Operations and Safety Boundary
Operating posture
This is a constrained developer-preview deployment, not a claim that DeepSeek Harness is secure or production-ready. If any boundary below is absent, stop the service rather than compensate by granting broader access.
What upstream warns about
DeepSeek Harness can:
- execute model-generated code and commands;
- load third-party plugins and MCP server commands as trusted host code;
- access the network, processes, credentials, and files visible to it;
- modify or delete data, disclose secrets, or damage its host after incorrect output, defects, misconfiguration, malicious input, or a hostile plugin.
Upstream says sandboxing, approvals, and permission controls reduce risk but do not guarantee isolation. Resources intentionally made available remain at risk.
What loca requires
| Boundary | Required state | Why it exists |
|---|---|---|
| Browser identity | Authelia one_factor on deek.loca.zone | Rejects unauthenticated users before they reach the app. |
| Browser process credential | Upstream launch-token exchange and session cookie | Authenticates the browser to /api; Authelia does not replace it. |
| Network | 127.0.0.1:52320 only | Keeps the backend unreachable except through local nginx. |
| Host authority | Exact --trusted-host deek.loca.zone | Admits the intended proxied browser authority without a wildcard. |
| Service identity | DynamicUser=yes in deek.service | Prevents the Harness from inheriting the loca operator identity. |
| Operator-home isolation | ProtectHome=true | Hides /home/loca and its credentials from the process. |
| Runtime | Root-owned immutable /opt/deek/app | Prevents the agent from rewriting the application it executes. |
| Persistent state | StateDirectory=deek, DSH_HOME=/var/lib/deek | Gives the transient service identity one narrowly owned state root. |
| Workspace | /var/lib/deek/workspace | Limits intended mutation to a dedicated disposable/work-controlled tree. |
| Telemetry | DSH_TELEMETRY_DISABLED=1 | Applies upstream’s authoritative hard opt-out. |
These controls do not confine permitted reads or outbound network access. The service must receive no host mount, environment variable, credential, socket, or device that it does not need.
Operator commands
Service lifecycle:
sudo systemctl start deek.service
sudo systemctl stop deek.service
sudo systemctl restart deek.service
sudo systemctl is-active deek.service
sudo systemctl is-enabled deek.serviceUse stop before changing the runtime copy or state ownership. Use restart after an approved update or plugin-bundle change. A restart rotates only the per-process launch token. The cookie-signing secret persists in $DSH_HOME/.credentials.yaml, so valid browser cookies survive a routine restart and do not require a fresh exchange.
Never run the effective ExecStart command manually as root or loca. Operator access is through systemd; the unit supplies the transient identity and filesystem protections.
Boundary checks
On the host, verify the listener address without exposing application data:
ss -ltn 'sport = :52320'The only accepted listener is 127.0.0.1:52320. A wildcard, IPv6 wildcard, LAN address, or public listener is a release blocker.
From an unauthenticated client, inspect only the HTTP status at the public edge:
curl -sS -o /dev/null -w '%{http_code}\n' https://deek.loca.zone/An unauthenticated request must receive the Authelia challenge or redirect, never the Harness page. After Authelia and the upstream token exchange, use the browser to verify the Web UI and a session against only /var/lib/deek/workspace.
Secret-safe diagnostics
The service journal can contain the process launch URL. Treat it as a secret-bearing source:
- inspect it only in an access-controlled terminal;
- redact the entire query string before copying any line;
- never paste raw startup output into tickets, chat, this vault, or command transcripts;
- never use broad environment-dump commands for diagnosis;
- treat a disclosed launch URL as a credential incident: restart to rotate the launch token; if token use is suspected, follow the approved credential-management procedure to rotate or delete the
client-connection/browser-sessionrecord, then restart to revoke every existing browser cookie.
Provider keys belong in the managed credentials file under /var/lib/deek, not the unit environment or runtime copy.