一台云服务器，
让手机也变成 DeepSeek Harness 工作台

# 1) 安装（Node 22 环境）
npm i -g @deepseek-ai/dsh

# 2) 首次启动，日志里会打印带 token 的地址
dsh web --host 127.0.0.1 --port 13080 --trusted-host dsh.example.com

# 3) 装网关 + 手机适配插件
dsh plugin --profile web add github:MrLukezy/dsh-cloud-gateway
dsh plugin --profile web add github:mexiaosqwq/dsh-web-mobile

# 4) nginx 反代到 3080，浏览器打开 https://dsh.example.com/dsh/

[Unit]
Description=DeepSeek Harness Web UI
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=/home/ubuntu
Environment=HOME=/home/ubuntu
Environment=DSH_HOME=/home/ubuntu/.dsh
Environment=PATH=/home/ubuntu/.nvm/versions/node/v22.23.0/bin:/usr/local/bin:/usr/bin:/bin
ExecStart=/home/ubuntu/.nvm/versions/node/v22.23.0/bin/dsh web \
  --host 127.0.0.1 --port 13080 \
  --trusted-host dsh.example.com --trusted-host dsh.example.com:3080
Restart=always
RestartSec=5

[Install]
WantedBy=default.target

systemctl --user daemon-reload
systemctl --user enable --now dsh
loginctl enable-linger $USER   # 关键：不 enable-linger，退出 SSH 服务会被杀

systemctl --user status dsh --no-pager
journalctl --user -u dsh -f    # 实时日志

dsh plugin --profile web add github:MrLukezy/dsh-cloud-gateway
dsh plugin --profile web add github:mexiaosqwq/dsh-web-mobile

# 装完重启一次，让插件 bundle 生效
systemctl --user restart dsh

- id: cloud-gateway
  config:
    listenHost: 0.0.0.0
    listenPort: 3080
    # ★ 必须显式写上游。0.2.x 里 ctx.webStartup.port 拿不到真实端口，
    #   不写会回落到 3080（网关自己），转发打回自己 → 永远登录失败。
    upstreamHost: 127.0.0.1
    upstreamPort: 13080
    basePath: /dsh
    username: your-name
    password: your-password
    trustProxy: true

systemctl --user restart dsh
ss -lntp | grep -E '13080|3080'
# 期望看到 0.0.0.0:3080 和 127.0.0.1:13080

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:3080/dsh/
# 302（跳登录页）说明网关活着

# WebSocket 升级（必须放在 http 上下文，站点文件就是）
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl http2;
    server_name dsh.example.com;

    ssl_certificate     /etc/letsencrypt/live/dsh.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dsh.example.com/privkey.pem;

    client_max_body_size 50m;        # 上传 PDF / 大文件

    # ① 前端构建产物：文件名内嵌内容哈希，可以缓存一年
    location ^~ /assets/ {
        proxy_pass http://127.0.0.1:3080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    # ② 插件 bundle：同样带哈希，同样长缓存
    location ^~ /plugins/ {
        proxy_pass http://127.0.0.1:3080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    # ③ 入口 HTML / API / WebSocket：必须 no-cache，且不缓冲
    location ^~ /dsh/ {
        proxy_pass http://127.0.0.1:3080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;             # 流式输出不卡顿
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
        add_header Cache-Control "no-cache";
    }

    location /api {
        proxy_pass http://127.0.0.1:3080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host       $host;
        proxy_read_timeout 86400;
    }

    # ④ APK 与自更新清单
    location /dsh-apk/ {
        alias /var/www/dsh-apk/;
        add_header Cache-Control "no-store";
    }
}

sudo nginx -t && sudo systemctl reload nginx
curl -sI https://dsh.example.com/dsh/ | head -5

# A 记录生效后
sudo certbot --nginx -d dsh.example.com
sudo certbot renew --dry-run   # 确认自动续期可用

git clone https://github.com/MrLukezy/dsh-mobile.git
cd dsh-mobile

export ANDROID_HOME=$HOME/android-sdk
export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64

./gradlew assembleRelease
# 产物：app/build/outputs/apk/release/app-release.apk（约 19 KB）

/** 默认打开的地址。用户也能在菜单里改。 */
private static final String DEFAULT_URL = "https://dsh.example.com/dsh/";

/** 自更新清单地址 */
private static final String VERSION_CHECK_URL =
        "https://dsh.example.com/dsh-apk/mobile/version.json";

/** 必须和 version.json 的 versionCode 对齐 */
private static final int VERSION_CODE = 2;

keytool -genkeypair -v -keystore keystore/dsh-mobile.jks \
  -alias dsh -keyalg RSA -keysize 2048 -validity 10000

sudo cp app/build/outputs/apk/release/app-release.apk \
        /var/www/dsh-apk/mobile/dsh-mobile.apk

sha=$(sha256sum /var/www/dsh-apk/mobile/dsh-mobile.apk | cut -d' ' -f1)
size=$(stat -c%s /var/www/dsh-apk/mobile/dsh-mobile.apk)

sudo tee /var/www/dsh-apk/mobile/version.json >/dev/null <<EOF
{
  "versionCode": 3,
  "versionName": "1.1.0",
  "url": "https://dsh.example.com/dsh-apk/mobile/dsh-mobile.apk",
  "sha256": "$sha",
  "size": $size,
  "notes": "更新说明，会显示在升级弹窗里"
}
EOF

# 服务活着吗
systemctl --user status dsh --no-pager | head -12

# 链路通吗（登录前应是 302）
curl -sI https://dsh.example.com/dsh/ | head -4

# 网关和 dsh 各自在听吗
ss -lntp | grep -E '13080|3080'

{
  "service": {
    "name": "DeepSeek Harness (dsh web)",
    "version": "0.2.1-rc.2",
    "bind": "127.0.0.1:13080",
    "home": "/home/ubuntu/.dsh",
    "unit": "dsh.service (systemd --user, linger enabled)"
  },
  "gateway": {
    "plugin": "dsh-cloud-gateway",
    "listen": "0.0.0.0:3080",
    "basePath": "/dsh",
    "upstream": "http://127.0.0.1:13080",
    "auth": "form login → session cookie"
  },
  "edge": {
    "server": "nginx 1.24 (Ubuntu)",
    "tls": "Let's Encrypt, 443",
    "proxyPrefixes": ["/dsh/", "/assets/", "/plugins/", "/api"],
    "cache": "hashed assets immutable; entry html no-cache"
  },
  "client": {
    "apk": "https://www.lukezystudio.cn/dsh-apk/mobile/dsh-mobile.apk",
    "size": 19344,
    "versionCode": 2,
    "manifest": "https://www.lukezystudio.cn/dsh-apk/mobile/version.json",
    "runtime": "WebView shell, no bundled assets"
  },
  "repos": [
    "github.com/MrLukezy/dsh-mobile",
    "github.com/MrLukezy/dsh-cloud-gateway",
    "github.com/MrLukezy/dsh-mobile-files",
    "github.com/MrLukezy/dsh-win-tunnel"
  ],
  "checks": [
    "systemctl --user status dsh",
    "curl -sI https://HOST/dsh/  # expect 302",
    "ss -lntp | grep -E '13080|3080'"
  ]
}