server {
  listen 8885 default_server;
  location / {
    set $aws_access_key 'xxxxx';
    set $aws_secret_key 'xxxxx';
    set $bucket 'mstdn-xxxxx';
    set $s3_host 'cos.ap-hongkong.myqcloud.com';

    resolver 127.0.0.53 valid=300s;
    resolver_timeout 10s;

    set $rule "$1";

    set $aws_signature '';

    set_by_lua $now "return ngx.cookie_time(ngx.time())";

    set $string_to_sign "$request_method\n\n\n\nx-amz-date:$now\n/$bucket/$rule";

    set_hmac_sha1 $aws_signature $aws_secret_key $string_to_sign;
    set_encode_base64 $aws_signature $aws_signature;
    proxy_set_header x-amz-date $now;
    proxy_set_header Authorization "AWS $aws_access_key:$aws_signature";

    rewrite .* /$rule break;

    proxy_set_header Host $s3_host;
    proxy_pass http://$s3_host/$bucket$uri;

    proxy_hide_header Set-Cookie;
    proxy_hide_header 'Access-Control-Allow-Origin';
    proxy_hide_header 'Access-Control-Allow-Methods';
    proxy_hide_header 'Access-Control-Allow-Headers';
    proxy_hide_header x-amz-id-2;
    proxy_hide_header x-amz-request-id;
    proxy_hide_header x-amz-meta-server-side-encryption;
    proxy_hide_header x-amz-server-side-encryption;
    proxy_hide_header x-amz-bucket-region;
    proxy_hide_header x-amzn-requestid;
    proxy_ignore_headers Set-Cookie;

    proxy_intercept_errors on;
    error_page 404 =404 @fallback404;
    error_page 403 =403 @fallback403;

    proxy_cache CACHE;
    proxy_cache_valid 200 48h;
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    proxy_cache_lock on;

    expires 1y;
    add_header Cache-Control public;
    add_header 'Access-Control-Allow-Origin' '*';
    add_header X-Cache-Status $upstream_cache_status;
  }

  location @fallback404 {
    proxy_pass http://127.0.0.1:8883;
  }

  location @fallback403 {
    proxy_pass http://127.0.0.1:8884;
  }
}