dsh-docker

Docker template for running the DeepSeek Harness Web UI. 简体中文

Quickstart

cp .env.example .env
docker compose up -d

Configure the provider URL, credentials, and model through the Web UI. Public deployments require the Nginx session login (24-hour expiry by default) before this configuration is available.

Open http://localhost:3080.

Stop the service with:

docker compose down

Local data and live configuration

• config/ is mounted at /dsh-home and stores Harness state and user configuration.
• workspace/ is mounted at /home/node, which is the default workspace location shown by the Web UI.

Configure provider settings after startup through the Web UI. Public deployments require the Nginx session login first. DSH watches user configuration and credential files under config/; changes apply to subsequent requests without restarting the container. .env contains Compose-only settings such as the host port and Nginx trusted host.

Ports

Only two host ports are ever published, both defined once in .env:

DSH_PORT=3080   # DSH Web UI, published on host 127.0.0.1
AUTH_PORT=8081  # login/session service, published on host 127.0.0.1

• The Compose publish mapping and DSH's trust fence (--trusted-host) both read DSH_PORT automatically; no other file needs editing.
• Container-internal ports are private constants that are never published and can be ignored when changing ports: socat 3080 → dsh web 3081 inside the DSH container, 8081 inside the auth container.
• Nginx is the only host-side file to sync. Its port literals are centralized in the constants block at the top of nginx/dsh.conf.example (two set lines mirroring .env); or let .env stay the single source of truth by rendering:

./scripts/render-nginx-conf.sh | sudo tee /etc/nginx/sites-available/dsh.conf

Port-change procedure: edit .env → docker compose up -d → re-render (or sync the constants block) → sudo nginx -t && sudo systemctl reload nginx.

Public deployment

Public deployment requires a DNS record, a TLS certificate, Nginx, and an authenticated reverse proxy. Do not expose the Docker port directly to the Internet.

Public authentication uses a login service plus session cookies: Nginx validates every request's session cookie with an internal auth_request subrequest and redirects invalid or expired sessions to the /login/ page. Sessions expire after 24 hours by default; restarting the auth service invalidates every session immediately.

Set the public authority and the login password in .env:

DSH_PORT=3080
DSH_TRUSTED_HOST=dsh.example.com
AUTH_PASSWORD=<strong random password>
# AUTH_TTL_HOURS=24

Generate a password:

openssl rand -base64 24 | tr '+/' '-_' | tr -d '='

Start DSH and the login service, and keep the host ports bound to localhost:

docker compose up -d --build

Use nginx/dsh.conf.example as the reverse-proxy starting point (ports — see “Ports” above), then set its server_name, TLS certificate paths, and HTTPS listener, and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Authentication behavior

• The first request to any page redirects to /login/; enter AUTH_PASSWORD from .env.
• A successful login sets a dsh_session cookie (HttpOnly + SameSite=Lax, plus Secure over HTTPS) that expires after AUTH_TTL_HOURS (default 24); afterwards the user is sent back to the login page.
• Sessions live in the auth container's memory: docker compose restart auth (or rebooting the host) logs everyone out immediately.
• 5 consecutive wrong passwords lock that source IP for 15 minutes.

The public URL is then https://dsh.example.com.