Imported from huaweicloud/huaweicloud-skills (skills/computing/flexus-x/huawei-cloud-ecs-dsh-deploy/SKILL.md). Install upstream with npx skills add huaweicloud/huaweicloud-skills --skill huawei-cloud-ecs-dsh-deploy. Copyright stays with the author.

Huawei Cloud Flexus X + DeepSeek Harness (dsh) One-Click Deployment

⚠️ Pre-Deployment Checklist (Highest Priority)

This skill involves actual charges (creating Huawei Cloud Flexus X instance), must confirm with user before execution!

Required Confirmations:

• Region (default: cn-north-4)
• Flavor (default: x1.2u.4g, 2 cores 4GB)
• Billing Mode (default: pay-as-you-go)

Prohibited Actions:

• ❌ Do NOT execute deployment before user explicitly confirms
• ❌ Do NOT use default config for deployment without asking user
• ❌ Do NOT assume user accepts default values
• ❌ Do NOT fabricate or estimate prices (e.g., "≈ ¥0.2-0.3/hour"); always refer users to the official pricing page

Correct Process:

1. Show user the default config (region, flavor, billing mode)
2. Inform users that for pricing, use the official price calculator: https://www.huaweicloud.com/pricing/calculator.html#/hecs
3. Ask if user confirms or needs modifications
4. Execute deployment only after user inputs CONFIRM (uppercase)

Overview

This skill provides one-click deployment of DeepSeek Harness (dsh) — the open-source AI agent harness from DeepSeek AI — on Huawei Cloud Flexus X instances:

Components

Deployed Applications

✅ Important: dsh web command intentionally binds to 127.0.0.1 only — the CLI rejects --host 0.0.0.0. Remote access goes through an SSH local port-forwarding tunnel: run ssh -L 3080:127.0.0.1:3080 root@{public_ip} on your machine, then open http://127.0.0.1:3080. Only port 22 needs to be open in the security group — dsh is never exposed to the public, which is more secure.

Use Cases

1. AI Agent Development - Run and manage DeepSeek AI agent harness with a web UI
2. Automation & Workflows - Build multi-step agent workflows with the "everything is a plugin" architecture
3. Development & Testing - Quickly set up an AI agent development environment
4. Team Collaboration - Share agent workspaces across a team
5. Multi-Region Deployment - Provide nearby access for global users

Important Notes

⚠️ All scripts and environment check scripts are in the skill package. Must use skill action=exec for execution, do NOT run directly in shell.

Prerequisites

Before using this skill, ensure the following conditions are met:

1. Huawei Cloud Account

• Valid Huawei Cloud account
• Account has completed real-name authentication
• Account has sufficient balance or bound payment method

2. AK/SK Credentials

• Created Huawei Cloud access key (AK/SK)
• AK/SK has the following permissions:
  • ECS: Elastic Cloud Server management
  • VPC: Virtual Private Cloud management
  • EIP: Elastic Public IP management
  • COC: Cloud Operations Center management
• How to obtain: Huawei Cloud Console → My Credentials → Access Keys → Create Access Key

Credential Configuration Methods:

Credential Types (By Recommendation Order):

Note: Credentials are prioritized from environment variables; users are never asked to directly input AK/SK. However, if the user voluntarily provides credentials through other methods (e.g., conversation input, configuration files), credential parsing is still supported.

3. IAM Permissions

📖 Detailed least-privilege policy: IAM Policies

4. Runtime Environment

• Python 3.8 or higher

Required Dependencies:

Install command:

pip install requests huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkcoc

5. Network Environment

• Ability to access Huawei Cloud API endpoints
• Required endpoints:
  • ecs.{region}.myhuaweicloud.com
  • vpc.{region}.myhuaweicloud.com
  • iam.myhuaweicloud.com
  • coc.myhuaweicloud.com

⚠️ Security Notes

⚠️ Security Execution Rules (Highest Priority)

⚠️ Security Group Policy (Critical - Read Before Deployment)

Deployment Strategy - Simple & Secure:

How to Configure After Deployment:

1. Access Huawei Cloud Console → ECS → Security Groups
2. Find the security group named sg-dsh
3. Manually add an inbound rule: protocol TCP, port 22, source IP = your public IP + /32 suffix (e.g., 203.0.113.10/32)
4. Do not add broad 80/443 rules — dsh is accessed only through the SSH tunnel; no other ports need to be exposed

💡 Why Use Empty Security Group? Security First - You have full control over which IPs can access the server. Only port 22 + SSH tunnel — dsh Web UI is never exposed publicly, so even an API key leak cannot be accessed from the internet.

