Introduction

DeepSeek Harness (dsh) runs locally. If you want to use it on devices over external networks, you typically need to expose ports to the public internet, which creates security risks. dsh-relay provides a solution that combines a Cloud Relay and a Host Plugin. Without modifying the dsh core code, it fully maps a local instance to the public network, enabling remote access with zero port exposure.

Plugin Overview

  • Name: dsh-relay
  • Author: SunNull
  • Category: Network Tool
  • License: MIT

Core Features

  • Cloud relay for DeepSeek Harness: Forwards requests through a cloud relay service.
  • Expose your home dsh instance: Fully exposes your home dsh instance to any device, supporting all native features such as real-time session synchronization and streaming output.
  • Out-of-tree plugin + wire-trunk architecture: Operates as an out-of-tree plugin and uses the Wire-Trunk architecture for communication.
  • Process invisible browser: The home-side plugin replays requests with a loopback identity, making the process invisible.
  • HTTPS support: Supports encrypted connections for public network access.
  • Cordis architecture: Developed based on the Cordis ecosystem.

Installation and Enablement

This plugin depends on a Node.js environment (Node >= 22 is required).

Installation command:

dsh plugin --profile web add "github:SunNull/dsh-relay"

Typical Usage

Generate authentication credentials (used to configure the relay connection):
* Generate a trunk token (32 characters):

    node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"
  • Generate a pairing code (8 characters):
    node -e "console.log(require('crypto').randomBytes(4).toString('hex'))"

Installation methods:
* Standard installation (recommended for enabling the management panel):

    dsh plugin --profile web add "github:SunNull/dsh-relay"
  • Using the installer (can automatically configure):
    node install.mjs --relay-url ws://<your-server-IP>:8443/trunk --token <TOKEN>

Working Principle

Wire-Trunk architecture:
* Home side: As an out-of-tree plugin, it runs inside the dsh process. It acts as an “invisible browser,” reuses the local 127.0.0.1:3080 dsh protocol connection, and forwards requests unchanged to the cloud.
* Cloud side: A pure forwarding plane responsible for relaying HTTPS requests to the home side.
* Security: The home side does not need to open inbound ports, and requests enter with a loopback identity. Authentication (pairing code) is handled at the cloud entry point, making it inherently NAT-traversable.

Notes

  • Environment requirements: The Node.js version must be >= 22.
  • Configuration file: The plugin uses ~/.dsh/profiles/web/cordis.patch.yml for configuration.
  • Plugin type: Developed as a host-plugin and runs inside the dsh process.
  • License: MIT.

Reference Links

  • GitHub: https://github.com/SunNull/dsh-relay
  • Plugin catalog: https://www.skillhub.cn/plugins/SunNull/dsh-relay