dsh-relay

dsh-relay

English | 简体中文

Reach your own DeepSeek Harness (DSH) from your phone, wherever you are. The computer running DSH keeps an outbound connection to an endpoint you control — a self-hosted relay server, or an frp server you already have. No inbound ports are opened on your computer, connections recover on their own after network switches and reboots, and the man in the middle is you — not a tunnel cloud.

How it works

Phone ──HTTPS──▶ Public entry          Your computer (DSH)
                 (frps or                 │ ▲ outbound tunnel,
                  your relay server)      │ ▼ plugin dials out
                                  ─────────────────▶ dsh-relay plugin
                                                       local reverse proxy :3082
                                                         └─▶ DSH web (127.0.0.1:3080)

The plugin rewrites Host/Origin headers so DSH's loopback trust bar sees a local client, handles the browser session handshake, keeps WebSockets alive across NAT, and enforces an access PIN on every public path. Your phone sees the same UI as your desktop, in real time.

Features

• Two ways to get a public entry
  • frp tunnel — reuse an frp server you (or a friend) already have: just two required fields (frps address and token); a live Test connection really logs in to the frps once before you start; leave the remote port empty and the plugin discovers the assigned port and builds the QR code for you
  • Self-hosted relay server — one Docker container; multi-tenant (many computers, isolated per-client secrets), web admin console, join-by-approval enrollment, automatic key rotation
  • LAN only — QR-code direct connection on the same WiFi, no tunnel at all
• Self-healing — bounded exponential-backoff reconnects (guarded by worst-case regression tests that watch RSS and reconnect rates), automatic recovery after server restarts, computer reboots, and network switches
• Security in depth — see Security

Two access modes compared

Quick start

Requirements: a running DSH web instance, and Node.js ≥ 22 with pnpm for development.

1. Install the plugin (on the computer running DSH) — one command, straight from GitHub:

dsh plugin --profile web add 'github:xiaohanqing/dsh-relay#path:packages/plugin'
# restart dsh web, then open Settings → DSH Relay

To upgrade later, run the same command again (or dsh plugin --profile web update dsh-relay).

2a. Connect through an frp server you already have (most common path):

In the plugin settings, choose frp tunnel as the access mode and fill in just:

• frps server address — e.g. frps.example.com:7000 (port optional, defaults to 7000)
• auth token

Click Test connection — the plugin really connects to the frps and logs in once; once it passes, click Start. The remote port is optional (empty = assigned by the frps; the plugin discovers the actual port and generates the QR code automatically). Open the public URL (or scan the QR code) on your phone and enter the access PIN.

2b. Or run your own relay server:

cd packages/server
docker compose up -d --build
docker compose logs relay | grep "admin password"   # initial admin console password

Open https://<server>:8443/__relay/admin, then use One-click join in the plugin settings and approve the request in the admin console. Details: docs/deploy-nas.md.

Security

• Three gates: per-client relay tokens, an 8-character access PIN enforced on every public path (with rate-limited lockout), and a separate admin console password
• Rotating secrets: relay keys rotate automatically every 30 days with a 10-minute grace window; rotation is pushed over the already-authenticated channel
• No storage: the relay server forwards bytes and keeps no business data
• Plaintext warning: with an frp TCP mapping, the leg between your phone and the frps is plaintext, and the PIN travels over it. Prefer an HTTPS front end in front of frp; the trade-offs are laid out in docs/tunnel.md

Documentation

• Tunnel mode guide — every supported tool, what to fill in, security notes
• Relay server deployment — TLS certificates, DDNS, port forwarding, nginx
• Protocol specification — tunnel protocol v1.1 (relay mode)
• Acceptance checklist — verify a deployment end to end
• Package READMEs: plugin · server

License

MIT