⚠️ AK/SK Security: See Prerequisites - AK/SK Credentials. Prohibited from exposing, recording, or printing AK/SK/Token values in any form.

⚠️ dsh Security (Critical)

🔐 SSL/TLS Verification

• 🔒 SSL/TLS certificate verification is enabled by default for all Huawei Cloud API requests (verify=true).
• The HW_VERIFY_SSL environment variable can override this — HW_VERIFY_SSL=false disables verification.
• ⚠️ HW_VERIFY_SSL=false is for testing only. Never disable SSL verification in production; it exposes AK/SK credentials and API traffic to man-in-the-middle attacks.

Core Commands and Usage

💡 Note: When no operation options are provided, deployment operation is executed by default.

Command Options

Global Parameters

💡 Required Parameters: --ak, --sk (or set HW_ACCESS_KEY, HW_SECRET_KEY environment variables) 💡 Recommended Parameters: --security-token (or set HW_SECURITY_TOKEN for temporary credentials)

Execution Examples

Example 1: List available regions

python3 scripts/deploy_dsh.py --list-regions

Example 2: Test AK/SK connection

python3 scripts/deploy_dsh.py --test

Example 3: Deploy with default settings (requires user confirmation)

python3 scripts/deploy_dsh.py

Example 4: Deploy with custom region and flavor

python3 scripts/deploy_dsh.py --region cn-east-3 --flavor x1.4u.8g

Example 5: List existing servers

python3 scripts/deploy_dsh.py --list-servers --region cn-north-4

Example 6: Check deployment status

python3 scripts/deploy_dsh.py --status <server_id>

Example 7: Delete a server

python3 scripts/deploy_dsh.py --delete <server_id_or_name>

dsh Parameters

💡 The dsh port is bound to 127.0.0.1 only — access it locally via SSH tunnel (ssh -L 3080:127.0.0.1:3080 root@{ip}). No security group rule is needed for the dsh port itself.

Advanced Parameters

💡 The following parameters are for advanced users, not needed for general scenarios

Credential Configuration Examples

Method 1: Using Environment Variables (First Choice - Strongly Recommended)

python3 scripts/deploy_dsh.py

Method 2: Using Command Line Arguments (Second Choice - Accepted)

# Temporary credentials
python3 scripts/deploy_dsh.py \
  --ak <AK> --sk <SK> --security-token <TOKEN> \
  --region cn-north-4 \
  --flavor x1.2u.4g

# Permanent credentials
python3 scripts/deploy_dsh.py \
  --ak <AK> --sk <SK> \
  --region cn-north-4 \
  --flavor x1.4u.8g

🔒 Anti-Duplicate Deployment Mechanism

System built-in lock file mechanism prevents duplicate deployments:

• Lock file automatically created at deployment start: dsh_deploy.lock
• Lock file validity: 30 minutes (auto-expires)
• When lock file exists, new deployment automatically blocked
• Lock file path: system temp directory (/tmp/dsh_deploy.lock on Linux, %TEMP%\dsh_deploy.lock on Windows)

⚠️ Important Notes:

• ❌ Do NOT run multiple deployment tasks simultaneously
• ❌ Duplicate deployments will create multiple servers, incurring double charges
• Check if lock file was deleted after deployment failure

Failure Handling: On deployment failure, return failure reason and guide user to check console, no automatic retry or parameter modification

🚀 Domestic Mirror Acceleration

Built-in domestic mirror acceleration for faster deployment:

Mirror configuration location: scripts/coc_deploy.py in COMBINED_INSTALL_SCRIPT

Module Details

Deploy DeepSeek Harness (dsh)

⏱️ Deployment Time: Entire process takes about 10 minutes (server creation 3-5 minutes + software deployment 5-8 minutes), please be patient

💡 See Credential Configuration Examples for deployment commands, and Global Parameters for all parameters

Deployment stages on the server (via COC script):

Available Regions

Common Regions (more regions run --list-regions):

💡 Complete region list (19) run: python3 scripts/deploy_dsh.py --list-regions

Output Format Specification

⛔ CRITICAL — The SSH tunnel command MUST be output verbatim, never omitted, summarized, or paraphrased:

After deployment, the reply MUST include a copy-paste-ready SSH tunnel command line, with {public_ip} replaced by the actual public IP from the script output. For example, if the script outputs Public IP: 121.36.x.x, the reply must contain:

ssh -L 3080:127.0.0.1:3080 root@121.36.x.x

NEVER write only "please establish an SSH tunnel" without the full command — users need to copy-paste it; missing the command makes the Web UI inaccessible.

