From c31f6d8d90fde98012f5c321d9bb4a93208c54b6 Mon Sep 17 00:00:00 2001
From: Vassiliy Yegorov <va@egorovanet.ru>
Date: Sun, 20 Sep 2026 13:11:10 +0700
Subject: [PATCH] add deepseek

---
 README.md            |  4 +++-
 nginx/locations.conf | 43 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 95051a5..3c15270 100644
--- a/README.md
+++ b/README.md
@@ -45,6 +45,8 @@ curl -H "X-Proxy-Token: YOUR_SECRET" http://localhost:8080/elevenlabs/v1/voices
 | /elevenlabs/ | https://api.elevenlabs.io   |
 | /openai/     | https://api.openai.com      |
 | /telegram/   | https://api.telegram.org    |
+| /openrouter/ | https://openrouter.ai/api/v1|
+| /deepseek/   | https://api.deepseek.com    |
 | /health      | local health check (no auth)|
 
 ---
@@ -203,6 +205,6 @@ docker inspect --format='{{.State.Health.Status}}' api-proxy
 
 1. A k8s pod sends an HTTP request to `http://<proxy-vm>:8080/elevenlabs/v1/text-to-speech/...` with the `X-Proxy-Token` header and the original API key.
 2. Nginx checks the source IP against `ALLOWED_CIDR` and validates `X-Proxy-Token` — rejecting with 403 if either fails.
-3. The prefix (`/elevenlabs/`, `/openai/`, `/telegram/`) is stripped via rewrite, and the request is forwarded over HTTPS to the upstream with SNI enabled.
+3. The prefix (`/elevenlabs/`, `/openai/`, `/telegram/`, `/openrouter/`, `/deepseek/`) is stripped via rewrite, and the request is forwarded over HTTPS to the upstream with SNI enabled.
 4. `X-Proxy-Token` and all IP-leaking headers are removed before forwarding; API keys pass through unchanged.
 5. The response streams back unbuffered to the pod — critical for binary audio data and long-polling (Telegram).
diff --git a/nginx/locations.conf b/nginx/locations.conf
index cadf7da..0bdd58f 100644
--- a/nginx/locations.conf
+++ b/nginx/locations.conf
@@ -156,8 +156,49 @@ location /openrouter/ {
     proxy_send_timeout 120s;
 }
 
+# --- DeepSeek ---
+location /deepseek/ {
+    if ($allowed_ip = 0) {
+        return 403 '{"error":"ip_not_allowed"}';
+    }
+    if ($auth_ok = 0) {
+        return 403 '{"error":"invalid_token"}';
+    }
+
+    set $deepseek_upstream https://api.deepseek.com;
+    rewrite ^/deepseek/(.*) /$1 break;
+
+    proxy_pass $deepseek_upstream;
+    proxy_ssl_server_name on;
+    proxy_ssl_name api.deepseek.com;
+    proxy_ssl_protocols TLSv1.2 TLSv1.3;
+
+    proxy_set_header Host api.deepseek.com;
+    proxy_set_header Connection "";
+
+    proxy_set_header X-Forwarded-For "";
+    proxy_set_header X-Real-IP "";
+    proxy_set_header True-Client-IP "";
+    proxy_set_header CF-Connecting-IP "";
+    proxy_set_header X-Client-IP "";
+    proxy_set_header Forwarded "";
+    proxy_set_header Via "";
+
+    proxy_set_header X-Proxy-Token "";
+
+    proxy_http_version 1.1;
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_buffer_size 16k;
+    proxy_buffers 4 16k;
+    proxy_busy_buffers_size 32k;
+    proxy_connect_timeout 15s;
+    proxy_read_timeout 300s;
+    proxy_send_timeout 120s;
+}
+
 # --- Catch-all ---
 location / {
     default_type application/json;
-    return 404 '{"error":"unknown_upstream","hint":"use /elevenlabs/, /openai/ or /telegram/ or /openrouter/"}';
+    return 404 '{"error":"unknown_upstream","hint":"use /elevenlabs/, /openai/, /telegram/, /openrouter/ or /deepseek/"}';
 }