There are two layers of flags and they are easy to confuse: the launcher picks a profile, the app serves it.
Launcher (dsh itself)
| Flag | What it does |
|---|---|
| --profile <name> | Boot a profile under $DSH_HOME/profiles |
| --patch <path> | Add a patch overlay on top of the profile, repeatable |
| --dump-config | Print the composed config tree and exit |
| --dump-default-config | Print the tree without the user layer and exit |
| -V, --version | Print the version |
Flags of the web app
Usage: dsh --profile web [options] --host <host> bind host --no-open do not open the Web UI in the default browser --port <port> listen port; pass 0 to let the OS pick a free one --trusted-host <authority...> extra authority the /api browser-trust fence accepts -h, --help show this help
Defaults worth remembering:
- --port 0 asks the OS for a free port and prints the one it got. The cheapest fix for a port clash you cannot kill.
- --no-open only suppresses the browser window. The URL is still printed and the token still generated. Autostart scripts use it.
- --trusted-host does not disable auth; it appends allowlist entries to the /api fence. Reaching it from another machine needs more than a host change.
- --host 0.0.0.0 means LAN-reachable. Think first: anyone on that network with the token gets your quota and your file permissions.
For LAN use, keeping the 127.0.0.1 bind plus an SSH tunnel or a reverse proxy with your own auth is safer. Exposing 0.0.0.0 puts filesystem reach behind a 43-character string.
Read the flags for your own version
dsh --help dsh web --help
Flags change between versions. 0.2.x and 0.1.x already differ; do not test an old flag table against a new build.