Execute deployment only after user inputs CONFIRM (uppercase)
Overview
This skill provides one-click deployment of DeepSeek Harness (dsh) — the open-source AI agent harness from DeepSeek AI — on Huawei Cloud Flexus X instances:
Module
Description
Command
List Regions
Show available regions
python3 scripts/deploy_dsh.py --list-regions
Test Connection
Verify AK/SK credentials
python3 scripts/deploy_dsh.py --test
Deploy
Purchase Flexus X instance and deploy dsh
python3 scripts/deploy_dsh.py
Components
Component
Description
Port
Notes
Node.js
JavaScript runtime
-
Node.js 22 LTS, installed to /opt/nodejs/current
@deepseek-ai/dsh
DeepSeek Harness CLI
3080 (loopback)
Official npm package, dsh web binds to 127.0.0.1 only
Nginx
Reverse proxy
80 (loopback)
Local server proxy 80 → 127.0.0.1:3080 (public access does not use this port, see SSH tunnel below)
systemd
Service manager
-
dsh.service manages dsh lifecycle, auto-restart on failure
UFW
Firewall
-
Allows 22 (SSH)/80/443 (80/443 blocked by security group, not reachable from public)
✅ Important: dsh web command intentionally binds to 127.0.0.1 only — the CLI rejects --host 0.0.0.0. Remote access goes through an SSH local port-forwarding tunnel: run ssh -L 3080:127.0.0.1:3080 root@{public_ip} on your machine, then open http://127.0.0.1:3080. Only port 22 needs to be open in the security group — dsh is never exposed to the public, which is more secure.
Use Cases
AI Agent Development - Run and manage DeepSeek AI agent harness with a web UI
Automation & Workflows - Build multi-step agent workflows with the "everything is a plugin" architecture
Development & Testing - Quickly set up an AI agent development environment
Team Collaboration - Share agent workspaces across a team
Multi-Region Deployment - Provide nearby access for global users
Important Notes
⚠️ All scripts and environment check scripts are in the skill package. Must use skill action=exec for execution, do NOT run directly in shell.
Prerequisites
Before using this skill, ensure the following conditions are met:
1. Huawei Cloud Account
Valid Huawei Cloud account
Account has completed real-name authentication
Account has sufficient balance or bound payment method
2. AK/SK Credentials
Created Huawei Cloud access key (AK/SK)
AK/SK has the following permissions:
ECS: Elastic Cloud Server management
VPC: Virtual Private Cloud management
EIP: Elastic Public IP management
COC: Cloud Operations Center management
How to obtain: Huawei Cloud Console → My Credentials → Access Keys → Create Access Key
Credential Configuration Methods:
Method
Description
Priority
Environment Variables
HW_ACCESS_KEY, HW_SECRET_KEY, HW_SECURITY_TOKEN
Highest (Recommended)
Command Line Arguments
--ak, --sk, --security-token
Lower (Accepted but not recommended)
Credential Types (By Recommendation Order):
Priority
Type
Parameters
Description
First Choice
Temporary AK/SK
Environment Variables + HW_SECURITY_TOKEN
Temporary credentials with security token, higher security
Second Choice
Permanent AK/SK
Environment Variables Only
Long-term access keys from Huawei Cloud Console
Note: Credentials are prioritized from environment variables; users are never asked to directly input AK/SK. However, if the user voluntarily provides credentials through other methods (e.g., conversation input, configuration files), credential parsing is still supported.
Manually add an inbound rule: protocol TCP, port 22, source IP = your public IP + /32 suffix (e.g., 203.0.113.10/32)
Do not add broad 80/443 rules — dsh is accessed only through the SSH tunnel; no other ports need to be exposed
💡 Why Use Empty Security Group? Security First - You have full control over which IPs can access the server. Only port 22 + SSH tunnel — dsh Web UI is never exposed publicly, so even an API key leak cannot be accessed from the internet.
⚠️ AK/SK Security: See Prerequisites - AK/SK Credentials. Prohibited from exposing, recording, or printing AK/SK/Token values in any form.
⚠️ dsh Security (Critical)
Rule
Description
1
dsh binds to 127.0.0.1 only — never force it to listen on 0.0.0.0 (CLI rejects it by design)
2
Remote access via SSH local port forwarding: run ssh -L 3080:127.0.0.1:3080 root@{public_ip} locally, then open http://127.0.0.1:3080
3
DEEPSEEK_API_KEY is injected via systemd drop-in with file mode 600 — never in the unit file, never in logs
4
API key is optional at deploy time; users can also set it later in the Web UI (Settings → Models)
5
dsh runs under a dedicated system user dsh (no-shell), not root
6
Production use must enable HTTPS (e.g. Let's Encrypt, via Nginx local proxy)
🔐 SSL/TLS Verification
🔒 SSL/TLS certificate verification is enabled by default for all Huawei Cloud API requests (verify=true).
