nginx.conf.noassets

map $proxy_host $is_allowed {
  default 0; # Deny by default
  include /etc/nginx/allowed_jupyter_proxy_hosts.conf;
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=proxy_jupyter_cache:10m max_size=10g inactive=60m use_temp_path=off;
resolver 8.8.8.8 8.8.4.4;

server {
  listen 80;
  server_name frontend;
  port_in_redirect off;

  include mime.types;
  types {
    application/javascript mjs;
  }

  location = / {
    return 302 /static/lecture/;
  }

  location /config {
    root /usr/share/nginx/html;
  }

  location /static/app {
    root /usr/share/nginx/html;
    index index.html
    try_files $uri /index.html;
  }

  location /static/lecture {
    root /usr/share/nginx/html;
    index index.html
    try_files $uri /index.html;
  }

  location /static/experimental/app {
    root /usr/share/nginx/html;
    index index.html
    try_files $uri /index.html;
  }
  location /static/experimental/lecture {
    root /usr/share/nginx/html;
    index index.html
    try_files $uri /index.html;
  }

  location /static/oss {
    root /usr/share/nginx/html;
    index attribution.txt
    try_files $uri /attribution.txt;
  }

  location ~ ^/jupyter/proxy/([^/]+)(/.*)?$ {
    set $proxy_host $1;
    set $proxy_uri $2;

    proxy_set_header Host $proxy_host;
    proxy_ssl_name $proxy_host;
    proxy_ssl_server_name   on;
    proxy_pass https://$proxy_host$proxy_uri;

    if ($is_allowed = 0) {
      return 403;
    }

    proxy_cache proxy_jupyter_cache;
    proxy_cache_valid 200 302 10m;
    proxy_cache_valid 404 1m;
    proxy_cache_key $proxy_host$proxy_uri;
    proxy_cache_use_stale error timeout updating;

    if ($request_method = 'OPTIONS') {
      add_header Access-Control-Allow-Origin $http_host;
      add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
      add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
      add_header Access-Control-Allow-Credentials 'true';
      return 204;
    }

    add_header Access-Control-Allow-Origin $http_host;
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
    add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
    add_header Access-Control-Allow-Credentials 'true';

    proxy_set_header Host $proxy_host;
    proxy_set_header X-Real-IP "";
    proxy_set_header X-Forwarded-For 127.0.0.1;
    proxy_set_header X-Forwarded-Proto "";
  }

location /jupyter {
  location ~ ^/jupyter/(?!proxy/).*$ {
    root /usr/share/nginx/html;
    index index.html
    try_files $uri /index.html;

    if ($request_method = 'OPTIONS') {
      add_header Access-Control-Allow-Origin $http_host;
      add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
      add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
      add_header Access-Control-Allow-Credentials 'true';
      return 204;
    }

    add_header Access-Control-Allow-Origin $http_host;
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
    add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
    add_header Access-Control-Allow-Credentials 'true';

    location ~* \.(wasm|tar\.gz)$ {
      add_header Cache-Control "public, max-age=2419200, must-revalidate"; 
      expires 4w;
    }
  }
}
}