Foreword

DeepSeek Harness (DSH) provides a Web interface for developers to debug and view sessions, but by default it usually listens only on the local loopback address. If you want to continue work from your phone, you typically need to set up an SSH tunnel or configure complex port forwarding. The moonglasskitty/dsh-tailscale-sync plugin leverages the encrypted tunnel provided by Tailscale, allowing developers to access the Harness Web service from a phone without manually configuring network ports.

What Is This

This is a DSH plugin (networking tool category) maintained by MoonGlassKitty. Its core function is to securely expose the Harness Web service through Tailscale to other devices in the same Tailnet, enabling zero-configuration remote access.

Core Features

  1. Port Locking: Automatically binds the Harness Web service to 127.0.0.1:3080, so it is not exposed to the normal LAN and only local access is allowed.
  2. Automatic Trust: Automatically detects the local *.ts.net domain (via tailscale status) and modifies the /api trust boundary, allowing only that domain.
  3. Zero Configuration: Uses Tailscale’s authentication and MagicDNS capabilities, eliminating the need to manually configure routing and domains.
  4. Cross-Platform: Supports Windows, macOS, and Linux systems.

Installation and Enablement

The installation and enablement process consists of three steps.

  1. Install Tailscale (one-time operation)
    Install Tailscale on both your computer and phone, and log in with the same account. Make sure MagicDNS is enabled on your Tailnet (enabled by default in newer versions).

  2. Install the Plugin
    Run the following command in your computer terminal:

   dsh plugin --profile web add github:MoonGlassKitty/dsh-tailscale-sync
  1. Enable the HTTPS Tunnel
    Run the following command on your computer to start the encrypted tunnel:
   tailscale serve --bg 3080

If you see the message “Serve is not enabled on your tailnet”, follow the prompt and click the link to authorize it once.

Typical Usage

After completing the steps above, your phone can access Harness.

  1. Get the Machine Name
    Run tailscale status on your computer and find your machine name (for example, my-macbook).

  2. Access from the Phone
    Keep Tailscale connected on your phone, then open the following URL in your browser:

   https://<你的机器名>.ts.net
  1. Disable the Tunnel
    When you no longer need remote access, run the following command to turn off the tunnel:
   tailscale serve --https=443 off

Applicable Scenarios and Notes

  • Applicable Scenarios: Suitable for developers who need to continue DeepSeek Harness sessions from a computer on a phone, or for cases where temporary inspection of Harness status is needed.
  • Permissions and Security: The plugin only modifies Web service configuration. Settings and API key management must still be handled locally at http://127.0.0.1:3080 (due to security restrictions in the Harness source code).
  • Network Limitation: The port listens only on the loopback address; devices on a normal LAN cannot directly access this port.
  • MagicDNS Requirement: If MagicDNS is not enabled on your Tailnet, the plugin automatically falls back to local-only access. In that case, you need to manually fill in the trustedHosts configuration item in the cordis.patch.yml file.

Conclusion

By integrating Tailscale, this plugin solves the inconvenience of local-only access to the DSH Web interface and provides a secure, convenient mobile access solution. For more details and source code, see the GitHub repository or the DSH ecosystem directory.