---
created: 2026-08-21 20:08
modified: 2026-08-21 20:08
type: note
tags:
  - ai
  - family
  - tools
aliases: []
---
# [[# DeepSeek Harness (dsh) Home Lab Setup]]


A brief overview for deploying isolated, tool-restricted DeepSeek Harness instances using Docker, Caddy, and subdomains.

## 1. System Architecture

Instead of subfolders, use subdomains to prevent WebSocket connection failures. Each family member gets an isolated container, distinct workspace volume, and restricted plugin configuration.

```
                  [ Internet / Home Network ]
                               │
                        [ Caddy Proxy ]
         ┌─────────────────────┼─────────────────────┐
         ▼                     ▼                     ▼
[ mum.ds.home.lab ]   [ dad.ds.home.lab ]   [ son.ds.home.lab ]
  (Port 3081)           (Port 3082)           (Port 3083)
  Container: dsh-mum    Container: dsh-dad    Container: dsh-son
  No Bash Plugin        No Bash Plugin        Full Coder Plugins
```

---

## 2. Docker Compose Configuration (`docker-compose.yml`)

This configuration isolates the file system environments. Adjust host directories to match your local system paths.

```yaml
version: '3.8'

services:
  dsh-mum:
    image: node:20-slim
    container_name: dsh-mum
    command: npx @deepseek-ai/dsh web --port 3080
    ports:
      - "3081:3080"
    volumes:
      - /home/user/dsh/mum/workspace:/workspace
      - /home/user/dsh/mum/config:/root/.config
    restart: unless-stopped

  dsh-dad:
    image: node:20-slim
    container_name: dsh-dad
    command: npx @deepseek-ai/dsh web --port 3080
    ports:
      - "3082:3080"
    volumes:
      - /home/user/dsh/dad/workspace:/workspace
      - /home/user/dsh/dad/config:/root/.config
    restart: unless-stopped
```

---

## 3. Caddy Reverse Proxy Configuration (`Caddyfile`)

Map local subdomains cleanly to prevent container path routing errors.

```caddy
mum.ds.home.lab {
    reverse_proxy 127.0.0.1:3081
}

dad.ds.home.lab {
    reverse_proxy 127.0.0.1:3082
}
```

---

## 4. Hardening & Customizing Tools (`dsh.config.yaml`)

To remove terminal or bash access, drop the shell execution plugins from the runtime profile. Place this file inside the user's config volume directory.

```yaml
# Target OmniRoute or external endpoints
providers:
  openai-compatible:
    baseUrl: "https://api.omniroute.example/v1" # Replace with your OmniRoute URL
    apiKey: "your-omniroute-api-key"

# Explicitly register safe household plugins
plugins:
  - name: dsh-plugin-file-editor
  - name: dsh-plugin-translation
  - name: dsh-plugin-ocr

# STRICTLY EXCLUDED (Do not list these to block terminal access):
# - dsh-plugin-shell
# - persistent-bash
```

---

## 5. Deployment Commands

1. **Create directories:** `mkdir -p /home/user/dsh/{mum,dad}/{workspace,config}`
2. **Launch containers:** `docker compose up -d`
3. **Reload proxy:** `caddy reload`