dsh-tailscale-sync DSH plugin

This plugin automatically locks the harness web service to 127.0.0.1:3080 and detects your *.ts.net domain from Tailscale, then restricts the /api trust fence to only allow that domain. It enables seamless remote access without exposing the service to the local network.

remote-execution

How to install the dsh-tailscale-sync DSH plugin

dsh plugin --profile web add github:MoonGlassKitty/dsh-tailscale-sync

Copying does not run this command. Review the repository and version before installing the dsh-tailscale-sync DSH plugin.

dsh-tailscale-sync DSH plugin data source

dsh-tailscale-sync DSH plugin snapshot date: Aug 16, 2026

discovered

What the dsh-tailscale-sync DSH plugin can do

Locks harness web service to 127.0.0.1:3080 (loopback only).
Automatically detects the machine's *.ts.net domain using `tailscale status`.
Configures the /api trust fence to trust only the detected domain.
Traffic travels through Tailscale's encrypted tunnel with device authentication.
Phone and computer share the same service and session – no data sync needed.

Where the dsh-tailscale-sync DSH plugin fits

Continue working on a DeepSeek Harness session from your phone while away from your computer.
Access your harness securely without a public IP or port forwarding.
Keep your existing configuration intact – no manual edits required.
Use the same Tailscale identity across multiple devices for unified access.

Who the dsh-tailscale-sync DSH plugin is for

Users who have Tailscale installed and want to access DeepSeek Harness remotely.
Users who need a quick, secure way to use their computer's harness from a mobile device.

dsh-tailscale-sync DSH plugin limitations

API key management can only be done on the local machine at http://127.0.0.1:3080 (due to harness source code security).
Requires Tailscale with MagicDNS enabled (default on new tailnets).
If MagicDNS is not enabled, the plugin auto-falls back to local-only access; manual `trustedHosts` configuration is needed.
The `tailscale serve` command must be run once on the computer to enable the HTTPS tunnel.

dsh-tailscale-sync DSH plugin: from the repository README

Quoted from the MoonGlassKitty/dsh-tailscale-sync README, the upstream source of the dsh-tailscale-sync DSH plugin. Copyright remains with the original authors.

在手机上继续电脑端 DeepSeek Harness 的工作 —— **装好 Tailscale、装好本插件，即可用**，无需改任何配置。本插件会自动： 1. 把 harness 的 web 服务锁死在 `127.0.0.1:3080`（不暴露局域网）； 2. 自动探测本机的 `*.ts.net` 域名（`tailscale status`），并让 `/api` 信任围栏只放行这个域名。 ## 安装 ### 1. 装 Tailscale（一次性）电脑和手机都安装 [Tailscale](https://tailscale.com/download) 并登录同一个账号（确认 tailnet 已开 MagicDNS，新版默认开启）。 ### 2. 装本插件 ```sh dsh plugin --profile web add github:MoonGlassKitty/dsh-tailscale-sync ``` ### 3. 开 HTTPS 隧道（一次性，一条命令）在电脑上运行： ```sh tailscale serve --bg 3080 ``` > 若提示 "Serve is not enabled on your tailnet"，按提示点链接授权一次即可。 ### 4. 手机访问手机保持 Tailscale 连接，浏览器打开： ``` https://<你的机器名>.ts.net ``` （在电脑上运行 `tailscale status` 能看到你的 `*.ts.net` 完整域名。） ## 工作方式 ``` 手机浏览器 ──Tailscale HTTPS──▶ tailscale serve ──▶ 127.0.0.1:3080 (harness) ``` - 手机和电脑看到的是**同一个服务、同一份会话**，不是"两处数据互相同步"； - 端口只监听回环，普通局域网访问不到； - 流量走 Tailscale 的加密隧道 + 设备鉴权。 ## 注意事项 - **设置 / API key 管理仍只能在本机** `http://127.0.0.1:3080` 操作（harness 源码安全限制，Tailscale 也绕不过）。 - 停用隧道：`tailscale serve --https=443 off`。 - 若你的 tailnet 没开 MagicDNS（没有 `*.ts.net` 域名），本插件会自动退化为"仅本机可访问"，此时需手动在 `cordis.patch.yml` 里填 `trustedHosts`。 ## 跨平台 Windows / macOS / Linux 均可用。`tailscale serve`、`dsh`、本插件在三个平台上的命令一致。

Read the full READMERepository license: MIT

dsh-tailscale-sync DSH plugin questions

How do I install dsh-tailscale-sync?

Run `dsh plugin --profile web add github:MoonGlassKitty/dsh-tailscale-sync` on your computer. Make sure you have Tailscale installed on both devices and logged into the same account.

Do I need to configure anything after installation?

No, the plugin automatically locks the port and detects your Tailscale domain. The only manual step is to run `tailscale serve --bg 3080` once on the computer to enable the HTTPS tunnel.

What if my tailnet doesn't have MagicDNS enabled?

If MagicDNS is off, you won't have a *.ts.net domain. The plugin will fall back to local-only access. You can manually set `trustedHosts` in `cordis.patch.yml` to allow access from other devices.

Can I manage API keys remotely from my phone?

No, API key management is restricted to the local machine at `http://127.0.0.1:3080`. This is a security limitation of DeepSeek Harness that cannot be bypassed by Tailscale or this plugin.

How do I stop the Tailscale tunnel?

Run `tailscale serve --https=443 off` on the computer to disable the HTTPS tunnel. The plugin will still be installed but the remote access will stop.