nginx-site-example.conf

# Copyright (C) 2021  Axel Amigo Arnold

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.

server {
    listen 80;
    server_tokens off;
    server_name _;
    set $bucket_region 'your-bucket-region';
    set $bucket_name 'your-bucket-name';
    set $s3_host $bucket_name.s3.$bucket_region.amazonaws.com;
    access_log /tmp/access.log;
    error_log /tmp/error.log warn;

    # S.U.R: secure_link_expires, uri and remote addr check
    location ~ /sur/ {
        secure_link $arg_md5,$arg_expires;
        # Rename "AM1ghtyS3cr3t!" with a secret of your choice
        secure_link_md5 "$secure_link_expires$uri$remote_addr AM1ghtyS3cr3t!";
        include secret-site.conf;
    }

    # S.U: secure_link_expires and uri check
    location ~ /su/ {
        secure_link $arg_md5,$arg_expires;
        # Rename "AM1ghtyS3cr3t!" with a secret of your choice
        secure_link_md5 "$secure_link_expires$uri AM1ghtyS3cr3t!";
        include secret-site.conf;
    }

    # U.R: URI and remote addr check
    location ~ /ur/ {
        secure_link $arg_md5;
        # Rename "AM1ghtyS3cr3t!" with a secret of your choice
        secure_link_md5 "$uri$remote_addr AM1ghtyS3cr3t!";
        include secret-site.conf;
    }

    # U: URI check
    location ~ /u/ {
        secure_link $arg_md5;
        # Rename "AM1ghtyS3cr3t!" with a secret of your choice
        secure_link_md5 "$uri AM1ghtyS3cr3t!";
        include secret-site.conf;
    }

    error_page 404             /404.html;

    location / {
        internal;
        resolver        127.0.0.1 local=on valid=300s;
        resolver_timeout 10s;

        # Sign AWS request using
        # AWS Signature Version 4
        # https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
        access_by_lua_block {
            require("resty.aws").s3_set_headers(ngx.var.s3_host, ngx.var.uri)
        }
        proxy_http_version     1.1;
        proxy_hide_header      x-amz-id-2;
        proxy_hide_header      x-amz-request-id;
        proxy_hide_header      x-amz-meta-server-side-encryption;
        proxy_hide_header      x-amz-server-side-encryption;
        proxy_hide_header      Set-Cookie;
        proxy_ignore_headers   Set-Cookie;
        proxy_intercept_errors on;
        add_header             Cache-Control max-age=31536000;
        proxy_pass https://$s3_host$uri;
    }

}