sam-4screen-desktop 2026-8-21:21:39:8

2026-08-21 21:39:08 +10:00
parent 8e1cb0c520
commit 72d8e3e1d7
3 changed files with 271 additions and 6 deletions
--- a/daily/FAMILY
+++ b/daily/FAMILY
@@ -0,0 +1,112 @@
+---
+created: 2026-08-21 20:08
+modified: 2026-08-21 20:08
+type: note
+tags:
+  - ai
+  - family
+  - tools
+aliases: []
+---
+# [[# DeepSeek Harness (dsh) Home Lab Setup]]
+
+
+A brief overview for deploying isolated, tool-restricted DeepSeek Harness instances using Docker, Caddy, and subdomains.
+
+## 1. System Architecture
+
+Instead of subfolders, use subdomains to prevent WebSocket connection failures. Each family member gets an isolated container, distinct workspace volume, and restricted plugin configuration.
+
+```
+                  [ Internet / Home Network ]
+                               │
+                        [ Caddy Proxy ]
+         ┌─────────────────────┼─────────────────────┐
+         ▼                     ▼                     ▼
+[ mum.ds.home.lab ]   [ dad.ds.home.lab ]   [ son.ds.home.lab ]
+  (Port 3081)           (Port 3082)           (Port 3083)
+  Container: dsh-mum    Container: dsh-dad    Container: dsh-son
+  No Bash Plugin        No Bash Plugin        Full Coder Plugins
+```
+
+---
+
+## 2. Docker Compose Configuration (`docker-compose.yml`)
+
+This configuration isolates the file system environments. Adjust host directories to match your local system paths.
+
+```yaml
+version: '3.8'
+
+services:
+  dsh-mum:
+    image: node:20-slim
+    container_name: dsh-mum
+    command: npx @deepseek-ai/dsh web --port 3080
+    ports:
+      - "3081:3080"
+    volumes:
+      - /home/user/dsh/mum/workspace:/workspace
+      - /home/user/dsh/mum/config:/root/.config
+    restart: unless-stopped
+
+  dsh-dad:
+    image: node:20-slim
+    container_name: dsh-dad
+    command: npx @deepseek-ai/dsh web --port 3080
+    ports:
+      - "3082:3080"
+    volumes:
+      - /home/user/dsh/dad/workspace:/workspace
+      - /home/user/dsh/dad/config:/root/.config
+    restart: unless-stopped
+```
+
+---
+
+## 3. Caddy Reverse Proxy Configuration (`Caddyfile`)
+
+Map local subdomains cleanly to prevent container path routing errors.
+
+```caddy
+mum.ds.home.lab {
+    reverse_proxy 127.0.0.1:3081
+}
+
+dad.ds.home.lab {
+    reverse_proxy 127.0.0.1:3082
+}
+```
+
+---
+
+## 4. Hardening & Customizing Tools (`dsh.config.yaml`)
+
+To remove terminal or bash access, drop the shell execution plugins from the runtime profile. Place this file inside the user's config volume directory.
+
+```yaml
+# Target OmniRoute or external endpoints
+providers:
+  openai-compatible:
+    baseUrl: "https://api.omniroute.example/v1" # Replace with your OmniRoute URL
+    apiKey: "your-omniroute-api-key"
+
+# Explicitly register safe household plugins
+plugins:
+  - name: dsh-plugin-file-editor
+  - name: dsh-plugin-translation
+  - name: dsh-plugin-ocr
+
+# STRICTLY EXCLUDED (Do not list these to block terminal access):
+# - dsh-plugin-shell
+# - persistent-bash
+```
+
+---
+
+## 5. Deployment Commands
+
+1. **Create directories:** `mkdir -p /home/user/dsh/{mum,dad}/{workspace,config}`
+2. **Launch containers:** `docker compose up -d`
+3. **Reload proxy:** `caddy reload`
+