From bf63cff8bdc69e169c86f6f97d98bb2735022bce Mon Sep 17 00:00:00 2001 From: okxlin <61420215+okxlin@users.noreply.github.com> Date: Sat, 29 Aug 2026 14:32:07 +0800 Subject: [PATCH] feat(deepseek-harness): update appstore workstation to alpha.1 --- .../0.1.2-alpha.1/.env.sample | 10 + .../0.1.2-alpha.1/data.yml | 181 ++++++++++++++++++ .../0.1.2-alpha.1/docker-compose.yml | 44 +++++ .../0.1.2-alpha.1/scripts/init.sh | 3 + .../0.1.2-alpha.1/scripts/uninstall.sh | 15 ++ .../0.1.2-alpha.1/scripts/upgrade.sh | 6 + apps/deepseek-harness-workstation/README.md | 10 +- .../latest/docker-compose.yml | 2 +- 8 files changed, 265 insertions(+), 6 deletions(-) create mode 100644 apps/deepseek-harness-workstation/0.1.2-alpha.1/.env.sample create mode 100644 apps/deepseek-harness-workstation/0.1.2-alpha.1/data.yml create mode 100644 apps/deepseek-harness-workstation/0.1.2-alpha.1/docker-compose.yml create mode 100755 apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/init.sh create mode 100755 apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/uninstall.sh create mode 100755 apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/upgrade.sh diff --git a/apps/deepseek-harness-workstation/0.1.2-alpha.1/.env.sample b/apps/deepseek-harness-workstation/0.1.2-alpha.1/.env.sample new file mode 100644 index 000000000..5a841ad09 --- /dev/null +++ b/apps/deepseek-harness-workstation/0.1.2-alpha.1/.env.sample @@ -0,0 +1,10 @@ +CONTAINER_NAME=deepseek-harness-workstation-compose-check +PANEL_APP_PORT_HTTP=56789 +TZ=Asia/Shanghai +DSH_PUBLIC_URL=https://dsh.example.com +DSH_AUTH_USERNAME=admin +DSH_AUTH_PASSWORD=replace-with-a-unique-password-at-least-12-characters +DSH_AUTH_TOKEN_LIFETIME=604800 +CADDY_TRUSTED_PROXIES=private_ranges +DSH_TRUSTED_HOSTS= +DOCKER_SOCK_PATH=/dev/null diff --git a/apps/deepseek-harness-workstation/0.1.2-alpha.1/data.yml b/apps/deepseek-harness-workstation/0.1.2-alpha.1/data.yml new file mode 100644 index 000000000..493a4cfdb --- /dev/null +++ b/apps/deepseek-harness-workstation/0.1.2-alpha.1/data.yml @@ -0,0 +1,181 @@ +additionalProperties: + formFields: + - envKey: PANEL_APP_PORT_HTTP + type: number + required: true + default: 56789 + rule: paramPort + edit: true + labelZh: Web 访问端口 + labelEn: Web Port + label: + en: Web Port + zh: Web 访问端口 + zh-Hant: Web 訪問端口 + ja: Web ポート + ko: 웹 포트 + ru: Веб-порт + ms: Port Web + pt-br: Porta Web + - envKey: TZ + type: text + required: true + default: Asia/Shanghai + edit: true + labelZh: 时区 + labelEn: Timezone + label: + en: Timezone + zh: 时区 + zh-Hant: 時區 + ja: タイムゾーン + ko: 시간대 + ru: Часовой пояс + ms: Zon waktu + pt-br: Fuso horário + - envKey: DSH_PUBLIC_URL + type: text + required: true + default: "" + edit: true + labelZh: 外部 HTTPS 地址 + labelEn: External HTTPS URL + label: + en: External HTTPS URL + zh: 外部 HTTPS 地址 + zh-Hant: 外部 HTTPS 位址 + ja: 外部 HTTPS URL + ko: 외부 HTTPS URL + ru: Внешний HTTPS-адрес + ms: URL HTTPS Luaran + pt-br: URL HTTPS externa + description: + en: Enter the complete browser origin, for example https://dsh.example.com. Paths are not supported. + zh: 输入浏览器使用的完整 Origin，例如 https://dsh.example.com；不支持子路径。 + - envKey: DSH_AUTH_USERNAME + type: text + required: true + default: admin + edit: true + labelZh: 登录用户名 + labelEn: Login Username + label: + en: Login Username + zh: 登录用户名 + zh-Hant: 登入使用者名稱 + ja: ログインユーザー名 + ko: 로그인 사용자 이름 + ru: Имя пользователя + ms: Nama Pengguna Log Masuk + pt-br: Nome de usuário de login + - envKey: DSH_AUTH_PASSWORD + type: password + required: true + default: "" + edit: true + labelZh: 登录密码 + labelEn: Login Password + label: + en: Login Password + zh: 登录密码 + zh-Hant: 登入密碼 + ja: ログインパスワード + ko: 로그인 비밀번호 + ru: Пароль для входа + ms: Kata Laluan Log Masuk + pt-br: Senha de login + description: + en: Use at least 12 characters. The image stores a bcrypt hash in its authentication database, while the submitted plaintext value remains visible to host, 1Panel, and Docker administrators. + zh: 至少使用 12 个字符；镜像会在鉴权数据库中保存 bcrypt 哈希，但宿主、1Panel 与 Docker 管理员仍可读取提交的明文值。 + - envKey: DSH_AUTH_TOKEN_LIFETIME + type: select + required: true + default: "604800" + edit: true + labelZh: 登录会话有效期 + labelEn: Login Session Lifetime + label: + en: Login Session Lifetime + zh: 登录会话有效期 + zh-Hant: 登入工作階段有效期 + ja: ログインセッション有効期間 + ko: 로그인 세션 유효 기간 + ru: Срок действия сеанса + ms: Tempoh Sesi Log Masuk + pt-br: Duração da sessão de login + description: + en: The token is not renewed automatically. When it expires, the browser must sign in again. + zh: 登录令牌不会自动续期；到期后浏览器需要重新登录。 + values: + - label: 1 hour + value: "3600" + - label: 8 hours + value: "28800" + - label: 24 hours + value: "86400" + - label: 7 days + value: "604800" + - label: 30 days + value: "2592000" + - envKey: CADDY_TRUSTED_PROXIES + type: text + required: true + default: private_ranges + edit: true + labelZh: 可信代理范围 + labelEn: Trusted Proxy Ranges + label: + en: Trusted Proxy Ranges + zh: 可信代理范围 + zh-Hant: 受信任代理範圍 + ja: 信頼済みプロキシ範囲 + ko: 신뢰할 수 있는 프록시 범위 + ru: Диапазоны доверенных прокси + ms: Julat Proksi Dipercayai + pt-br: Faixas de proxies confiáveis + description: + en: Use space-separated CIDRs or private_ranges. Keep private_ranges behind 1Panel/OpenResty; use none only when clients connect directly to Caddy. + zh: 使用空格分隔的 CIDR 或 private_ranges。通过 1Panel/OpenResty 反向代理时保留 private_ranges；仅在客户端直连 Caddy 时使用 none。 + - envKey: DSH_TRUSTED_HOSTS + type: text + required: false + default: "" + edit: true + labelZh: 附加可信主机 + labelEn: Additional Trusted Hosts + label: + en: Additional Trusted Hosts + zh: 附加可信主机 + zh-Hant: 附加受信任主機 + ja: 追加の信頼済みホスト + ko: 추가 신뢰 호스트 + ru: Дополнительные доверенные хосты + ms: Hos Dipercayai Tambahan + pt-br: Hosts confiáveis adicionais + description: + en: Optional comma-separated host authorities without a scheme. The authority from the external URL is trusted automatically. + zh: 可选的逗号分隔主机 authority，不要包含协议；外部地址中的 authority 会自动加入可信列表。 + - envKey: DOCKER_SOCK_PATH + type: select + required: true + default: /dev/null + edit: true + labelZh: Docker 套接字访问 + labelEn: Docker Socket Access + label: + en: Docker Socket Access + zh: Docker 套接字访问 + zh-Hant: Docker 通訊端存取 + ja: Docker ソケットアクセス + ko: Docker 소켓 접근 + ru: Доступ к сокету Docker + ms: Akses Soket Docker + pt-br: Acesso ao socket do Docker + description: + en: Disabled is the safe default. Enabling grants the workstation effective control of the host Docker daemon. + zh: 默认禁用最安全；启用后工作站可有效控制宿主 Docker 守护进程。 + values: + - label: Disabled + value: /dev/null + - label: Enabled (/var/run/docker.sock) + value: /var/run/docker.sock diff --git a/apps/deepseek-harness-workstation/0.1.2-alpha.1/docker-compose.yml b/apps/deepseek-harness-workstation/0.1.2-alpha.1/docker-compose.yml new file mode 100644 index 000000000..82d8b2e4b --- /dev/null +++ b/apps/deepseek-harness-workstation/0.1.2-alpha.1/docker-compose.yml @@ -0,0 +1,44 @@ +services: + deepseek-harness-workstation: + image: "ghcr.io/okxlin/deepseek-harness:0.1.2-alpha.1-workstation" + container_name: ${CONTAINER_NAME} + restart: unless-stopped + labels: + createdBy: "Apps" + security_opt: + - no-new-privileges:true + environment: + - TZ=${TZ:-Asia/Shanghai} + - PUBLIC_URL=${DSH_PUBLIC_URL} + - AUTH_MODE=caddy-security + - AUTH_USERNAME=${DSH_AUTH_USERNAME:-admin} + - AUTH_PASSWORD=${DSH_AUTH_PASSWORD} + - AUTH_TOKEN_LIFETIME=${DSH_AUTH_TOKEN_LIFETIME:-604800} + - CADDY_TRUSTED_PROXIES=${CADDY_TRUSTED_PROXIES:-private_ranges} + - AUTH_COOKIE_INSECURE=false + - DSH_TRUSTED_HOSTS=${DSH_TRUSTED_HOSTS:-} + - PORT=8080 + - DSH_TELEMETRY_DISABLED=1 + ports: + - "${PANEL_APP_PORT_HTTP}:8080" + volumes: + - ./data/data:/data + - dsh-home:/home/node + - ./data/workspace:/workspace + - "${DOCKER_SOCK_PATH:-/dev/null}:/var/run/docker.sock" + healthcheck: + test: ["CMD", "/usr/local/bin/healthcheck.sh"] + interval: 30s + timeout: 5s + retries: 3 + start_period: 15s + networks: + - 1panel-network + +networks: + 1panel-network: + external: true + +volumes: + dsh-home: + name: dsh-home diff --git a/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/init.sh b/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/init.sh new file mode 100755 index 000000000..9879df4c3 --- /dev/null +++ b/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/init.sh @@ -0,0 +1,3 @@ +#!/usr/bin/env bash +set -euo pipefail +exit 0 diff --git a/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/uninstall.sh b/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/uninstall.sh new file mode 100755 index 000000000..b5e0b15a4 --- /dev/null +++ b/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/uninstall.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)" +cd "$ROOT_DIR" +if docker compose version >/dev/null 2>&1; then + docker compose down --remove-orphans +elif docker-compose version >/dev/null 2>&1; then + docker-compose down --remove-orphans +else + echo "Docker Compose is not available" >&2 + exit 1 +fi + +echo "Compose resources were removed. Persistent ./data/data, ./data/workspace, and dsh-home are preserved." diff --git a/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/upgrade.sh b/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/upgrade.sh new file mode 100755 index 000000000..aaaa2d089 --- /dev/null +++ b/apps/deepseek-harness-workstation/0.1.2-alpha.1/scripts/upgrade.