System documentation

H-DCS Documentation

This manual explains how to use H-DCS as a customer workspace: accounts, requests, device integration, VPN, storage, mail, chat, shell access and legal validation.

Open user manual Browse services

Start here

What H-DCS provides

H-DCS combines web-hosted services with device enrollment. After registration, a user can manage a profile, request services, use an H-D.email mailbox, work with H-D Disk storage, integrate computers and phones, and control VPN connectivity between devices and selected external services.

Visual overview

Architecture

How H-DCS traffic moves

H-DCS is built around account identity, enrolled devices, private VPN paths and service-specific web interfaces. Public visitors see the website; authenticated users get private services and device integrations.

User devices Browser, Linux, Windows, Android

WireGuard VPN and DNS 172.16.0.1 resolver and gateway

H-DCS services Mail, Disk, Chat, Shell, requests

Setup path

From registration to integrated device

The fastest path is to finish account setup first, then enroll each computer or phone and validate the VPN indicator before using storage, mail or voice features.

1
Create and secure the account
Confirm email, complete the profile, then add passkeys or two-factor authentication.
2
Generate device setup
Open Devices, choose the operating system, and keep the generated setup material private.
3
Connect through VPN
Run the setup, confirm the WireGuard tunnel, and check the VPN indicator in the left menu.
4
Enable daily services
Use H-D Disk, H-D.email, H-DChat, H-D.shell and VPN settings from the authenticated workspace.

Workspace map

Where daily work happens

Devices VPN settings Email settings Legal mechanisms

HelpBar Page-specific guidance

User Manual

Account

Account and identity

The account is the starting point for every H-DCS service. It ties together service requests, mailbox provisioning, public profile settings, device enrollments and legal validation.

Register with a valid email address and confirm the mailbox before completing the profile.
Complete the profile with real account details; the username becomes a stable system label.
Use passkeys and two-factor authentication where possible to reduce password dependence.
Use the Public Profile page to control what appears on username.h-d.website.
Use the Legal page for Terms, EULA and the KEO identity document process when a stronger provider-customer relationship is needed.

Requests

Service requests and quotes

H-DCS uses structured request forms so a service can be reviewed before a quote or next action is proposed.

Open Services to choose the closest service area, then follow the requirements form.
Unauthenticated visitors can read services and start the flow, but submitting requests requires an account.
Use My Requests to track request status, review published quotes and confirm an order when the scope is acceptable.
Attach screenshots, exports, diagrams or inventories when they reduce ambiguity.
Use Forums or the contact form for smaller questions that do not need a structured RFQ.

Devices

Device enrollment

Device enrollment creates operating-system-specific setup material for H-DCS VPN and related integrations.

Open Account / Manage / Devices and choose the target operating system before generating a profile.
Linux and Windows scripts should be run with administrator or root privileges as instructed by the generated script.
Android uses WireGuard QR/config import, app install links and mobile-specific storage or voice-agent instructions.
Generated scripts contain private key material and should be treated as sensitive.
Use Revoke when a device is lost, replaced or no longer trusted; then regenerate a fresh enrollment if needed.

VPN

VPN and network access

H-DCS uses a split-tunnel WireGuard VPN. H-DCS service traffic and approved private routes use the tunnel, while normal internet browsing stays outside the tunnel.

The VPN status indicator in the left menu shows whether the webapp sees the client through H-DCS VPN.
The H-DCS resolver at the VPN gateway resolves internal H-DCS service names while connected.
Devices belonging to one user can be managed from VPN settings, including isolation from the user's other devices.
Connection requests allow one user to request narrowly scoped protocol and port access to another user's enrolled device.
External FQDN egress can route one selected hostname, protocol and port through a synthetic VPN address without enabling full-tunnel VPN.

Storage

H-D Disk remote storage

H-D Disk exposes the user's H-DCS server-side home folder through the webapp and through mounted storage on enrolled devices.

Use H-D Disk in the browser to browse, upload, download, rename, copy, move and delete files.
Folder downloads are zipped when the folder contains downloadable content.
Share files or folders with another H-DCS user or create an external share link when needed.
Linux and Windows enrollment can mount the same storage locally using the internal SSH key material generated for the user.
Android storage uses a mobile SSH/SFTP workflow and PocketShell pairing where available.

Mail

H-D.email mailbox

H-D.email provides a Mailu-backed mailbox, webmail access, app-password tokens and Linux desktop mail integration.

Open H-D.email from the navigation menu to use webmail in a new browser tab.
Use Email Settings to manage mailbox display settings, forwarding, spam behavior, automatic replies and app-password tokens.
App passwords are Mailu authentication tokens generated for native mail clients; copy them when created because they are not displayed again.
Linux device enrollment can configure local Maildir synchronization with mbsync, sending through msmtp and command-line mail through neomutt.
Windows device enrollment does not currently install a Windows mail agent; use webmail or native client app passwords instead.

