From aa9e6e68282d99d43a0d66af627749dde8dd728e Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Mon, 24 Aug 2026 16:09:08 +1000 Subject: [PATCH] sam-4screen-desktop 2026-8-24:16:9:8 --- ...LY DeepSeek Harness (dsh) Home Lab Setup.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/000 daily/FAMILY DeepSeek Harness (dsh) Home Lab Setup.md b/000 daily/FAMILY DeepSeek Harness (dsh) Home Lab Setup.md index 2bfab62..a933cdf 100644 --- a/000 daily/FAMILY DeepSeek Harness (dsh) Home Lab Setup.md +++ b/000 daily/FAMILY DeepSeek Harness (dsh) Home Lab Setup.md @@ -11,13 +11,13 @@ aliases: [] # [[# DeepSeek Harness (dsh) Home Lab Setup]] > **IMPLEMENTATION BRIEF for the dsh agent (updated by family-home-lab parent project).** -> The dsh agent builds these instances. The **parent console** (FastAPI portal at `console.home.lab`) is built separately and provides login, session routing and tool launching. Read this whole note before deploying. +> The dsh agent builds these instances. The **parent console** (FastAPI portal at `console.lab.audasmedia.com.au`) is built separately and provides login, session routing and tool launching. Read this whole note before deploying. ## 0. Context — what the parent console provides (do NOT rebuild) The family-home-lab project (`/home/sam/home_network/custom_tools/family_home_lab/plan.md` on .27) deploys on `.13`: -- A FastAPI + Jinja2 + HTMX console at **`console.home.lab`** (port `8500` on .13) with per-user login (**Sam, Jo, Harry, Finn**) — bcrypt password auth, signed HTTP-only session cookies. +- A FastAPI + Jinja2 + HTMX console at **`console.lab.audasmedia.com.au`** (port `8500` on .13) with per-user login (**Sam, Jo, Harry, Finn**) — bcrypt password auth, signed HTTP-only session cookies. - The console links to each user's dsh instance after they log in. - RabbitMQ + Celery workers, PostgreSQL+pgvector, Garage S3 (see [[FAMILY S3 Storage Integration & Blueprint]]). @@ -49,7 +49,7 @@ Subdomains (not subpaths) to prevent WebSocket failures: │ ┌──────────┬────────┼─────────┬──────────────┐ ▼ ▼ ▼ ▼ ▼ -dsh-sam dsh-jo dsh-harry dsh-finn console.home.lab +dsh-sam dsh-jo dsh-harry dsh-finn console.lab.audasmedia.com.au :3081 :3082 :3083 :3084 (.13:8500) ``` @@ -77,21 +77,21 @@ Data lives under `/mnt/data/family-home-lab/dsh//` so it's covered by the ## 4. Caddy entries (on .35, `/etc/caddy/Caddyfile` or its compose config) ```caddy -dsh-sam.home.lab { +dsh-sam.lab.audasmedia.com.au { reverse_proxy 192.168.20.13:3081 } -dsh-jo.home.lab { +dsh-jo.lab.audasmedia.com.au { reverse_proxy 192.168.20.13:3082 } -dsh-harry.home.lab { +dsh-harry.lab.audasmedia.com.au { reverse_proxy 192.168.20.13:3083 } -dsh-finn.home.lab { +dsh-finn.lab.audasmedia.com.au { reverse_proxy 192.168.20.13:3084 } ``` -**Iframe requirement (from parent console):** tools are embedded inline in the console where possible. Ensure Caddy does not add `X-Frame-Options: DENY` and that dsh sets no restrictive CSP frame-ancestors. If dsh sets headers itself, allow framing from `console.home.lab`. +**Iframe requirement (from parent console):** tools are embedded inline in the console where possible. Ensure Caddy does not add `X-Frame-Options: DENY` and that dsh sets no restrictive CSP frame-ancestors. If dsh sets headers itself, allow framing from `console.lab.audasmedia.com.au`. **Session handoff (to coordinate with console):** the console links out with a short-lived one-time token (`?token=...`) so users don't re-enter credentials; dsh should accept and exchange it, or at minimum tolerate being launched from the console. Coordinate final design with the parent project. @@ -120,7 +120,7 @@ Per-user restrictions: Sam full plugins; Jo/Harry/Finn no shell/bash plugins. 1. `mkdir -p /mnt/data/family-home-lab/dsh/{sam,jo,harry,finn}/{workspace,config}` 2. Compose up from `/home/sam/Docker/Containers/dsh/` -3. Add Pi-hole DNS records: `dsh-{sam,jo,harry,finn}.home.lab` → `.35` +3. ~~Pi-hole records~~ not needed — public DNS `*.lab.audasmedia.com.au` already resolves to `.35` 4. Add Caddyfile entries on .35, reload 5. Configure OmniRoute provider keys per instance 6. Verify WebSocket connectivity through Caddy