Take down a public DSH deployment: proxy, TLS and ports

Taking a public DeepSeek Harness deployment offline is not “stop the dsh process”. If the proxy is still configured, DNS still points, or the GitHub webhook still delivers, the entry remains. Stop the external traffic first, then stop the service, then clean credentials and residual files.

DeepSeek Harness: Inventory the entry points

Write down every door before closing them; otherwise one gets missed. The list:(source)

Tunnels and webhooks are missed most often. A stopped tunnel can reconnect if the vendor mapping remains; an undeleted webhook makes GitHub keep retrying.

DeepSeek Harness: Four verification commands

Do not rely on memory; verify each entry is gone. Four checks:(source)

1. Listening ports — lsof -i :3080 and lsof -i :3081. Expected: no DSH process.
2. External reachability — from a non-local network, curl -I https://app.example/. Expected: connection failure or unknown domain, not 502.
3. Proxy and tunnel — inspect site config, tunnel panel, and system services. Expected: no upstream or autostart pointing at DSH.
4. Webhook — check GitHub repository Settings → Webhooks. Expected: the subscription is gone.

Only after these pass should you delete certificates and credentials. Doing it earlier removes the evidence you need to debug an entry that is still open.

DeepSeek Harness: Teardown order

The order matters: cut external traffic, stop the service, then revoke credentials. Steps:(source)

1. Cut external traffic — remove DNS, stop the proxy site, or close the tunnel mapping. Expected: the domain fails instead of returning 502.
2. Stop DSH — stop dsh web normally and confirm port 3080 is free. Expected: lsof -i :3080 is empty.
3. Revoke credentials — clear or rotate the credential that signs session cookies and remove unused provider keys. Expected: old browser cookies cannot validate.
4. Clean TLS files — move the certificate and key out of the DSH read path or delete them. Expected: the next start cannot accidentally reuse them.

Be careful with step 3: the credential file may also hold model provider keys. If you still need the model, rotate only the Web-session part or follow the official credential structure instead of deleting the whole file.

DeepSeek Harness: Three deployment shapes, three teardowns

Proxy-terminated TLS, tunnel access, and native TLS need different actions. Compare:(source)

1. Proxy-terminated TLS — stop the proxy site, then DSH. Watch: remove the upstream pointing at 3080 along with the site.
2. Tunnel access — stop the tunnel client, delete the vendor mapping, then stop DSH. Watch: tunnels often autostart as a system service.
3. Native TLS in dsh web — stopping the process closes the listener, but certificate files remain. Watch: remove or move the files referenced by --tls-cert and --tls-key.

If both proxy and native TLS are used, close the outer layer first, then the inner one.

DeepSeek Harness: The GitHub review endpoint

GitHub review is a second listener on 3081 with only POST /github; it does not disappear just because the main UI is closed. Teardown:(source)

1. Delete the GitHub subscription — repository Settings → Webhooks. Expected: GitHub stops delivering.
2. Stop the overlay process — do not load the github-review patch. Expected: 3081 is no longer listening.
3. Remove the experimental packages — dsh plugin --profile web remove the webhook and GitHub adapter. Expected: they disappear from the profile dependencies.
4. Clear environment variables — remove DSH_GITHUB_WEBHOOK_SECRET, DSH_GITHUB_REVIEW_WORKSPACE, and related settings. Expected: a restart does not re-enable the old configuration.

The webhook secret only validates inbound GitHub data; it does not grant the rule or the agent outbound GitHub access. Removing the secret is not the same as revoking the agent’s GitHub permissions.

DeepSeek Harness: Residual checks

After teardown, check from outside and inside; “I stopped it” is not evidence. Checklist:(source)

1. External access — domain, IP, and old port from a non-local network. Expected: all unreachable.
2. Local listeners — lsof -i :3080 and lsof -i :3081. Expected: no DSH process.
3. Proxy and tunnel — site configs, vendor panel, system services. Expected: no DSH upstream or autostart.
4. Webhook — GitHub subscription gone. Expected: no recent deliveries.
5. Certificates and backups — private key not in temp or download folders. Expected: sensitive files cleaned or archived in a controlled location.

If step 1 still opens the page, do not continue deleting files; find the missing entry, often DNS cache, a cloud load balancer, or another tunnel.

Re-deploying later

Treat a later deployment as new, not as a copy of the old one. Three points:

1. New token and certificate — the old token is retired and the old certificate may be expired or exposed. Expected: regenerate and verify the chain.
2. Reconfigure trusted-host — a changed domain or port no longer matches the old list. Expected: use the current authority.
3. Reassess the webhook secret — the old secret may be in logs or backups. Expected: generate a new one and update the GitHub subscription.

Before switching production traffic, verify from a test machine that /api does not return 403.

DeepSeek Harness FAQ

If I only stop dsh, is external access gone? No. The entry still exists and returns 502 or a connection error. For a public deployment, that is not offline.

Can I reuse the same domain later? Yes. Use a new startup token and certificate, and reconfigure --trusted-host and --public-url; do not reuse old cookies or keys.

Does a local-only DSH need this teardown? No. A loopback-only instance with no proxy or webhook only needs the process stopped. This article is for deployments with external entry points.

The short version: public teardown is complete when external traffic cannot reach the host, old credentials no longer validate, and dedicated endpoints no longer deliver—not when the process disappears.