# DeepSeek API Nginx Proxy

All ShopProQuote AI features now use DeepSeek V4 Flash via the VPS `/deepseek/` proxy. The browser cannot call `api.deepseek.com` directly — the API key is server-side only.

## VPS Nginx Configuration

At `/etc/nginx/sites-enabled/shopproquote` on VPS (51.81.84.34):

```nginx
location /deepseek/ {
    proxy_pass https://api.deepseek.com/;
    proxy_http_version 1.1;
    proxy_set_header Host api.deepseek.com;
    proxy_set_header Authorization "Bearer ${DEEPSEEK_API_KEY}";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_ssl_server_name on;
    proxy_ssl_protocols TLSv1.2 TLSv1.3;
    proxy_read_timeout 120;
}
```

Key requirements:
- `proxy_ssl_server_name on` is REQUIRED — without it, nginx fails with "SSL handshake failure: alert number 40"
- `proxy_read_timeout 120` because model loading can take a few seconds
- The `DEEPSEEK_API_KEY` comes from `/home/ray/.hermes/.env`
- `proxy_ssl_protocols TLSv1.2 TLSv1.3` ensures compatibility with CloudFront

## Client-Side Usage

All SPQ AI features use this pattern:

```javascript
const response = await fetch('/deepseek/v1/chat/completions', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        model: 'deepseek-v4-flash',
        messages: [
            { role: 'system', content: systemPrompt },
            { role: 'user', content: userMsg }
        ],
        temperature: 0,
        thinking: { type: 'disabled' },
        max_tokens: 500
    })
});
const result = await response.json();
const text = result.choices[0].message.content;
```

## Cost & Thinking Mode

- `thinking: { type: 'disabled' }` keeps costs at the non-thinking rate: $0.14/M input, $0.28/M output
- Typical AI Write call: ~400 tokens total → ~$0.0001
- Appointment scan: ~2,000 input + ~500 output → ~$0.0004
- Without `thinking: disabled`, thinking tokens 3-5x the output cost

## CSP

`connect-src 'self'` covers `/deepseek/` since it's same-origin. No CSP changes needed for DeepSeek specifically. For Tesseract.js / WASM / Web Worker CSP requirements, see `references/csp-wasm-libraries.md`.

## Testing

```bash
curl -s -X POST https://shopproquote.graj-media.com/deepseek/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"deepseek-v4-flash","messages":[{"role":"user","content":"Say OK"}],"max_tokens":50,"thinking":{"type":"disabled"}}'
```