Reach your DeepSeek Harness host from your LAN, Tailnet, or an existing HTTPS endpoint. Pair a client once and keep multiple routes attached to the same host identity.
One host, several ways to connect
| Route | Address | Setup |
|---|
| LAN | A reachable local gateway address | Choose LAN and scan the pairing QR. |
| Tailnet | A Tailscale Serve MagicDNS HTTPS URL | Choose Tailscale on an already signed-in host. |
| Custom HTTPS | Your working reverse-proxy URL | Supply the address when creating the QR. |
DSH stays on loopback. The plugin puts an authenticated gateway in front of it, with short-lived pairing tickets, rotating device credentials, and a persistent host ID.
Quick start
dsh plugin --profile web add dsh-network@latest
dsh web
Open Settings → Network to see the host and create a pairing QR, or use the setup assistant in another terminal:
dsh plugin --profile web exec dsh-network setup
Choose LAN, Tailscale, or Custom address. The assistant asks when no mode is supplied. Scan the result with a compatible client.
The default gateway listens on port 3081. DSH's underlying Web server remains bound to loopback at its configured port.
Choose your route
# LAN: both devices must be able to reach each other
dsh plugin --profile web exec dsh-network setup lan
# Tailnet: requires Tailscale already installed and signed in
dsh plugin --profile web exec dsh-network setup tailscale
# A working HTTPS gateway you already operate
dsh plugin --profile web exec dsh-network setup custom --url https://dsh.example.com
Use --url http://HOST:3081 if LAN detection selects the wrong interface. Tailscale setup configures Serve to forward to the authenticated gateway. A custom public route must already provide trusted HTTPS and HTTP/WebSocket forwarding; this plugin does not configure DNS, certificates, firewalls, or a reverse proxy.
Settings that explain the current state
The Network page groups host identity and device pairing separately, with labelled inputs, pending states, and inline errors. It follows DSH's English/Chinese locale and light/dark theme. Pending settings requests stop when the panel unmounts.
An optional iosAppDownloadURL displays a dismissible app-download card when configured with a valid HTTPS URL. Without one, the card stays hidden.
Configuration
| Field | Default | Purpose |
|---|
gatewayPort | 3081 | Authenticated gateway port. |
bindHost | 0.0.0.0 | Gateway interfaces; 127.0.0.1 limits it to loopback. |
hostName | System hostname | Host display name. |
statePath | $DSH_HOME/network/state.json | Pairing and device state. |
historyChunkTrim | true | Remove redundant settled streaming chunks from history responses. |
historyTrustedHosts | [] | Additional allowed direct-Web Host values for history routes. |
iosAppDownloadURL | Unset | App Store or TestFlight HTTPS URL for the optional card. |
DSH_HOME defaults to ~/.dsh. History trimming preserves rendered messages, first-token timing, and current partial output while reducing redundant deltas; savings depend on the session. Its routes retain the host's origin and cross-site checks.
Pairing & credentials
Pairing tickets are single-use and expire after five minutes. A paired client receives a refresh credential and a one-hour access token; refresh rotates both. The host stores hashes, not the original credentials. Pairing links are generated on demand rather than broadcast.
LAN HTTP relies on a trusted local network. For a public route, expose the authenticated gateway through HTTPS, not the underlying DSH Web port. See public deployment boundaries.
Troubleshooting
| Symptom | Check |
|---|
| LAN address does not open | Device reachability, private-interface firewall rules, and the selected IP. |
| Tailscale setup fails | tailscale status and the host's existing sign-in. |
| Public route fails | Trusted TLS and both HTTP/WebSocket reverse-proxy forwarding. |
| Pairing QR expired | Generate a new single-use ticket. |
Full device listing and revocation controls in settings remain future work; the current panel exposes host status, paired-device count, and pairing.
Development & feedback
npm ci
npm run check
Report an issue · Release notes · MIT license
