Introduction

DeepSeek Harness (DSH) adopts a plugin-based architecture. The model runs in a controlled environment and cannot directly execute Shell commands. When remotely managing VPN configurations, granting direct Shell access poses significant security risks. The dsh-vpn-ops plugin resolves secure deployment and management of WireGuard and VLESS Reality in DSH through strict workflow control, mandatory authentication, and key streaming mechanisms.

Plugin Introduction

dsh-vpn-ops is a DeepSeek Harness plugin package maintained by zootguru. It converts reviewed server definitions into repeatable preflight, planning, application, status check, validation, rollback, and client export operations.

Core Features

The plugin provides the following tools:

  • vpn_targets: List target servers.
  • vpn_preflight: Run preflight checks.
  • vpn_status: Check server status.
  • vpn_plan: Generate a deployment plan.
  • vpn_apply: Apply WireGuard and VLESS Reality configuration.
  • vpn_verify: Validate the configuration.
  • vpn_rollback: Roll back changes.
  • vpn_export_client: Export client keys to a local file.

Installation and Enablement

Install the plugin using the official command:

dsh plugin --profile my-profile add github:zootguru/dsh-vpn-ops#v0.1.0

After installation, the functionality must be enabled in the configuration file. By default, remote mutations are disabled (allowMutations: false), and the configuration keys need to be manually overridden in cordis.patch.yml.

Typical Usage

The deployment workflow is recommended to be executed in the following order:

  1. Call vpn_targets to obtain the target list.
  2. Call vpn_preflight and vpn_status to check the target status.
  3. Call vpn_plan to generate a deployment plan.
  4. Carefully review the plan contents, and after confirming it is correct, set allowMutations: true and call vpn_apply.
  5. After configuration validation passes, reset allowMutations to false.

When exporting client keys, temporarily enable allowSecretExport. After the tool is called, the keys are written directly to a local file instead of being returned to the model.

Applicable Scenarios and Considerations

  • Permission Requirements: The model cannot use the local Shell, and all remote commands are executed via argv arrays. Target servers must allow root or non-interactive sudo privileges.
  • Target Systems: The target operating system must be Debian or Ubuntu, and must have systemd and specific commands installed (such as wg, xray, etc.).
  • Key Security: Client keys are not returned as tool return values; they are streamed to a local file only.
  • Production Environments: Before deploying to production, operators need an independent pre-production server for acceptance testing.