dsh-ip-https

Opening the DeepSeek Harness web UI through a raw public IP exposes a nasty browser problem: without a secure context, crypto.randomUUID is unavailable, and the settings page, workspace, and model loading all fail outright. On top of that, privileged RPC calls and tunnel.start return 403 because the Host header does not match 127.0.0.1, and every restart forces you to fish the launch token out of the terminal log.

dsh-ip-https tackles all three issues in one pass. It injects a polyfill script into the page to restore crypto.randomUUID and enable the settings panel to write settings.yaml in local mode; it rewrites the Host and Origin headers so privileged requests bypass the 403; and it handles HTTPS end-to-end by detecting your public IP, requesting a short-lived Let's Encrypt IP certificate (roughly 6-day validity), redirecting port 80 to 443, and auto-renewing about 48 hours before expiry. No domain, no ICP filing, and not a single line of nginx to hand-write. The login flow is smoothed over as well: opening the root URL redirects to the current process token page, so a phone and a laptop only need one bookmark instead of digging through startup logs each time.

This plugin is built for developers who manage DeepSeek Harness over a bare public IP without a domain or a desire to go through ICP registration. If you already run an nginx reverse proxy, the settings page and privileged RPCs become functional the moment you install the plugin, while HTTPS stays under your existing proxy. One caveat: anyone who can reach that IP can change models and run commands, so lock down the source with a security group or VPN.