What Is This
DSH (DeepSeek Harness) is an AI automation console I built myself. It runs on the homelab machine .223 and is exposed to the public internet through the dsh domain. The model, plugins, tool calls, and session UI all live in the same harness.
Why I Built It
I wanted to make the "AI does work for me" path actually work end to end: the model can call plugins, search the web, and open a browser, rather than stopping at a chat box. Along the way, I turned the deployment, tunneling, and service setup I used to redo by hand every time into fixed practices.
What It Solves
On search: the default web_search scrapes a single engine, so coverage is narrow. I wrote the dsh-searxng plugin to swap the provider to a self-hosted SearXNG: the instance runs on a Hong Kong VPS and is mapped to local 127.0.0.1:8888 via an SSH tunnel — no public port opened, no firewall rules added, no API key needed, and no DeepSeek search quota burned.
On the UI: dsh-browser-enable is a pure patch plugin that turns on the right-side browser that ships with dsh but is disabled by default in the Web profile. Tunnels and backups are entirely managed by systemd.
Now
Running. I'm still adding to the patch layer; the main things I've learned are DSH deployment, the plugin mechanism, tunneling, and service management.
Features
- 自建 SearXNG 搜索 provider，替换默认的单引擎抓取
- SSH 隧道把香港 VPS 的 SearXNG 映射到本机 127.0.0.1:8888，无公网端口
- dsh-browser-enable：纯 patch 插件，开启右侧栏浏览器
- systemd 托管隧道与备份（searxng-tunnel、dns-hk-tunnel、homelab-git-backup）
- 插件以 bundle patch 层叠加，按 profile 顺序生效，可插拔
Stack: Node.js · SearXNG · systemd · SSH 隧道 · Docker · Linux
1. Preparation
- An always-on Linux base host (here it is .223), with the Node.js version following the plugin's
enginesrequirement (>=18). - A VPS that can directly connect to Google/Bing and other engines (the Hong Kong one here); SearXNG must run there.
2. Start SearXNG on the VPS
Deploy the instance in the official way, listening on 127.0.0.1:8888; do not bind it to the public network. Self-test:
curl 'http://127.0.0.1:8888/search?q=test&format=json'format=json must be explicitly enabled in settings; otherwise, structured results cannot be obtained.
3. Establish the tunnel
searxng-tunnel.service publishes port 8888 on the VPS to the same loopback port on the local machine; for containerized scenarios, use searxng-tunnel-docker.service.
systemctl enable --now searxng-tunnel.service
curl 'http://127.0.0.1:8888/search?q=test&format=json'Only when JSON can be obtained directly on the local machine is the tunnel considered working.
4. Install the dsh-searxng plugin
Put the plugin directory into DSH's plugin path. In package.json, dsh.bundle.patch points to cordis.patch.yml; at DSH startup, overlays are applied in the order of the profile's dsh.profile.bundles.
The patch layer does two things: insert a loader line that registers the searxng provider (ctx.web.registerSearchProvider), and change the base web line's searchProvider from bing-free to searxng. Note that this bundle must come after @deepseek-ai/dsh-web-app; otherwise, the order will be wrong. After restarting, run web_search once to verify.
5. Enable the right sidebar browser
dsh-browser-enable only has a patch and no runtime logic:
- id: ui-sidebar-browser
disabled: falseAfter installing and restarting, the right sidebar browser will appear.
6. Service setup and backup
dns-hk-tunnel.service manages DNS through the Hong Kong tunnel; homelab-git-backup.service + .timer periodically backs up the configuration. Use systemctl list-timers to confirm that the timer is running.