The HW_VERIFY_SSL environment variable can override this — HW_VERIFY_SSL=false disables verification.
⚠️ HW_VERIFY_SSL=false is for testing only. Never disable SSL verification in production; it exposes AK/SK credentials and API traffic to man-in-the-middle attacks.
Core Commands and Usage
💡 Note: When no operation options are provided, deployment operation is executed by default.
Command Options
Command/Option
Function
Description
python3 scripts/deploy_dsh.py
Deploy
Purchase Flexus X instance and deploy dsh
python3 scripts/deploy_dsh.py --list-regions
Show Available Regions
Show all available regions (19 regions)
python3 scripts/deploy_dsh.py --test
Test Connection
Verify AK/SK credentials
python3 scripts/deploy_dsh.py --list-servers
List Servers
Show all servers in specified region
python3 scripts/deploy_dsh.py --delete <ID>
Delete Server
Delete server by ID or name
python3 scripts/deploy_dsh.py --status <ID>
Check Status
Check deployment status by server ID
Global Parameters
💡 Required Parameters: --ak, --sk (or set HW_ACCESS_KEY, HW_SECRET_KEY environment variables)
💡 Recommended Parameters: --security-token (or set HW_SECURITY_TOKEN for temporary credentials)
Execution Examples
Example 1: List available regions
bash
python3 scripts/deploy_dsh.py --list-regions
Example 2: Test AK/SK connection
bash
python3 scripts/deploy_dsh.py --test
Example 3: Deploy with default settings (requires user confirmation)
DEEPSEEK_API_KEY to pre-seed into the dsh service (optional)
Not set
💡 The dsh port is bound to 127.0.0.1 only — access it locally via SSH tunnel (ssh -L 3080:127.0.0.1:3080 root@{ip}). No security group rule is needed for the dsh port itself.
Advanced Parameters
💡 The following parameters are for advanced users, not needed for general scenarios
Parameter
Description
Default
--project-id
Huawei Cloud project ID (optional)
Auto-fetched
--image
Image ID
Default Ubuntu 22.04
--zone
Specify availability zone
Auto-select
--random-zone
Randomly select availability zone
Off
--no-eip
Do not create elastic public IP
Off
--auto-confirm
Skip interactive confirmation (use with caution!)
Off
Credential Configuration Examples
Method 1: Using Environment Variables (First Choice - Strongly Recommended)
bash
python3 scripts/deploy_dsh.py
Method 2: Using Command Line Arguments (Second Choice - Accepted)
UFW allow 22/80/443 (80/443 blocked by security group, not reachable from public)
7
Start & Verify
Start dsh, wait for loopback HTTP 200, print deployment info
Available Regions
Common Regions (more regions run --list-regions):
Region ID
Region Name
Supported Flexus X Instance Types
cn-north-4
North China-Beijing 4
x1, x1e, x1i, x2e
cn-east-3
East China-Shanghai 1
x1, x1e, x1i, x2e
cn-south-1
South China-Guangzhou
x1, x1e, x1i, x2e
ap-southeast-1
China-Hong Kong
x1, x2e
ap-southeast-3
Asia Pacific-Singapore
x1, x1e, x2e
💡 Complete region list (19) run: python3 scripts/deploy_dsh.py --list-regions
Output Format Specification
⛔ CRITICAL — The SSH tunnel command MUST be output verbatim, never omitted, summarized, or paraphrased:
After deployment, the reply MUST include a copy-paste-ready SSH tunnel command line, with {public_ip}replaced by the actual public IP from the script output.
For example, if the script outputs Public IP: 121.36.x.x, the reply must contain:
text
ssh -L 3080:127.0.0.1:3080 root@121.36.x.x
NEVER write only "please establish an SSH tunnel" without the full command — users need to copy-paste it; missing the command makes the Web UI inaccessible.
After successful deployment, must return results in the following format:
text
🎉 Deployment Successful!