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash +set -euo pipefail + +echo "DeepSeek Harness Workstation keeps application state under ./data/data:/data." +echo "If legacy state exists in dsh-home:/home/node/.local/share/deepseek-harness, the image migrates it to /data on first startup when /data/auth is empty." +exit 0 diff --git a/apps/deepseek-harness-workstation/README.md b/apps/deepseek-harness-workstation/README.md index c501a7615..dc5d14253 100644 --- a/apps/deepseek-harness-workstation/README.md +++ b/apps/deepseek-harness-workstation/README.md @@ -82,7 +82,7 @@ http://127.0.0.1:56789 从旧版工作站布局升级时，如果 `/data/auth` 为空，镜像入口会在首次启动时把 `dsh-home:/home/node/.local/share/deepseek-harness` 中的旧鉴权、Caddy 和 DSH 状态复制到 `/data`。迁移不会删除旧 HOME 数据；请先备份 `./data/data` 和 `dsh-home`，确认新版本启动正常后再自行清理旧副本。 -从旧版 AppStore 包升级时，已有 `.env` 通常不包含 `CADDY_TRUSTED_PROXIES`。新 Compose 会自动使用 `private_ranges`，因此标准 1Panel/OpenResty 部署无需手工补写该变量，也不会改变 `/data`、`/home/node` 或 `/workspace` 的挂载和数据。升级后可在应用参数中按实际代理链调整该值。 +从旧版 AppStore 包升级时，已有 `.env` 通常不包含 `CADDY_TRUSTED_PROXIES`。新 Compose 会自动使用 `private_ranges`，因此标准 1Panel/OpenResty 部署无需手工补写该变量，也不会改变 `/data`、`/home/node` 或 `/workspace` 的挂载和数据。升级后可在应用参数中按实际代理链调整该值。`0.1.2-alpha.1` 使用新的 `ghcr.io/okxlin/deepseek-harness` 工作站镜像，现有安装可以直接执行 1Panel 应用升级；升级前仍建议备份应用目录和 `dsh-home`，不要删除旧卷。 1Panel 的应用备份覆盖应用安装目录，因此会包含 `./data/data` 和 `./data/workspace`。独立的 HOME named volume 不在应用目录内，升级、卸载或迁移前如需保留用户安装的工具和缓存，请停止应用并单独备份 `dsh-home`： @@ -90,7 +90,7 @@ http://127.0.0.1:56789 docker run --rm --entrypoint tar \ -v dsh-home:/source:ro \ -v "$PWD":/backup \ - moelin/deepseek-harness:workstation \ + ghcr.io/okxlin/deepseek-harness:workstation \ -C /source -czf /backup/dsh-home.tar.gz . ``` @@ -100,7 +100,7 @@ docker run --rm --entrypoint tar \ docker run --rm --entrypoint tar \ -v dsh-home:/target \ -v "$PWD":/backup:ro \ - moelin/deepseek-harness:workstation \ + ghcr.io/okxlin/deepseek-harness:workstation \ -C /target -xzf /backup/dsh-home.tar.gz ``` @@ -130,7 +130,7 @@ The image limits username-stage POSTs to 30 per minute and password-stage POSTs ## 镜像与源码 -- 应用版本：滚动版本 `latest` 与对应的固定版本目录 -- 镜像：`latest` 使用 `moelin/deepseek-harness:workstation`，固定版本使用匹配的 `<版本>-workstation` tag +- 应用版本：滚动版本 `latest` 与固定版本 `0.1.2-alpha.1` +- 镜像：`latest` 使用 `ghcr.io/okxlin/deepseek-harness:workstation`，固定版本使用匹配的 `<版本>-workstation` tag - DeepSeek Harness： - 镜像构建源码： diff --git a/apps/deepseek-harness-workstation/latest/docker-compose.yml b/apps/deepseek-harness-workstation/latest/docker-compose.yml index 0c7b91cd2..a759072d8 100644 --- a/apps/deepseek-harness-workstation/latest/docker-compose.yml +++ b/apps/deepseek-harness-workstation/latest/docker-compose.yml @@ -1,6 +1,6 @@ services: deepseek-harness-workstation: - image: "moelin/deepseek-harness:workstation" + image: "ghcr.io/okxlin/deepseek-harness:workstation" container_name: ${CONTAINER_NAME} restart: unless-stopped labels: