obsidian-vault/000 daily/DeepSeek Harness (dsh) Home Lab Setup.md

created, modified, type, tags, aliases

created	modified	type	tags	aliases
2026-08-21 20:08	2026-08-21 20:08	note

# DeepSeek Harness (dsh) Home Lab Setup

A brief overview for deploying isolated, tool-restricted DeepSeek Harness instances using Docker, Caddy, and subdomains.

1. System Architecture

Instead of subfolders, use subdomains to prevent WebSocket connection failures. Each family member gets an isolated container, distinct workspace volume, and restricted plugin configuration.

                  [ Internet / Home Network ]
                               │
                        [ Caddy Proxy ]
         ┌─────────────────────┼─────────────────────┐
         ▼                     ▼                     ▼
[ mum.ds.home.lab ]   [ dad.ds.home.lab ]   [ son.ds.home.lab ]
  (Port 3081)           (Port 3082)           (Port 3083)
  Container: dsh-mum    Container: dsh-dad    Container: dsh-son
  No Bash Plugin        No Bash Plugin        Full Coder Plugins

---

2. Docker Compose Configuration (docker-compose.yml)

This configuration isolates the file system environments. Adjust host directories to match your local system paths.

version: '3.8'

services:
  dsh-mum:
    image: node:20-slim
    container_name: dsh-mum
    command: npx @deepseek-ai/dsh web --port 3080
    ports:
      - "3081:3080"
    volumes:
      - /home/user/dsh/mum/workspace:/workspace
      - /home/user/dsh/mum/config:/root/.config
    restart: unless-stopped

  dsh-dad:
    image: node:20-slim
    container_name: dsh-dad
    command: npx @deepseek-ai/dsh web --port 3080
    ports:
      - "3082:3080"
    volumes:
      - /home/user/dsh/dad/workspace:/workspace
      - /home/user/dsh/dad/config:/root/.config
    restart: unless-stopped

---

3. Caddy Reverse Proxy Configuration (Caddyfile)

Map local subdomains cleanly to prevent container path routing errors.

mum.ds.home.lab {
    reverse_proxy 127.0.0.1:3081
}

dad.ds.home.lab {
    reverse_proxy 127.0.0.1:3082
}

---

4. Hardening & Customizing Tools (dsh.config.yaml)

To remove terminal or bash access, drop the shell execution plugins from the runtime profile. Place this file inside the user's config volume directory.

# Target OmniRoute or external endpoints
providers:
  openai-compatible:
    baseUrl: "https://api.omniroute.example/v1" # Replace with your OmniRoute URL
    apiKey: "your-omniroute-api-key"

# Explicitly register safe household plugins
plugins:
  - name: dsh-plugin-file-editor
  - name: dsh-plugin-translation
  - name: dsh-plugin-ocr

# STRICTLY EXCLUDED (Do not list these to block terminal access):
# - dsh-plugin-shell
# - persistent-bash

---

5. Deployment Commands

1. Create directories: mkdir -p /home/user/dsh/{mum,dad}/{workspace,config}
2. Launch containers: docker compose up -d
3. Reload proxy: caddy reload