Chat

H-DChat and voice

H-DChat provides PGP-secured conversations, attachments and optional VPN-backed voice calls between enrolled users and devices.

Import and unlock your private PGP key locally in the browser; private keys are not posted to the server.
Messages are encrypted using the recipient's public PGP key stored in H-DCS.
Use attachments, editing, deletion, read receipts and plaintext search after messages are decrypted locally.
Voice calls use the H-DCS Voice Agent on enrolled devices and the VPN path between caller and receiver.
If calls connect but audio fails, confirm the Voice Agent is running locally and the browser has microphone permission.

Shell

H-D.shell access

H-D.shell opens Apache Guacamole in a new tab for browser-based access to H-DCS shell and desktop sessions.

Use the H-D.shell navigation item to open Guacamole directly.
SSH access is intended for the user's H-DCS UNIX account.
VNC/RDP-style desktop access is available where the account and service profile have been provisioned.
Authentication and connection definitions are managed by H-DCS provisioning rather than by exposing raw server credentials in the web UI.
Close unused sessions when work is finished.

Support

Troubleshooting

Most operational issues can be narrowed down by checking the current account, device enrollment state, VPN status and whether the generated setup material is current.

Use a hard browser refresh after deployment or UI changes if an old script or old JavaScript appears to be cached.
If an install script fails, copy the full terminal output and check whether the failing section is VPN, storage, mail or voice.
If VPN-dependent services fail, first confirm the VPN status indicator and the device's WireGuard connection.
If a device was revoked, do not reuse old scripts; enroll the device again and use the newly generated setup material.
Use Forums, Contact or My Requests depending on whether the issue is public discussion, a small question or a formal service request.

Service reference

Mail

H-D.email

Where to open it: Open H-D.email for webmail, or Email Settings for mailbox controls and app passwords.
Device integration: Linux enrollment can configure local Maildir synchronization and SMTP sending; other clients use app-password tokens.
Useful when: You need a managed mailbox, webmail access, Linux desktop mail or native MUA credentials.

Storage

H-D Disk

Where to open it: Open H-D Disk from the left navigation for browser file management.
Device integration: Linux and Windows enrollment can mount the server-side home folder; Android uses SFTP-oriented mobile workflows.
Useful when: You need private files available from the browser and from enrolled computers.

VPN

VPN settings

Where to open it: Open Account / Manage / VPN settings for device visibility, connection requests and external FQDN egress.
Device integration: Every enrolled device receives WireGuard configuration and controlled split-tunnel routes.
Useful when: You need device-to-device access, user-approved firewall rules or selected external hostname egress through H-DCS.

Chat

H-DChat

Where to open it: Open H-DChat from the left navigation after signing in.
Device integration: Voice calls require the H-DCS Voice Agent on enrolled devices and VPN reachability between endpoints.
Useful when: You need encrypted conversations, attachments, read receipts, search or VPN-backed calls.

Shell

H-D.shell

Where to open it: Open H-D.shell to launch Apache Guacamole in a new browser tab.
Device integration: Provisioned shell and desktop sessions connect to the user's H-DCS UNIX account and managed desktop profiles.
Useful when: You need browser-based SSH, VNC or RDP-style access to H-DCS shell resources.

Requests

Service requests

Where to open it: Open Services or My Requests to create and track structured RFQs.
Device integration: No device setup is required, but account completion makes quoting and follow-up cleaner.
Useful when: You need reviewed scope, a quote, or a formal service request instead of a chat or forum question.

Common workflows

First account setup

Register, confirm email, complete the profile, add passkeys or two-factor authentication, then review Public Profile and Legal settings.

Integrate a computer

Open Devices, generate the correct OS profile, run the install script with elevated privileges and confirm VPN, storage and optional Linux mail behavior.

Use storage

Open H-D Disk for browser file management, or mount the same server-side home folder from an enrolled Linux or Windows computer.

Request network access

Open VPN settings, choose the relevant devices, protocol and port, then wait for the target user to approve the connection request.

Operational note

Regenerate scripts after changes

Device install scripts contain device-specific keys, routes and service settings. When an enrollment is revoked or a generator changes, create a new enrollment and use the newly generated script rather than reusing an older copy.

Security and recovery checklist

Identity

Protect sign-in first

Use confirmed email, passkeys and two-factor authentication before relying on device integrations.

Keys

Treat generated scripts as secrets

Install scripts can include private keys and tokens. Do not post them into tickets, chats or public logs.