initial commit

2026-07-12 10:17:17 -04:00
commit dab5a4ebc6
1424 changed files with 330463 additions and 0 deletions
@@ -0,0 +1,68 @@
+# DeepSeek API Nginx Proxy
+
+All ShopProQuote AI features now use DeepSeek V4 Flash via the VPS `/deepseek/` proxy. The browser cannot call `api.deepseek.com` directly — the API key is server-side only.
+
+## VPS Nginx Configuration
+
+At `/etc/nginx/sites-enabled/shopproquote` on VPS (51.81.84.34):
+
+```nginx
+location /deepseek/ {
+    proxy_pass https://api.deepseek.com/;
+    proxy_http_version 1.1;
+    proxy_set_header Host api.deepseek.com;
+    proxy_set_header Authorization "Bearer ${DEEPSEEK_API_KEY}";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_ssl_server_name on;
+    proxy_ssl_protocols TLSv1.2 TLSv1.3;
+    proxy_read_timeout 120;
+}
+```
+
+Key requirements:
+- `proxy_ssl_server_name on` is REQUIRED — without it, nginx fails with "SSL handshake failure: alert number 40"
+- `proxy_read_timeout 120` because model loading can take a few seconds
+- The `DEEPSEEK_API_KEY` comes from `/home/ray/.hermes/.env`
+- `proxy_ssl_protocols TLSv1.2 TLSv1.3` ensures compatibility with CloudFront
+
+## Client-Side Usage
+
+All SPQ AI features use this pattern:
+
+```javascript
+const response = await fetch('/deepseek/v1/chat/completions', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+        model: 'deepseek-v4-flash',
+        messages: [
+            { role: 'system', content: systemPrompt },
+            { role: 'user', content: userMsg }
+        ],
+        temperature: 0,
+        thinking: { type: 'disabled' },
+        max_tokens: 500
+    })
+});
+const result = await response.json();
+const text = result.choices[0].message.content;
+```
+
+## Cost & Thinking Mode
+
+- `thinking: { type: 'disabled' }` keeps costs at the non-thinking rate: $0.14/M input, $0.28/M output
+- Typical AI Write call: ~400 tokens total → ~$0.0001
+- Appointment scan: ~2,000 input + ~500 output → ~$0.0004
+- Without `thinking: disabled`, thinking tokens 3-5x the output cost
+
+## CSP
+
+`connect-src 'self'` covers `/deepseek/` since it's same-origin. No CSP changes needed for DeepSeek specifically. For Tesseract.js / WASM / Web Worker CSP requirements, see `references/csp-wasm-libraries.md`.
+
+## Testing
+
+```bash
+curl -s -X POST https://shopproquote.graj-media.com/deepseek/v1/chat/completions \
+  -H "Content-Type: application/json" \
+  -d '{"model":"deepseek-v4-flash","messages":[{"role":"user","content":"Say OK"}],"max_tokens":50,"thinking":{"type":"disabled"}}'
+```