateway address

Users then sign in with the enterprise account created by the admin. Requires macOS 12+ / Windows 10+ (x64), 2 GB disk, network access to GitHub / npm (the Node download on Windows uses a China mirror automatically).

Configuration

Config file data/gateway-config.json (auto-created on first start):

jsonc

{
  "server": { "port": 8899, "host": "0.0.0.0" },
  "auth": { "mode": "jwt" },
  "policy": {
    "allowedPlugins": [],
    "pluginEnforce": "enforce",
    "pluginRegistry": { "mode": "off" }
  }
}

host defaults to loopback; set 0.0.0.0 explicitly for LAN/public access (v3.1 also supports HOST=0.0.0.0)
JWT secret goes in the ENT_JWT_SECRET env var — never in the config file
Provider API keys go into data/.env, one per line: ENT_PROV_<NAME>_KEY=sk-xxx

Backup & upgrade

Backup = copy the data directory (single SQLite file + config + .env); copy it while the gateway is stopped
Upgrade: npm i -g dsh-enterprise-gateway@latest, then restart; data and config are backward-compatible, policies and accounts are untouched
Forgot the password: run node scripts/reset-admin-pw.mjs <new-password> from the package directory (global installs: $(npm root -g)/dsh-enterprise-gateway)

Run from source (developers)

bash

git clone https://github.com/mafeis/dsh-enterprise-gateway.git
cd dsh-enterprise-gateway/gateway
npm install

# Provider keys go into data/.env, one per line: ENT_PROV_<NAME>_KEY=sk-xxx

node gateway.mjs

Requirements

Node.js ≥ 22.5 (built-in SQLite — no database service to install)
2C4G to start; disk sized by your audit trail retention (default 90 days)
Enterprise accounts are created and deactivated in the admin console; LDAP / SSO is not built in yet

For the full option reference, see the repository README and the comments in gateway-config.json.

Get the gateway running in five minutes

Deployment flow ​