Hara Control: Self-hosting & Fleet

hara-control is the open-source control plane for company-managed model access. It keeps upstream provider keys on infrastructure you control, exchanges one-time enrollment codes for scoped device credentials, and gives administrators a fleet, usage, quota, and audit view.

There are two different Hara gateways. Hara Control manages model access and devices. The hara gateway --platform … command connects a local Hara to chat products such as Feishu, WeCom, and WeChat. They can be used together, but they are not the same service.

The two access surfaces

administrator
    │  private network / SSH tunnel
    ▼
Hara Control console  ── issue codes · set limits · usage · fleet · revoke
 
member CLI / Desktop
    │  public HTTPS origin + scoped device credential
    ▼
company gateway  ── Hara Control + LiteLLM  ── provider / private model

Use a public HTTPS origin such as https://gw.example.com when laptops must connect from outside the server's LAN. Enter the origin only in Hara — do not append /v1. localhost is fine for a same-machine evaluation; plain HTTP remote origins are rejected.

Keep the administration surface private. A common arrangement is to bind Hara Control to localhost on the server, then open it from an administrator's computer with an SSH tunnel:

ssh -L 4100:127.0.0.1:4100 <server>
# open http://localhost:4100/console/

The public gateway URL is a device endpoint, not the admin console URL. Never give an admin password, shared admin key, or upstream provider key to a member device.

Administrator workflow

The hara-control 0.1.15 web console supports individual accounts and organization-scoped access:

• SUPERADMIN creates console users, assigns roles and organizations, and can manage every org.
• ADMIN manages enrollment, fleet, usage, and revocation only for the assigned organization.
• Every console user can enable TOTP two-factor authentication under Security.

To onboard a colleague:

1. Open Enroll codes and select the organization.
2. Choose the model and device-key validity period.
3. Optionally set independent rolling USD limits for 5 hours, 7 days, and 30 days, plus requests per minute (RPM) and tokens per minute (TPM).
4. Mint the code and send the generated command through a trusted private channel.

The enrollment code is single-use. It is exchanged for a scoped device credential and is not kept by Hara after redemption. The gateway enforces the model, expiry, spend limits, and rate limits; a dollar limit is refused if the configured model does not have positive pricing.

DeepSeek V4 model boundary

The production DeepSeek choices in 0.1.15 are:

• deepseek-v4-flash, the default;
• deepseek-v4-pro, the higher-quality tier;
• both advertise a 1M-token context, up to 384K output, and only off, high, and max thinking controls to Hara.

One redeemed enrollment code produces a device credential authorized for the deployment's complete allowed model catalog. The enrollment model is only the initial default; the same connection and raw Token can switch between Flash and Pro. Existing single-model credentials are reconciled in place on heartbeat, without re-enrollment. Existing deepseek-chat / deepseek-pro values remain compatibility aliases for previously issued configuration, while new enrollment and documentation should use the canonical ids. Follow the official DeepSeek update log for model capability and migration dates.

Member workflow

Give each company or team a distinct profile name:

hara profile add acme-work \
  --gateway https://gw.example.com \
  --code <one-time-code>
 
hara profile use acme-work       # default for new sessions
hara profile list                # status and current profile
hara --profile acme-work         # use once without changing the default

hara enroll <gateway-url> --code <code> remains a shorthand that creates the default-org profile. Named profiles are a better fit when one person belongs to more than one organization.

In Hara Desktop, open Settings → AI & models → Enterprise managed, choose +, then enter a connection name, the HTTPS Hara Control origin, and the one-time code. Desktop can retain several user-added company connections, display their model and expiry status, test them, and switch the route used by new sessions. Hara never ships a fixed enterprise endpoint.

Usage, quota, and revocation

The console's Usage page switches between 24 hours, 7 days, and 30 days and shows:

• billed USD, input/output token total, request count, and latest activity;
• a spend and token timeline;
• colleague, device, and model breakdowns;
• current 5-hour, 7-day, and 30-day progress for every active limited key;
• the RPM/TPM policy and device-key expiry.

The fleet page shows enrolled devices and their current access state. Revoking a device invalidates its server-side key; removing a connection from one laptop only removes the local copy and does not replace server-side revocation. Usage APIs return aggregates rather than device credentials, prompts, responses, or authorization headers.

Run your own

hara-control is Apache-2.0 and self-hostable. Pin a released multi-architecture image rather than a moving tag:

docker pull ghcr.io/hara-cli/hara-control:0.1.15

The deployment needs PostgreSQL, a separate LiteLLM data plane for real model traffic, TLS path routing, and independent signing/encryption secrets. Follow the repository's self-hosting guide for the complete deployment and first-admin procedure. After deployment, require the readiness endpoint to report database, gateway, and configuration checks as healthy before distributing enrollment codes.