nginx.conf

user nginx nginx;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    include /etc/nginx/conf.d/*; # add any additional/custom server blocks
    map_hash_bucket_size 128;

    resolver 1.1.1.1;
    # resolver 1.1.1.3; # <-- uncomment this and comment out the above to block malware and adult sites

    # ddos protection
    client_body_timeout 10s;
    client_header_timeout 10s;
    proxy_connect_timeout 20s;
    # these are very lenient limits. there should be no reason why a
    # client will request 60 requests per second for a straight 8.33 seconds
    limit_req_zone $binary_remote_addr zone=limitreq:20m rate=30r/s;
    limit_req zone=limitreq burst=500 nodelay;
    limit_req_status 429;
    limit_conn_zone $binary_remote_addr zone=limitconn:20m;
    limit_conn limitconn 10;

    # domain blacklist. blacklisting www.example.com as an example
    map $dest_host $blacklist {
        default 0;
        'www.example.com' 1;
    }
    # blacklist user agents
    # the following is a default list that simply blocks all bots. credit to https://stackoverflow.com/a/24820722
    map $http_user_agent $blacklist_useragent {
        default 0;
        ~*(google|bing|yandex|msnbot) 1;
        ~*(AltaVista|Googlebot|Slurp|BlackWidow|Bot|ChinaClaw|Custo|DISCo|Download|Demon|eCatch|EirGrabber|EmailSiphon|EmailWolf|SuperHTTP|Surfbot|WebWhacker) 1;
        ~*(Express|WebPictures|ExtractorPro|EyeNetIE|FlashGet|GetRight|GetWeb!|Go!Zilla|Go-Ahead-Got-It|GrabNet|Grafula|HMView|Go!Zilla|Go-Ahead-Got-It) 1;
        ~*(rafula|HMView|HTTrack|Stripper|Sucker|Indy|InterGET|Ninja|JetCar|Spider|larbin|LeechFTP|Downloader|tool|Navroad|NearSite|NetAnts|tAkeOut|WWWOFFLE) 1;
        ~*(GrabNet|NetSpider|Vampire|NetZIP|Octopus|Offline|PageGrabber|Foto|pavuk|pcBrowser|RealDownload|ReGet|SiteSnagger|SmartDownload|SuperBot|WebSpider) 1;
        ~*(Teleport|VoidEYE|Collector|WebAuto|WebCopier|WebFetch|WebGo|WebLeacher|WebReaper|WebSauger|eXtractor|Quester|WebStripper|WebZIP|Wget|Widow|Zeus) 1;
        ~*(Twengabot|htmlparser|libwww|Python|perl|urllib|scan|Curl|email|PycURL|Pyth|PyQ|WebCollector|WebCopy|webcraw) 1;
    }
    # set scheme appropriately in case nginx is sitting behind servers like heroku
    map $http_x_forwarded_proto $relativescheme {
        default $http_x_forwarded_proto;
        '' $scheme;
    }
    # set cookie only if / or /index.html
    map $uri $do_set_womginx_cookie {
        '/index.html' 'womginx_are_you_a_bot=no; HttpOnly';
    }

    # websocket headers
    map $http_upgrade $connection_upgrade {
        default Upgrade;
        '' close;
    }

    map '' $proxy_prefix {
        default $relativescheme://$host;
    }

    map $targeturl $dest_host {
        default '';
        ~^https?://([^/]+) $1;
    }
    # remove origin header from websocket url request: wss://dest:12/blah?somestuff?womginx_ws_origin_header=https://example.com
    # convert wss://domain.com to https://domain.com
    map $targeturl $dest_fullwebsocketurl {
        default $targeturl;
        ~^ws(s)?:\/\/(.+)(\?womginx_ws_origin_header=.+)$ http$1://$2;
        ~^ws(s)?://(.+) http$1://$2;
    }
    # get targeturl destination from referrer
    map $http_referer $dest_referrerhost {
        default '';
        ~^https?://[^/]+/main(/[^_/]+_)?/(?<targeturl>https?://[^/]+) $targeturl;
    }
    # use $request_uri for proxy cookie rewriting where there is no $targeturl variable
    map $request_uri $dest_hostwithscheme {
        default '';
        ~^/main(/[^_/]+_)?/(https?://[^/]+) $2;
    }
    # header rewrites
    map $http_referer $rewrite_referer {
        default $http_referer;
        ~^https?://[^/]+/main(/[^_/]+_)?/(?<targeturl>.*) $targeturl;
    }
    # rewrite origin header with destination host. if that doesn't exist, don't rewrite it
    # also, get origin header from websocket request, prioritizing over $http_origin if that exists (see $dest_fullwebsocketurl)
    map $http_origin:womginxseparate:$request_uri $rewrite_origin {
        default $dest_hostwithscheme;
        # origin maybe exists, womginx_ws_origin_header exists
        ~^.+(\?womginx_ws_origin_header=(.+))$ $2;
        # origin and womginx_ws_origin_header doesn't exist
        ~^:womginxseparate: '';
    }
    server {
        server_name womginx.arph.org;

        listen 80;
        listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/womginx.arph.org/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/womginx.arph.org/privkey.pem;

        merge_slashes off;
        proxy_ssl_server_name on;
        error_page 404 = @referrer-handler;

