Introduction

DeepSeek Harness (DSH) trusts only the local browser by default. Its privileged interfaces (Settings, API Key, plugin management) are protected by a browser trust boundary. If DSH is directly reverse-proxied to the public internet, these pages all stop working.

The dsh-vps plugin solves this by placing a login gateway (dsh-gate) with zero runtime dependencies in front of DSH. Public requests first pass through a scrypt login gate, and the gateway then completes DSH session authentication as a server-side identity and passes the traffic through. After deployment, when you open the browser anywhere, you are using the official native DSH web interface, and all features (Settings, models, API Key, plugin marketplace) remain fully available.

Core Features

  • Dual deployment modes: Supports form-based installation from the DSH plugin marketplace and one-click script installation on a VPS.
  • Login and sessions: Uses scrypt passwords and HMAC session cookies. “Stay signed in” is checked by default and supports staying signed in for up to 30 days.
  • Security hardening: Session cookies are always Secure/HttpOnly/SameSite; diagnostic endpoints are exposed only to the server’s local host and authenticated sessions; the service runs as the unprivileged dsh user.
  • Public access: Provides a native settings page accessible over the public internet via Caddy automatic HTTPS.
  • Observability and recoverability: Provides a /gate/health endpoint to inspect crash reasons; supports one-click upgrade with automatic backup and rollback.
  • Localized experience: Supports bilingual Chinese and English; supports Add to Home Screen on mobile phones; supports a browser initial wizard (admin account, domain, API Key).

Installation

Environment Requirements

  • System: Ubuntu 22.04+ / Debian 12+ (root privileges required)
  • Resources: 2C2G or higher
  • Network: Ports 80/443 must be open

Installation Methods

Method 1: Install in DSH

  1. Search for dsh-vps in the DSH plugin marketplace and run the installation command: dsh plugin add dsh-vps.
  2. Open “Settings → VPS Deployment”, and fill in the server IP, SSH port, username, and password. Also fill in the domain if you have one.
  3. Click “Install to this VPS”. The installation runs in the background, so disconnecting from the page does not affect progress.

Method 2: Run a Script on the VPS

Run the following command on the target VPS:

curl -fsSL https://raw.githubusercontent.com/AIcivilization/dsh-vps/main/install.sh | sudo bash -s

After installation, the system automatically configures systemd management, Caddy automatic HTTPS, and startup on boot.

Usage and Maintenance

At the end of installation, a setup link with a one-time token is provided. If the link is lost, you can retrieve it again on the server:

sudo dsh-vps setup-url

Upgrade and Rollback

When an official new version of DeepSeek Harness is released, the plugin will prompt you to upgrade. Click “Upgrade Now” in “Settings → VPS Deployment”. The upgrade process includes backup, self-check, and automatic rollback mechanisms.

If you need to do it manually or roll back:

# 升级到本项目验证过的版本
sudo dsh-vps upgrade

# 回滚到上一个版本
sudo dsh-vps rollback

Conclusion

dsh-vps is a solution for fully self-hosted deployment of DeepSeek Harness. Through gateway pass-through and security hardening, it preserves the native DSH interface while enabling public access and secure management.