After successful deployment, must return results in the following format:

🎉 Deployment Successful!

| Item | Value |
|------|-----|
| Server Name | {server_name} |
| Public IP | {public_ip} |
| SSH Password | {password} |
| Region | {region_id} ({region_name}) |

🌐 Access URL (SSH tunnel required first):
- Run on your local machine (Windows PowerShell / macOS Terminal), replacing {public_ip} with the Public IP from the table above:

ssh -L 3080:127.0.0.1:3080 root@{public_ip}

- Enter the SSH password (from the table above), keep the terminal window open
- Then open in your browser: http://127.0.0.1:3080

🔑 SSH Login: `ssh root@{public_ip}` (password: {password})

📦 Installed Components:
- Node.js 22 LTS ({node_version})
- @deepseek-ai/dsh ({dsh_version}, systemd service 'dsh')
- Nginx reverse proxy (80 → 127.0.0.1:{dsh_port}, loopback only)

📋 Post-deployment TODO:
1. Configure security group: Console → ECS → Security Groups → sg-dsh → Add inbound rule (TCP 22, source your_ip/32)
2. Establish SSH tunnel locally (see command above), then open Web UI: http://127.0.0.1:3080
3. In the Web UI: Settings → Models, enter your DeepSeek API key and save
4. Choose a workspace directory, then start a session

📖 [DeepSeek Harness GitHub](https://github.com/deepseek-ai/deepseek-harness) | [Flexus X Docs](https://support.huaweicloud.com/productdesc-flexusx/pd_01_0002.html)

Variables: {server_name} server name | {public_ip} public IP | {password} SSH password | {region_id}/{region_name} region | {dsh_port} dsh loopback port | {node_version} Node.js version | {dsh_version} dsh CLI version

🔐 Local Access Guide (SSH Port Forwarding)

⚠️ You MUST follow this section after deployment, otherwise the browser cannot open the dsh Web UI. dsh only listens on the server's loopback address 127.0.0.1:3080 — you need to establish an SSH tunnel on your local machine to forward local port 3080 to the server's 3080 port.

How it works: ssh -L 3080:127.0.0.1:3080 root@{public_ip} means — forward all traffic on your local 3080 port through the encrypted SSH channel to 127.0.0.1:3080 on the cloud server (where dsh runs). Data is fully encrypted, dsh Web UI is never exposed publicly, and only someone who can SSH can access it.

Windows Users (PowerShell)

1. Open PowerShell: Press Win key → type powershell → Enter (or press Win+X → select "Windows PowerShell" / "Windows Terminal")
2. Run the tunnel command (replace {public_ip} with the public IP from the deployment output):

   ssh -L 3080:127.0.0.1:3080 root@{public_ip}

3. First-time fingerprint confirmation: if prompted Are you sure you want to continue connecting (yes/no)?, type yes and press Enter
4. Enter the password: type the SSH password from the deployment output (characters are not displayed while typing — this is normal), press Enter
5. Keep the window open: once you see the remote shell prompt (e.g., root@xxx:~#), the tunnel is established. Do not close this window
6. Open your browser: visit http://127.0.0.1:3080 to open the dsh Web UI

💡 Windows 10/11 ships with the OpenSSH client — no extra installation needed. If you get "'ssh' is not recognized", go to Settings → Apps → Optional Features → add "OpenSSH Client".

macOS Users (Terminal)

1. Open Terminal: press Command + Space → type Terminal → Enter (or Finder → Applications → Utilities → Terminal)
2. Run the tunnel command (replace {public_ip} with the public IP from the deployment output):

   ssh -L 3080:127.0.0.1:3080 root@{public_ip}

3. First-time fingerprint confirmation: if prompted Are you sure you want to continue connecting (yes/no)?, type yes and press Enter
4. Enter the password: type the SSH password from the deployment output (characters are not displayed while typing — this is normal), press Enter
5. Keep the window open: once you see the remote shell prompt, the tunnel is established. Do not close this window
6. Open your browser: visit http://127.0.0.1:3080 to open the dsh Web UI

💡 macOS ships with the OpenSSH client — no extra installation needed.

Closing the Tunnel & Advanced Usage

⚠️ Note: after the tunnel is closed, http://127.0.0.1:3080 becomes unreachable — this is normal; just re-run the tunnel command. After every machine reboot you must re-establish the tunnel.

dsh Initial Setup

After establishing the SSH tunnel, open the dsh Web UI (http://127.0.0.1:3080):

⚠️ Important: dsh can read/write files and run commands — only port 22 should be open in the security group (source your_ip/32); dsh is accessed via SSH tunnel; never open 80/3080 to the public, never use 0.0.0.0/0.

Deployment Architecture

This skill uses COC (Cloud Operations Center) for secure deployment, replacing traditional SSH method:

┌─────────────────────────────────────────────────────────────┐
│                    Flexus Cloud Server X Instance                     │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌─────────────────────────────────────────────────────┐    │
│  │              Ubuntu 22.04 Server                    │    │
│  ├─────────────────────────────────────────────────────┤    │
│  │                                                     │    │
│  │   SSH tunnel ──► dsh (127.0.0.1:3080)              │    │
│  │   (port 22)       (loopback only)                   │    │
│  │                                                     │    │
│  │  ┌───────────────┐      ┌───────────────┐          │    │
│  │  │    Nginx      │      │    systemd    │          │    │
│  │  │   (port 80)   │      │  dsh.service  │          │    │
│  │  │   loopback    │      └───────┬───────┘          │    │
│  │  └───────────────┘              │                   │    │
│  │                                 ▼                   │    │
│  │                            dsh web (Node.js 22)     │    │
│  │                             user: dsh (no-shell)   │    │
│  │                             DSH_HOME: /home/dsh/.dsh│    │
│  └───────────┬──────────────────────┬──────────────────┘    │
│              │                      │                       │
│              │              ┌───────┴───────┐              │
│              │              │ Security Group │             │
│              │              │    sg-dsh     │             │
│              │              │ allow 22 /32  │             │
│              │              └───────┬───────┘             │
│              │                      │                      │
│              └──────────────────────┼──────────────────────┘
│                                     ▼                       │
│                           ┌─────────────┐                  │
│                           │    EIP      │  SSH only (22)   │
│                           └─────────────┘                  │
│                                     ▲                       │
│                                     │                       │
│                           ┌─────────┴─────────┐            │
│                           │  COC (Cloud       │           │
│                           │  Operations       │           │
│                           │  Center)          │           │
│                           │  Secure Script    │           │
│                           │  Execution        │           │
│                           └───────────────────┘            │
└─────────────────────────────────────────────────────────────┘

              ┌─────────────────────────────┐
              │  User machine (Windows/macOS) │
              │  ssh -L 3080:127.0.0.1:3080 root@{ip} │
              │  Browser → http://127.0.0.1:3080      │
              └─────────────────────────────┘

Deployment Flow

COC Deployment Advantages

Compared to SSH method, COC deployment has the following advantages:

Log Files

File Structure

skills/huawei-cloud-ecs-dsh-deploy/
├── SKILL.md                    # English version
├── scripts/
│   ├── deploy_dsh.py           # Main deployment script
│   ├── pyproject.toml          # Dependency list
│   ├── huawei_cloud_ecs.py     # Huawei Cloud SDK wrapper
│   ├── coc_deploy.py           # COC deployment module (includes install script)
│   ├── config.py               # Configuration constants
│   ├── utils.py                # Utility functions
│   └── query_regions.py        # Region query helper
└── references/
    ├── acceptance-criteria.md     # Acceptance criteria
    ├── cli-installation-guide.md  # CLI installation guide (KooCLI & dependencies)
    ├── iam-policies.md            # IAM policies
    ├── verification-method.md     # Verification methods
    └── conversation-examples.md   # Natural-language conversation examples

Error Handling

Known Limitations

Common Errors

References

Skill Reference Documents

• Acceptance Criteria - Deployment verification standards
• IAM Policies - Permission configuration
• Verification Methods - Skill verification
• Conversation Examples - Dialog scenarios & response rules

External References

• DeepSeek Harness GitHub - Official repository (default branch: master)
• Flexus Cloud Server X Instance Documentation - Flexus X instance product documentation
• AK/SK Authentication - IAM authentication guide