{"slug": "making-a-remote-service-look-local-dsh-as-a-case-study", "title": "Making a remote service look local - (dsh as a case study)", "summary": "A developer built Kepos, an end-to-end encrypted P2P tunnel that makes remote TCP services appear as local loopback connections, and demonstrated its utility by integrating it with DeepSeek Harness (dsh), a local-first coding agent. The tunnel uses HyperDHT and UDX for peer connections, and on the subscriber side, dsh can be mounted on a loopback listener, allowing the web interface to function with its expected loopback security semantics without requiring trusted-host changes. The developer notes that Kepos is still a developer preview with limitations such as no UDP support.", "body_md": "I wrote Kepos as a general-purpose, end-to-end encrypted P2P tunnel. The publisher shares a TCP service, and the subscriber receives it as a `*.localhost`\n\nhostname or an explicit local port. Browsers, SSH clients, and CLIs all behave as if the service were on the same machine.\n\nThe first things I wanted to reach were ordinary self-hosted services: music and SSH, without opening public ports or putting every device on a virtual network. Kepos uses HyperDHT and UDX for the peer connection. Peer keys authenticate an end-to-end encrypted outer connection, and Protomux carries the registry, heartbeat, pairing, and one channel per service over that single connection.\n\nThe tunnel ends TCP locally at both peers. Open, data, half-close, reset, and backpressure cross the multiplexed channel instead of forwarding TCP packets. That detail matters less to the application than the result: it sees a normal loopback connection.\n\nDeepSeek Harness (dsh) is a local-first coding agent with a web interface. Its configuration panel deliberately trusts loopback same-origin requests as a defense against DNS rebinding. That is a sensible boundary, but it makes remote access awkward. A LAN address can receive a `403`\n\n; an ordinary tunnel hostname can leave settings unavailable or non-persistent; and `--trusted-host`\n\nmeans maintaining another list of addresses as networks change.\n\nSSH forwarding works. I have used it. But then every client owns a tunnel that has to stay alive. A reverse proxy usually means adding an authentication layer the application did not ask for.\n\nIt turned out that Kepos already had the useful property. On the subscriber, dsh can be mounted on an explicit loopback listener:\n\n```\n[subscriber]\nenabled = true\ngateway_port = 17480\n\n[[subscriber.services]]\nid = \"dsh\"\nlocal_port = 13080\n```\n\nOpening `http://127.0.0.1:13080/`\n\ngives dsh the loopback `Host`\n\nsemantics it expects. There are no `--trusted-host`\n\nchanges, and its settings continue to edit and persist across reloads. Android includes this `dsh`\n\nmapping by default, so the service card opens the same loopback URL after the phone pairs with a publisher that advertises `id = \"dsh\"`\n\n.\n\nNothing in the transport is specific to dsh. SSH, Dagger, and other raw TCP services use their own listeners over the same authenticated outer connection; HTTP services can share the `*.localhost`\n\ngateway.\n\nUnknown devices still cannot open the service. Publisher and per-service allowlists decide which subscriber public keys are authorized. Kepos does not weaken dsh's browser fence or expose its port publicly. It makes the remote service look local while keeping access at the service boundary.\n\nKepos is still a developer preview. Android is sideload-only, the macOS build is ad-hoc signed and not notarized, and the tunnel does not carry UDP. The dsh case is useful because it exposes the design in a concrete way: sometimes \"local\" is not just a convenient address. It is part of the application's security model.\n\nSee [DeepSeek Harness integration](//../integrations/deepseek-harness.md) for the publisher policy, setup steps, and security notes.", "url": "https://wpnews.pro/news/making-a-remote-service-look-local-dsh-as-a-case-study", "canonical_source": "https://dev.to/neil_agentic/making-a-remote-service-look-local-dsh-as-a-case-study-4gnd", "published_at": "2026-08-17 00:40:49+00:00", "updated_at": "2026-08-17 01:11:51.552116+00:00", "lang": "en", "topics": ["developer-tools", "ai-products", "ai-tools"], "entities": ["Kepos", "DeepSeek Harness", "HyperDHT", "UDX", "Protomux", "Android", "macOS"], "alternates": {"html": "https://wpnews.pro/news/making-a-remote-service-look-local-dsh-as-a-case-study", "markdown": "https://wpnews.pro/news/making-a-remote-service-look-local-dsh-as-a-case-study.md", "text": "https://wpnews.pro/news/making-a-remote-service-look-local-dsh-as-a-case-study.txt", "jsonld": "https://wpnews.pro/news/making-a-remote-service-look-local-dsh-as-a-case-study.jsonld"}}