        # reason for putting rewrites here is putting them in parent of nested locations will
        # not apply to child locations
        # use undecoded uri as location for proxying encoded urls
        rewrite ^ $request_uri;
        # convert /main/http://domain.com to /main/http://domain.com/
        # convert /main/http://domain.com?a to /main/http://domain.com/?a
        rewrite ^(/main/https?://[^/?]*)/?(.*) $1/$2;


        #### static file requests handling ####

        # serve static files, disallow access to .git directories, and ignore prefixes starting with /main/
        location ~^((?!/\.git|^/main/).)*$ {
            add_header 'Set-Cookie' $do_set_womginx_cookie;
            alias /home/binary/womginx/public$uri;
            # if no file is found, pass it to @referrer-handler
        }
        location = / {
            if ($dest_referrerhost = '') {
                rewrite ^ /index.html last;
            }
            # if referrer is valid, pass it to @referrer-handler
            return 404;
        }
        # catch links like '/assets.png' and redirect them by their referrer if referrer is valid
        location @referrer-handler {
            # if referrer doesn't exist, send 404 page
            if ($dest_referrerhost = '') {
                return 404;
            }
            # if it exists, send appropriate redirection
            return 302 $proxy_prefix/main/$dest_referrerhost$request_uri;
        }


        #### proxy requests handling ####
        location /main {
            # reason for including all proxy header modifications here is because apparently,
            # using proxy_set_header in a child block automatically negates all parent proxy_set_header
            # directives.
            # disable disabling inline scripts (if proxy sends a content-security-policy like that over)
            proxy_hide_header Content-Security-Policy;
            # force proxy to send non-compressed for sub_filter to work
            proxy_set_header Accept-Encoding 'identity;q=1, *;q=0';
            # prevent proxied servers' HSTS headers from affecting the client
            proxy_hide_header Strict-Transport-Security;
            # enable support for embedding proxy site in an iframe
            proxy_hide_header X-Frame-Options;
            # rewrite referer header
            proxy_set_header Referer $rewrite_referer;
            # rewrite origin header
            proxy_set_header Origin $rewrite_origin;
            # rewrite cookie domain and path
            proxy_cookie_domain ~(.*) $host;
            # rewrite cookie path
            proxy_cookie_path ~(/.*) /main/$dest_hostwithscheme$1;
            # websocket headers
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            # fix "upstream sent too big header/body"
            proxy_buffer_size 16k;
            # proxy_buffer_size + 8k
            proxy_busy_buffers_size 24k;
            # numOfBuffers * bufferSize >= proxy_buffer_size
            proxy_buffers 4 16k; 
            # client can only upload files less than 100M
            client_max_body_size 100M;

            # rewrite relative urls like /main/// to /main/https:// internally without redirect
            location ~^/main(/[^_/]+_)?///(?<protocol_relative_url>.+) {
                rewrite ^/main(/[^_/]+_)?///(?<protocol_relative_url>.+) /main$1/$relativescheme://$protocol_relative_url last;
            }
            # redirect any url with /main/google.com to /main/https://google.com
            location ~^/main(/[^/_]+_)?(?!(/[^/_]+_)?/(http|ws)s?://|//)/(?<rewrite_url_with_scheme>.*) {
                return 302 $proxy_prefix/main$1/$relativescheme://$rewrite_url_with_scheme;
            }
            # handle websocket connections
            location ~^/main/\d*ws_/(?<targeturl>.+){
                proxy_http_version 1.1;
                
                proxy_pass $dest_fullwebsocketurl;
            }
            # serve assets
            location ~^/main/\d*(im|oe)_/(?<targeturl>.+) {
                proxy_pass $targeturl;
            }
            # serve web and service workers. rewrites are done client side
            location ~^/main/\d*(wkr|sw)_/(?<targeturl>.+) {
                proxy_pass $targeturl;
            }
            # rewrite js files
            location ~^/main/\d*js_/(?<targeturl>.+) {
                sub_filter_once off;
                sub_filter_types *;
                sub_filter '.postMessage(' '.__WB_pmw(self.window).postMessage(';
                sub_filter '.postMessage (' '.__WB_pmw(self.window).postMessage (';
                sub_filter 'window.location' 'window.currentLocation';
                proxy_pass $targeturl;
            }
            # redirect any url with /main/unsupportedmod_/blahblah to /main/blahblah
            location ~^/main/[^_/]+_/(?<redirecttargeturl>.+) {
                return 302 $proxy_prefix/main/$redirecttargeturl;
            }
            location ~^/main/(?<targeturl>.*)$ {
                # blacklist urls
                if ($blacklist) {
                    return 403 'Sorry. The owner of this proxy decided to disallow access to this content.';
                }
                # blacklist user agents
                if ($blacklist_useragent) {
                    return 403 'Sorry, you are not allowed to access this content.';
                }
                # deny access to anyone without the special cookie
                if ($cookie_womginx_are_you_a_bot != 'no') {
                    return 403;
                }

