hermes-config/skills/software-development/pocketbase-react-apps/references/nginx-key-safety.md

Nginx Config Construction with API Keys (Secrets Filter Safety)

Problem

When reading an existing nginx config that contains API keys, the Hermes secrets filter truncates the key in the displayed output. If you then tee or cp that truncated output into a new config file, the API key becomes corrupted — resulting in Authentication Fails, Your api key is invalid on all proxied API calls.

Safe Pattern

Build the nginx config inline using environment variable values instead of copying from a truncated config file:

# Safe: construct config with env var key, write directly
import os
key = os.environ.get('AUXILIARY_APPROVAL_API_KEY', '')
config = f'''
location /deepseek/ {{
    proxy_pass https://api.deepseek.com/;
    proxy_ssl_server_name on;
    proxy_ssl_name api.deepseek.com;
    proxy_http_version 1.1;
    proxy_set_header Host api.deepseek.com;
    proxy_set_header Authorization "Bearer {key}";
    proxy_set_header Content-Type "application/json";
    proxy_buffering off;
    proxy_read_timeout 120s;
    proxy_connect_timeout 10s;
}}
'''
with open('/tmp/nginx-spq.conf', 'w') as f:
    f.write(config)

Then deploy: sudo cp /tmp/nginx-spq.conf /etc/nginx/sites-enabled/shopproquote

Verifying the Key

After deploying, test the endpoint. A working key returns a chat completion. An invalid/corrupted key returns {"error":{"message":"Authentication Fails..."}}.

curl -s -X POST https://site/deepseek/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"model":"deepseek-v4-flash","messages":[{"role":"user","content":"hi"}],"temperature":0,"max_tokens":20}'

Env Var Locations

DeepSeek API keys are typically set as:

• DEEPSEEK_API_KEY — used by Hermes config via ${DEEPSEEK_API_KEY}
• AUXILIARY_APPROVAL_API_KEY — set by Hermes secret store
• AUXILIARY_VISION_API_KEY — set by Hermes secret store
• AUXILIARY_WEB_EXTRACT_API_KEY — set by Hermes secret store

Check with: python3 -c "import os; print(len(os.environ.get('AUXILIARY_APPROVAL_API_KEY','')))"