location ~ ^/github/penpot-files/(.+)$ {
    rewrite ^/github/penpot-files/(.+) /penpot/penpot-files/refs/heads/main/$1 break;
    proxy_pass https://raw.githubusercontent.com;

    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Cookies;
    proxy_set_header User-Agent "curl/8.5.0";
    proxy_set_header Host "raw.githubusercontent.com";
    proxy_set_header Accept "*/*";
    # A third-party upstream must not dictate the security policy of our own
    # origin: browsers enforce the intersection of every Content-Security-Policy
    # they receive, and any Strict-Transport-Security lands on this host.
    proxy_hide_header Strict-Transport-Security;
    proxy_hide_header Content-Security-Policy;
    proxy_hide_header Content-Security-Policy-Report-Only;

    include /etc/nginx/nginx-security-headers.conf;
    add_header Access-Control-Allow-Origin $http_origin;
    proxy_buffering off;
}

location ~ ^/internal/gfonts/font/(?<font_file>.+) {
    proxy_pass https://fonts.gstatic.com/s/$font_file;

    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Cross-Origin-Resource-Policy;
    proxy_hide_header Link;
    proxy_hide_header Alt-Svc;
    proxy_hide_header Cache-Control;
    proxy_hide_header Expires;
    proxy_hide_header Cross-Origin-Opener-Policy;
    proxy_hide_header Report-To;

    proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;

    proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
    proxy_set_header Host "fonts.gstatic.com";
    proxy_set_header Accept "*/*";

    proxy_cache penpot;

    # A third-party upstream must not dictate the security policy of our own
    # origin: browsers enforce the intersection of every Content-Security-Policy
    # they receive, and any Strict-Transport-Security lands on this host.
    proxy_hide_header Strict-Transport-Security;
    proxy_hide_header Content-Security-Policy;
    proxy_hide_header Content-Security-Policy-Report-Only;

    include /etc/nginx/nginx-security-headers.conf;
    add_header Access-Control-Allow-Origin $http_origin;
    add_header Cache-Control max-age=86400;
    add_header X-Cache-Status $upstream_cache_status;
}

location ~ ^/internal/gfonts/css {
    proxy_pass https://fonts.googleapis.com/css?$args;
    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Cross-Origin-Resource-Policy;
    proxy_hide_header Link;
    proxy_hide_header Alt-Svc;
    proxy_hide_header Cache-Control;
    proxy_hide_header Expires;

    proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;

    proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
    proxy_set_header Host "fonts.googleapis.com";
    proxy_set_header Accept "*/*";

    proxy_cache penpot;

    # A third-party upstream must not dictate the security policy of our own
    # origin: browsers enforce the intersection of every Content-Security-Policy
    # they receive, and any Strict-Transport-Security lands on this host.
    proxy_hide_header Strict-Transport-Security;
    proxy_hide_header Content-Security-Policy;
    proxy_hide_header Content-Security-Policy-Report-Only;

    include /etc/nginx/nginx-security-headers.conf;
    add_header Access-Control-Allow-Origin $http_origin;
    add_header Cache-Control max-age=86400;
    add_header X-Cache-Status $upstream_cache_status;
}