                # handle proxy sending redirection requests
                proxy_redirect ~^(https?://.+) $proxy_prefix/main/$1;

                sub_filter_once off;
                # sub_filter_types text/html; already text/html by default but leaving it here for clarity
                # and commenting it out to suppress duplicate warnings


                # wrap href,src,poster,action,srcset,data,codebase links.
                # and add a womginx-processed attribute to the tag to notify client js it is already handled.
                # since we're not using subs_filter module for simplicity of installation, we are going to
                # list every possible combination. However, we only need to do src and script src tags
                # because they cannot be handled by wombat, and for the rest of the attributes, we can
                # let the client handle it for offloading the CPU load to the client and maintaining
                # the integrity of the html document (so we reduce chances of replacing an attribute at a
                # wrong place)

                set $processed_flag_attribute 'womginx-processed';
                # 1. change 'href="//domain/image.png' to 'womginx-processed href="/main/$relativescheme://domain/image.png'
                # for scripts, serve under /main/js_/http://domain.com/script.js to inject wombat code
                sub_filter '<script src="//' '<script $processed_flag_attribute src="/main/js_/$relativescheme://';
                sub_filter '<script type="text/javascript" src="//' '<script type="text/javascript" $processed_flag_attribute src="/main/js_/$relativescheme://';
                sub_filter 'src="//' '$processed_flag_attribute src="/main/$relativescheme://';
                
                # 2. change 'href="/image.png' to 'womginx-processed href="/main/$dest_hostwithscheme/image.png'
                sub_filter '<script src="/' '<script $processed_flag_attribute src="/main/js_/$dest_hostwithscheme/';
                sub_filter '<script type="text/javascript" src="/' '<script type="text/javascript" $processed_flag_attribute src="/main/js_/$dest_hostwithscheme/';
                sub_filter 'src="/' '$processed_flag_attribute src="/main/$dest_hostwithscheme/';

                # 3. change 'href="https://domain.com/image.png"' to 'womginx-processed href="/main/https://domain.com/image.png"'
                sub_filter '<script src="https://' '<script $processed_flag_attribute src="/main/js_/https://';
                sub_filter '<script type="text/javascript" src="https://' '<script type="text/javascript" $processed_flag_attribute src="/main/js_/https://';
                sub_filter 'src="https://' '$processed_flag_attribute src="/main/https://';

                # 4. same as above but with http:// instead of https://
                sub_filter '<script src="http://' '<script $processed_flag_attribute src="/main/js_/http://';
                sub_filter '<script type="text/javascript" src="http://' '<script type="text/javascript" $processed_flag_attribute src="/main/js_/http://';
                sub_filter 'src="http://' '$processed_flag_attribute src="/main/http://';

                # 5. rewrite 'integrity="' to 'nointegrity=' to disable script integrity checking
                sub_filter 'integrity="' 'nointegrity="';

                # 6. disable meta tag's Content-Security-Policy
                sub_filter 'http-equiv="Content-Security-Policy"' 'http-equiv="No-U-Content-Security-Policy"';

                # do the same thing but instead of ", do '
                # 1.
                sub_filter "<script src='//" "<script $processed_flag_attribute src='/main/js_/$relativescheme://";
                sub_filter "<script type='text/javascript' src='//" "<script type='text/javascript' $processed_flag_attribute src='/main/js_/$relativescheme://";
                sub_filter "src='//" "$processed_flag_attribute src='/main/$relativescheme://";
                # 2.
                sub_filter "<script src='/" "<script $processed_flag_attribute src='/main/js_/$dest_hostwithscheme/";
                sub_filter "<script type='text/javascript' src='/" "<script type='text/javascript' $processed_flag_attribute src='/main/js_/$dest_hostwithscheme/";
                sub_filter "src='/" "$processed_flag_attribute src='/main/$dest_hostwithscheme/";
                # 3.
                sub_filter "<script src='https://" "<script $processed_flag_attribute src='/main/js_/https://";
                sub_filter "<script type='text/javascript' src='https://" "<script type='text/javascript' $processed_flag_attribute src='/main/js_/https://";
                sub_filter "src='https://" "$processed_flag_attribute src='/main/https://";
                # 4.
                sub_filter "<script src='http://" "<script $processed_flag_attribute src='/main/js_/http://";
                sub_filter "<script type='text/javascript' src='http://" "<script type='text/javascript' $processed_flag_attribute src='/main/js_/http://";
                sub_filter "src='http://" "$processed_flag_attribute src='/main/http://";
                # 5.
                sub_filter "integrity='" "nointegrity='";
                # 6. disable meta tag's Content-Security-Policy
                sub_filter "http-equiv='Content-Security-Policy'" "http-equiv='No-U-Content-Security-Policy'";


                # insert wombat.js and wombat-handler.js scripts
                sub_filter '<head>' '<head>
    <script $processed_flag_attribute src="/wombat/dist/wombat.js"></script>
    <script $processed_flag_attribute src="/wombat-handler.js" processed-attribute="$processed_flag_attribute">
    </script>';
                proxy_pass $targeturl;
            }
        }
    }
}