nginx.conf

map $proxy_host $is_allowed {
  default 0; # Deny by default
  include /etc/nginx/allowed_jupyter_proxy_hosts.conf;
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=proxy_jupyter_cache:10m max_size=10g inactive=60m use_temp_path=off;
resolver 8.8.8.8 8.8.4.4;

# remove the log stuff after debugging
 log_format custom '$proxy_protocol_addr - $remote_user [$time_local] "$request" '
                          'proxy_host=$proxy_host '
                          'proxy_uri=$proxy_uri '
                          'request_uri=$request_uri '
                          'proxy_pass_url="https://$proxy_host$proxy_uri" '
                          'status=$status '
                          'body_bytes_sent=$body_bytes_sent '
                          'referer=$http_referer '
                          'user_agent=$http_user_agent';

    access_log /var/log/nginx/access.log custom;

server { 
 listen 80;
 server_name frontend;
 port_in_redirect off;

include mime.types;
types {
    application/javascript mjs;
}

location = / {
    return 302 /static/lecture/;
}

location /files {
    alias /usr/share/nginx/htmlsecuredfiles;
    secure_link $arg_md5,$arg_expires;
    secure_link_md5 "$secure_link_expires$uri ${FAILS_STATIC_SECRET}";

    if ($secure_link = "") { return 403; }
    if ($secure_link = "0") { return 410; }
}

location /config {
  root /usr/share/nginx/html;
}

location /static/app {
  root /usr/share/nginx/html;
  index index.html
  try_files $uri /index.html;
}
 
location /static/lecture {
  root /usr/share/nginx/html;
  index index.html
  try_files $uri /index.html;
}

location /static/experimental/app {
  root /usr/share/nginx/html;
  index index.html
  try_files $uri /index.html;
}
location /static/experimental/lecture {
  root /usr/share/nginx/html;
  index index.html
  try_files $uri /index.html;
}

location /static/oss {
  root /usr/share/nginx/html;
  index attribution.txt
  try_files $uri /attribution.txt;
}

location ~ ^/jupyter/proxy/([^/]+)(/.*)?$ {
  set $proxy_host $1;
  set $proxy_uri $2;

  proxy_set_header Host $proxy_host;
  proxy_ssl_name $proxy_host;
  proxy_ssl_server_name   on;
  proxy_pass https://$proxy_host$proxy_uri;
    
  if ($is_allowed = 0) {
    return 403;
  }

  proxy_cache proxy_jupyter_cache;
  proxy_cache_valid 200 302 10m;
  proxy_cache_valid 404 1m;
  proxy_cache_key $proxy_host$proxy_uri;
  proxy_cache_use_stale error timeout updating;

  if ($request_method = 'OPTIONS') {
    add_header Access-Control-Allow-Origin $http_host;
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
    add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
    add_header Access-Control-Allow-Credentials 'true';
    return 204;
  }

  add_header Access-Control-Allow-Origin $http_host;
  add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
  add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
  add_header Access-Control-Allow-Credentials 'true';

  proxy_set_header Host $proxy_host;
  proxy_set_header X-Real-IP "";
  proxy_set_header X-Forwarded-For 127.0.0.1;
  proxy_set_header X-Forwarded-Proto "";
}

location /jupyter {
  location ~ ^/jupyter/(?!proxy/).*$ {
    root /usr/share/nginx/html;
    index index.html
    try_files $uri /index.html;

    if ($request_method = 'OPTIONS') {
      add_header Access-Control-Allow-Origin $http_host;
      add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
      add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
      add_header Access-Control-Allow-Credentials 'true';
      return 204;
    }

    add_header Access-Control-Allow-Origin $http_host;
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
    add_header Access-Control-Allow-Headers 'Content-Type, Authorization';
    add_header Access-Control-Allow-Credentials 'true';

    location ~* \.(wasm|tar\.gz)$ {
      add_header Cache-Control "public, max-age=2419200, must-revalidate"; 
      expires 4w;
    }
  }
}
 
}