1
resolver 223.5.5.5  119.29.29.29 valid=300s ipv6=off;

1
# 用 map 把真实 key 定义成一个变量,集中管理、便于轮换
2
map $host $deepseek_api_key {
3
    default "sk-your-deepseek-api-key";
4
}

1
# 内部令牌 → 员工/团队标识(标识用于限流与日志归因)
2
# 令牌建议用 `openssl rand -hex 16` 生成,前缀方便辨识
3
map $http_authorization $client_name {
4
    default                        "";          # 不在清单 → 视为非法
5
    "Bearer [token]" "[username]"; #备注
6
}

115 collapsed lines
1
http {
2
    include /usr/local/openresty/nginx/secrets/deepseek.conf;   # $deepseek_api_key
3
    include /usr/local/openresty/nginx/secrets/tokens.conf;     # $client_name
4

5
    map $uri $endpoint_allowed {
6
        default               0;
7
        ~^/chat/completions$  1;
8
        ~^/completions$       1;
9
        ~^/models$            1;
10
        ~^/anthropic/         1;
11
        ~^/beta/              1;
12
        ~^/v1/                1;
13
    }
14

15
    limit_req_zone  $client_name zone=req_per_user:10m  rate=20r/m;
16
    limit_conn_zone $client_name zone=conn_per_user:10m;
17

18
    log_format llm_audit escape=json
19
      '{'
20
        '"time":"$time_iso8601","client":"$client_name","ip":"$remote_addr",'
21
        '"method":"$request_method","uri":"$uri","status":$status,'
22
        '"req_bytes":$request_length,"resp_bytes":$body_bytes_sent,'
23
        '"upstream_time":"$upstream_response_time"'
24
      '}';
25

26
    upstream deepseek {
27
        server api.deepseek.com:443;
28
        keepalive 32;
29
    }
30

31
    resolver 223.5.5.5  119.29.29.29 valid=300s ipv6=off;
32

33
    server {
34
        listen 9443;
35
        #listen 443 ssl;
36
        server_name [所在服务器内网IP];
37

38
        #ssl_certificate     /etc/nginx/ssl/proxy.crt;
39
        #ssl_certificate_key /etc/nginx/ssl/proxy.key;
40
        #ssl_protocols       TLSv1.2 TLSv1.3;
41

42
        access_log /var/log/nginx/llm_audit.log llm_audit;
43
        client_max_body_size    20m;
44
        client_body_buffer_size 1m;
45

46
        location / {
47
            limit_req  zone=req_per_user burst=20 nodelay;
48
            limit_conn conn_per_user 10;
49

50
            access_by_lua_block {
51
                local client = ngx.var.client_name
52
                if client == nil or client == "" then
53
                    ngx.status = 401
54
                    ngx.header.content_type = "application/json"
55
                    ngx.say('{"error":{"message":"invalid internal token"}}')
56
                    return ngx.exit(401)
57
                end
58
                if ngx.var.endpoint_allowed ~= "1" then
59
                    ngx.status = 403
60
                    ngx.header.content_type = "application/json"
61
                    ngx.say('{"error":{"message":"endpoint not allowed"}}')
62
                    return ngx.exit(403)
63
                end
64

65
                local method = ngx.req.get_method()
66
                local ctype  = ngx.req.get_headers()["content-type"] or ""
67
                if method == "POST" and ctype:find("application/json", 1, true) then
68
                    ngx.req.read_body()
69
                    local body = ngx.req.get_body_data()
70
                    -- 大 body 被写到临时文件时，get_body_data() 返回 nil，需读文件
71
                    if not body then
72
                        local fname = ngx.req.get_body_file()
73
                        if fname then
74
                            local fh = io.open(fname, "rb")
75
                            if fh then body = fh:read("*a"); fh:close() end
76
                        end
77
                    end
78
                    if body and #body > 0 then
79
                        local cjson = require "cjson.safe"
80
                        local data  = cjson.decode(body)
81
                        if not data then
82
                            ngx.status = 400
83
                            ngx.header.content_type = "application/json"
84
                            ngx.say('{"error":{"message":"invalid JSON body"}}')
85
                            return ngx.exit(400)
86
                        end
87
                        -- 强制覆盖为已鉴权身份，客户端传什么都不算数
88
                        if ngx.var.uri:find("^/anthropic") then
89
                            if type(data.metadata) ~= "table" then data.metadata = {} end
90
                            data.metadata.user_id = client      -- Anthropic 格式
91
                        else
92
                            data.user_id = client               -- OpenAI 格式
93
                        end
94
                        ngx.req.set_body_data(cjson.encode(data))
95
                    end
96
                end
97
            }
98

99
            proxy_pass https://deepseek;
100
            proxy_http_version 1.1;
101
            proxy_ssl_server_name on;
102
            proxy_ssl_name  api.deepseek.com;
103
            proxy_set_header Host          api.deepseek.com;
104
            proxy_set_header Authorization "Bearer $deepseek_api_key";
105
            proxy_set_header Connection    "";
106

107
            proxy_buffering off;
108
            proxy_cache     off;
109
            proxy_connect_timeout 10s;
110
            proxy_send_timeout    300s;
111
            proxy_read_timeout    300s;
112
            default_type application/json;
113
        }
114
    }
115
}

1
ngx.req.set_body_data(cjson.encode(data))
2
ngx.log(ngx.ERR, "USERID_INJECT client=", client, " body=", cjson.encode(data))  -- 临时

1
{
2
  "env": {
3
    "ANTHROPIC_AUTH_TOKEN": "[token]",
4
    "ANTHROPIC_BASE_URL": "http://[ip]:[port]/anthropic",
5
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "deepseek-v4-flash",
6
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "deepseek-v4-pro[1M]",
7
    "ANTHROPIC_DEFAULT_OPUS_MODEL_NAME": "deepseek-v4-pro",
8
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "deepseek-v4-pro[1M]",
9
    "ANTHROPIC_DEFAULT_SONNET_MODEL_NAME": "deepseek-v4-pro",
10
    "ANTHROPIC_MODEL": "deepseek-v4-pro"
11
  },
12
  "includeCoAuthoredBy": false
13
}