sam/obsidian-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sam-4screen-desktop 2026-8-24:16:9:8

Browse Source
This commit is contained in:
Sam Rolfe
2026-08-24 16:09:08 +10:00
parent 95ecbd233c
commit aa9e6e6828
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
000 daily/FAMILY DeepSeek Harness (dsh) Home Lab Setup.md
View File

@@ -11,13 +11,13 @@ aliases: []
# [[# DeepSeek Harness (dsh) Home Lab Setup]] # [[# DeepSeek Harness (dsh) Home Lab Setup]]
> **IMPLEMENTATION BRIEF for the dsh agent (updated by family-home-lab parent project).** > **IMPLEMENTATION BRIEF for the dsh agent (updated by family-home-lab parent project).**
> The dsh agent builds these instances. The **parent console** (FastAPI portal at `console.home.lab`) is built separately and provides login, session routing and tool launching. Read this whole note before deploying. > The dsh agent builds these instances. The **parent console** (FastAPI portal at `console.lab.audasmedia.com.au`) is built separately and provides login, session routing and tool launching. Read this whole note before deploying.
## 0. Context — what the parent console provides (do NOT rebuild) ## 0. Context — what the parent console provides (do NOT rebuild)
The family-home-lab project (`/home/sam/home_network/custom_tools/family_home_lab/plan.md` on .27) deploys on `.13`: The family-home-lab project (`/home/sam/home_network/custom_tools/family_home_lab/plan.md` on .27) deploys on `.13`:
- A FastAPI + Jinja2 + HTMX console at **`console.home.lab`** (port `8500` on .13) with per-user login (**Sam, Jo, Harry, Finn**) — bcrypt password auth, signed HTTP-only session cookies. - A FastAPI + Jinja2 + HTMX console at **`console.lab.audasmedia.com.au`** (port `8500` on .13) with per-user login (**Sam, Jo, Harry, Finn**) — bcrypt password auth, signed HTTP-only session cookies.
- The console links to each user's dsh instance after they log in. - The console links to each user's dsh instance after they log in.
- RabbitMQ + Celery workers, PostgreSQL+pgvector, Garage S3 (see [[FAMILY S3 Storage Integration & Blueprint]]). - RabbitMQ + Celery workers, PostgreSQL+pgvector, Garage S3 (see [[FAMILY S3 Storage Integration & Blueprint]]).
@@ -49,7 +49,7 @@ Subdomains (not subpaths) to prevent WebSocket failures:
│ │
┌──────────┬────────┼─────────┬──────────────┐ ┌──────────┬────────┼─────────┬──────────────┐
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
dsh-sam dsh-jo dsh-harry dsh-finn console.home.lab dsh-sam dsh-jo dsh-harry dsh-finn console.lab.audasmedia.com.au
:3081 :3082 :3083 :3084 (.13:8500) :3081 :3082 :3083 :3084 (.13:8500)
``` ```
@@ -77,21 +77,21 @@ Data lives under `/mnt/data/family-home-lab/dsh/<user>/` so it's covered by the
## 4. Caddy entries (on .35, `/etc/caddy/Caddyfile` or its compose config) ## 4. Caddy entries (on .35, `/etc/caddy/Caddyfile` or its compose config)
```caddy ```caddy
dsh-sam.home.lab { dsh-sam.lab.audasmedia.com.au {
reverse_proxy 192.168.20.13:3081 reverse_proxy 192.168.20.13:3081
} }
dsh-jo.home.lab { dsh-jo.lab.audasmedia.com.au {
reverse_proxy 192.168.20.13:3082 reverse_proxy 192.168.20.13:3082
} }
dsh-harry.home.lab { dsh-harry.lab.audasmedia.com.au {
reverse_proxy 192.168.20.13:3083 reverse_proxy 192.168.20.13:3083
} }
dsh-finn.home.lab { dsh-finn.lab.audasmedia.com.au {
reverse_proxy 192.168.20.13:3084 reverse_proxy 192.168.20.13:3084
} }
``` ```
**Iframe requirement (from parent console):** tools are embedded inline in the console where possible. Ensure Caddy does not add `X-Frame-Options: DENY` and that dsh sets no restrictive CSP frame-ancestors. If dsh sets headers itself, allow framing from `console.home.lab`. **Iframe requirement (from parent console):** tools are embedded inline in the console where possible. Ensure Caddy does not add `X-Frame-Options: DENY` and that dsh sets no restrictive CSP frame-ancestors. If dsh sets headers itself, allow framing from `console.lab.audasmedia.com.au`.
**Session handoff (to coordinate with console):** the console links out with a short-lived one-time token (`?token=...`) so users don't re-enter credentials; dsh should accept and exchange it, or at minimum tolerate being launched from the console. Coordinate final design with the parent project. **Session handoff (to coordinate with console):** the console links out with a short-lived one-time token (`?token=...`) so users don't re-enter credentials; dsh should accept and exchange it, or at minimum tolerate being launched from the console. Coordinate final design with the parent project.
@@ -120,7 +120,7 @@ Per-user restrictions: Sam full plugins; Jo/Harry/Finn no shell/bash plugins.
1. `mkdir -p /mnt/data/family-home-lab/dsh/{sam,jo,harry,finn}/{workspace,config}` 1. `mkdir -p /mnt/data/family-home-lab/dsh/{sam,jo,harry,finn}/{workspace,config}`
2. Compose up from `/home/sam/Docker/Containers/dsh/` 2. Compose up from `/home/sam/Docker/Containers/dsh/`
3. Add Pi-hole DNS records: `dsh-{sam,jo,harry,finn}.home.lab` → `.35` 3. ~~Pi-hole records~~ not needed — public DNS `*.lab.audasmedia.com.au` already resolves to `.35`
4. Add Caddyfile entries on .35, reload 4. Add Caddyfile entries on .35, reload
5. Configure OmniRoute provider keys per instance 5. Configure OmniRoute provider keys per instance
6. Verify WebSocket connectivity through Caddy 6. Verify WebSocket connectivity through Caddy