| Item | Value |
|------|-----|
| Server Name | {server_name} |
| Public IP | {public_ip} |
| SSH Password | {password} |
| Region | {region_id} ({region_name}) |
🌐 Access URL (SSH tunnel required first):
- Run on your local machine (Windows PowerShell / macOS Terminal), replacing {public_ip} with the Public IP from the table above:
ssh -L 3080:127.0.0.1:3080 root@{public_ip}
text
- Enter the SSH password (from the table above), keep the terminal window open
- Then open in your browser: http://127.0.0.1:3080
🔑 SSH Login: `ssh root@{public_ip}` (password: {password})
📦 Installed Components:
- Node.js 22 LTS ({node_version})
- @deepseek-ai/dsh ({dsh_version}, systemd service 'dsh')
- Nginx reverse proxy (80 → 127.0.0.1:{dsh_port}, loopback only)
📋 Post-deployment TODO:
1. Configure security group: Console → ECS → Security Groups → sg-dsh → Add inbound rule (TCP 22, source your_ip/32)
2. Establish SSH tunnel locally (see command above), then open Web UI: http://127.0.0.1:3080
3. In the Web UI: Settings → Models, enter your DeepSeek API key and save
4. Choose a workspace directory, then start a session
📖 [DeepSeek Harness GitHub](https://github.com/deepseek-ai/deepseek-harness) | [Flexus X Docs](https://support.huaweicloud.com/productdesc-flexusx/pd_01_0002.html)
Variables:{server_name} server name | {public_ip} public IP | {password} SSH password | {region_id}/{region_name} region | {dsh_port} dsh loopback port | {node_version} Node.js version | {dsh_version} dsh CLI version
🔐 Local Access Guide (SSH Port Forwarding)
⚠️ You MUST follow this section after deployment, otherwise the browser cannot open the dsh Web UI. dsh only listens on the server's loopback address 127.0.0.1:3080 — you need to establish an SSH tunnel on your local machine to forward local port 3080 to the server's 3080 port.
How it works: ssh -L 3080:127.0.0.1:3080 root@{public_ip} means — forward all traffic on your local 3080 port through the encrypted SSH channel to 127.0.0.1:3080 on the cloud server (where dsh runs). Data is fully encrypted, dsh Web UI is never exposed publicly, and only someone who can SSH can access it.
Windows Users (PowerShell)
Open PowerShell: Press Win key → type powershell → Enter (or press Win+X → select "Windows PowerShell" / "Windows Terminal")
Run the tunnel command (replace {public_ip} with the public IP from the deployment output):
powershell
ssh -L 3080:127.0.0.1:3080 root@{public_ip}
First-time fingerprint confirmation: if prompted Are you sure you want to continue connecting (yes/no)?, type yes and press Enter
Enter the password: type the SSH password from the deployment output (characters are not displayed while typing — this is normal), press Enter
Keep the window open: once you see the remote shell prompt (e.g., root@xxx:~#), the tunnel is established. Do not close this window
Open your browser: visit http://127.0.0.1:3080 to open the dsh Web UI
💡 Windows 10/11 ships with the OpenSSH client — no extra installation needed. If you get "'ssh' is not recognized", go to Settings → Apps → Optional Features → add "OpenSSH Client".
macOS Users (Terminal)
Open Terminal: press Command + Space → type Terminal → Enter (or Finder → Applications → Utilities → Terminal)
Run the tunnel command (replace {public_ip} with the public IP from the deployment output):
bash
ssh -L 3080:127.0.0.1:3080 root@{public_ip}
First-time fingerprint confirmation: if prompted Are you sure you want to continue connecting (yes/no)?, type yes and press Enter
Enter the password: type the SSH password from the deployment output (characters are not displayed while typing — this is normal), press Enter
Keep the window open: once you see the remote shell prompt, the tunnel is established. Do not close this window
Open your browser: visit http://127.0.0.1:3080 to open the dsh Web UI
💡 macOS ships with the OpenSSH client — no extra installation needed.
Closing the Tunnel & Advanced Usage
Scenario
Action
Close the tunnel
Press Ctrl+C in the PowerShell/Terminal window, or type exit and press Enter
Forward only, no shell
ssh -N -L 3080:127.0.0.1:3080 root@{public_ip} (-N runs no remote command; no shell prompt — recommended)
macOS background
ssh -f -N -L 3080:127.0.0.1:3080 root@{public_ip} (-f runs in background; stop with pkill -f "ssh -f -N" or killall ssh)
Local port 3080 in use
Use another local port: ssh -L 18080:127.0.0.1:3080 root@{public_ip}, then open http://127.0.0.1:18080
Passwordless login (recommended)
Run ssh-copy-id root@{public_ip} (macOS/Linux) or use an SSH key in PowerShell for passwordless connections later
⚠️ Note: after the tunnel is closed, http://127.0.0.1:3080 becomes unreachable — this is normal; just re-run the tunnel command. After every machine reboot you must re-establish the tunnel.
dsh Initial Setup
After establishing the SSH tunnel, open the dsh Web UI (http://127.0.0.1:3080):
Setting
Description
API Key
Go to Settings → Models, enter your DeepSeek API key and save (if not pre-seeded via --api-key)
Workspace
Choose a workspace directory to store sessions and artifacts
Start Session
Start a session in the web UI and the harness will respond
⚠️ Important: dsh can read/write files and run commands — only port 22 should be open in the security group (source your_ip/32); dsh is accessed via SSH tunnel; never open 80/3080 to the public, never use 0.0.0.0/0.
Deployment Architecture
This skill uses COC (Cloud Operations Center) for secure deployment, replacing traditional SSH method:
