113 lines
2.9 KiB
Markdown
113 lines
2.9 KiB
Markdown
---
|
|
created: 2026-08-21 20:08
|
|
modified: 2026-08-21 20:08
|
|
type: note
|
|
tags:
|
|
- ai
|
|
- family
|
|
- tools
|
|
aliases: []
|
|
---
|
|
# [[# DeepSeek Harness (dsh) Home Lab Setup]]
|
|
|
|
|
|
A brief overview for deploying isolated, tool-restricted DeepSeek Harness instances using Docker, Caddy, and subdomains.
|
|
|
|
## 1. System Architecture
|
|
|
|
Instead of subfolders, use subdomains to prevent WebSocket connection failures. Each family member gets an isolated container, distinct workspace volume, and restricted plugin configuration.
|
|
|
|
```
|
|
[ Internet / Home Network ]
|
|
│
|
|
[ Caddy Proxy ]
|
|
┌─────────────────────┼─────────────────────┐
|
|
▼ ▼ ▼
|
|
[ mum.ds.home.lab ] [ dad.ds.home.lab ] [ son.ds.home.lab ]
|
|
(Port 3081) (Port 3082) (Port 3083)
|
|
Container: dsh-mum Container: dsh-dad Container: dsh-son
|
|
No Bash Plugin No Bash Plugin Full Coder Plugins
|
|
```
|
|
|
|
---
|
|
|
|
## 2. Docker Compose Configuration (`docker-compose.yml`)
|
|
|
|
This configuration isolates the file system environments. Adjust host directories to match your local system paths.
|
|
|
|
```yaml
|
|
version: '3.8'
|
|
|
|
services:
|
|
dsh-mum:
|
|
image: node:20-slim
|
|
container_name: dsh-mum
|
|
command: npx @deepseek-ai/dsh web --port 3080
|
|
ports:
|
|
- "3081:3080"
|
|
volumes:
|
|
- /home/user/dsh/mum/workspace:/workspace
|
|
- /home/user/dsh/mum/config:/root/.config
|
|
restart: unless-stopped
|
|
|
|
dsh-dad:
|
|
image: node:20-slim
|
|
container_name: dsh-dad
|
|
command: npx @deepseek-ai/dsh web --port 3080
|
|
ports:
|
|
- "3082:3080"
|
|
volumes:
|
|
- /home/user/dsh/dad/workspace:/workspace
|
|
- /home/user/dsh/dad/config:/root/.config
|
|
restart: unless-stopped
|
|
```
|
|
|
|
---
|
|
|
|
## 3. Caddy Reverse Proxy Configuration (`Caddyfile`)
|
|
|
|
Map local subdomains cleanly to prevent container path routing errors.
|
|
|
|
```caddy
|
|
mum.ds.home.lab {
|
|
reverse_proxy 127.0.0.1:3081
|
|
}
|
|
|
|
dad.ds.home.lab {
|
|
reverse_proxy 127.0.0.1:3082
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 4. Hardening & Customizing Tools (`dsh.config.yaml`)
|
|
|
|
To remove terminal or bash access, drop the shell execution plugins from the runtime profile. Place this file inside the user's config volume directory.
|
|
|
|
```yaml
|
|
# Target OmniRoute or external endpoints
|
|
providers:
|
|
openai-compatible:
|
|
baseUrl: "https://api.omniroute.example/v1" # Replace with your OmniRoute URL
|
|
apiKey: "your-omniroute-api-key"
|
|
|
|
# Explicitly register safe household plugins
|
|
plugins:
|
|
- name: dsh-plugin-file-editor
|
|
- name: dsh-plugin-translation
|
|
- name: dsh-plugin-ocr
|
|
|
|
# STRICTLY EXCLUDED (Do not list these to block terminal access):
|
|
# - dsh-plugin-shell
|
|
# - persistent-bash
|
|
```
|
|
|
|
---
|
|
|
|
## 5. Deployment Commands
|
|
|
|
1. **Create directories:** `mkdir -p /home/user/dsh/{mum,dad}/{workspace,config}`
|
|
2. **Launch containers:** `docker compose up -d`
|
|
3. **Reload proxy:** `caddy reload`
|
|
|