Introduction¶

When accessing the DSH web interface remotely via Tailscale, several checks are typically required simultaneously: verifying the availability of the HTTPS entry, ensuring local proxies don’t block *.ts.net and 100.64.0.0/10, checking if the relay server is available, and confirming that DSH trusts the remote access address. These steps are scattered across Tailscale, system proxy settings, DSH profiles, and ACLs, making it easy to overlook one.

The following introduces dsh-tailscale-console. It is a plugin for DSH that centralizes common checks and repair entry points into a single dashboard.

What is it¶

dsh-tailscale-console is a Tailscale remote access operational dashboard for DeepSeek Harness (DSH), maintained by evanfang0054, and licensed under the MIT License.

It is designed for scenarios where the DSH web profile is already in use, primarily addressing issues related to entry point verification, macOS proxy bypass, relay server maintenance, and ACL fragment generation during remote access.

Core Features¶

The following lists the capabilities of the verified cards:

Device and Online Status: Displays online/offline status per device; automatically notifies when an offline device comes back online.
Health Check: Performs one-click checks on the HTTPS entry point, the page, /api session list, /sidebar/api, server direct path, and proxy bypass.
HTTPS Entry: View Tailscale Serve status and URL, provide an on/off toggle, and support verification and retry.
Proxy Bypass: Checks *.ts.net and 100.64.0.0/10 in the macOS system proxy bypass list, allowing for one-click reapplication; available on macOS only.
Relay Server: View the status of the relay server within the Tailnet, enable Peer Relay, and perform ping verification.
Access: Displays the remote HTTPS URL, local URL, and the complete dsh web startup command.
ACL Fragment: Generates a tailscale.com/cap/relay grants JSON based on the current device IP.

Installation and Activation¶

The package name is dsh-tailscale-console. Verified documentation does not provide official installation commands. To avoid guessing based on the name, this article does not provide specific installation commands.

Before enabling, you can first confirm the prerequisites:

DSH version must be at least 0.1.0-rc.6, as it requires --trusted-host and the webRuntime service.
The profile runtime environment requires Node 20.x and pnpm >= 9; the verified combination is Node 20.19.2 and pnpm 10.27.0.
After modifying cordis.patch.yml, plugin code, or the dsh-better-sidebar patch, dsh web must be restarted, which will interrupt the currently running session.
The plugin runs with the permissions of the current dsh process; you should check the source code and license before installing. The current verified license is MIT.

Typical Usage¶

First, Confirm the HTTPS Entry Point¶

Tailscale Serve is used to expose local services to HTTPS addresses within the tailnet. First, execute:

tailscale serve --bg 3080

Then view the status:

tailscale serve status

HTTPS is mandatory because browsers only expose crypto.randomUUID within a secure context.

Launch DSH Web¶

When launching dsh web, add both the local tailnet IP and <hostname>.<tailnet>.ts.net to trusted hosts:

dsh web --trusted-host <local-tailnet-ip>:3080 --trusted-host <hostname>.<tailnet>.ts.net

If you wish to hardcode trustedHosts into the profile, you can append the corresponding trusted hosts to:

~/.dsh/profiles/web/cordis.patch.yml

Note: dsh web must be restarted after modification.

macOS Proxy Bypass¶

If your local machine uses a proxy tool that modifies system proxies, *.ts.net and 100.64.0.0/10 might be blocked by the proxy. First, view the current bypass list:

networksetup -getproxybypassdomains "Wi-Fi"

Then write to the bypass list including the Tailscale domain segments:

networksetup -setproxybypassdomains "Wi-Fi" "*.ts.net" "100.64.0.0/10" "*.local" "<local>" "localhost" "127.0.0.1" "192.168.0.0/16" "10.0.0.0/8" "172.16.0.0/12"

Note: -setproxybypassdomains replaces the entire bypass list for that network service, so back up first. This card is only applicable to macOS; non-macOS systems will hide this card.

Configure Relay ACL¶

If relay is needed via a phone, authorization for the relay capability between the device and the relay server is required. You can add a similar snippet to the grants in the Tailscale ACL:

{
  "grants": [
    {
      "src": ["<device-A-ip>", "<device-B-ip>"],
      "dst": ["<server-tailnet-ip>"],
      "app": { "tailscale.com/cap/relay": [] }
    }
  ]
}

Note: src is the device allowed to use relay, and dst is the relay server. Without this authorization, phone relay will not be available.

Relay Ports and Security Groups¶

If Peer Relay is configured, verified documentation requires cloud security groups to allow inbound UDP ports 40000 and 41641.

Use Cases and Notes¶

Suitable for scenarios where DSH web is run on a local macOS machine and accessed via Tailscale on a phone or remote device.
Suitable for operations scenarios requiring maintenance of HTTPS entry points, proxy bypass, relay servers, and ACLs.
The proxy bypass card in the dashboard is only applicable to macOS; non-macOS systems will hide this card.
There is an issue with trustedHostsOf in dsh-better-sidebar 0.10.3. If the profile uses it, the patch in node_modules will be lost after pnpm install and needs to be reapplied.
After modifying cordis.patch.yml, plugin code, or the dsh-better-sidebar patch, dsh web must be restarted, which will interrupt the current session.
The plugin runs with the permissions of the current dsh process; check the source code and license before installing.

Conclusion¶

dsh-tailscale-console centralizes several scattered checkpoints in DSH remote access into a dashboard: entry point, proxy, relay, access commands, and ACL. DSH’s plugin ecosystem emphasizes “everything is a plugin”; the community directory is an independent site with no official affiliation to DeepSeek / Huafan.

The directory page URL is not confirmed in the verified materials and is not listed here. The GitHub address is:

https://github.com/evanfang0054/dsh-tailscale-console

dsh-tailscale-console: Tailscale remote access operations panel for DSH Web