Doing weird things with Openresty - is it secure?

I host Nextcloud on my home network. It isn’t the fastest network out there (80/20 on a good day) which makes the website very slow because the browser has to download about 40MB of resources. I was running everything behind the Cloudflare CDN but started facing timeout issues when uploading files using the website (tl;dr Cloudflare has a timeout which uploading large files causes).

My solution was to use a separate domain,, to serve the static resources through the CDN and turn off Cloudflare on the site and pass it straight to the origin.

I assume this is a very unusual way of doing things and I’d like some input on the security aspect of this. Does everything look alright?

I did this on my reverse proxy server. My Nextcloud server’s nginx is configured according to the documentation.

To move the static resources over to I used nginx’s sub_filter to edit the HTML:

sub_filter_once off;
proxy_set_header Accept-Encoding "";
sub_filter_types text/html;
sub_filter 'href="/' 'href="';
sub_filter 'src="/' 'src="';
sub_filter 'content="/' 'content="';

To make CSP happy, I used Openresty’s Lua module to append to the values in the Content-Security-Policy header:

header_filter_by_lua_block {
    local csp = ngx.var.upstream_http_content_security_policy
    if csp then
        csp = csp:gsub("script%-src", "script-src")
        csp = csp:gsub("style%-src", "style-src")
        csp = csp:gsub("img%-src", "img-src")
        csp = csp:gsub("font%-src", "font-src")
        csp = csp:gsub("media%-src", "media-src data:")
        ngx.header["Content-Security-Policy"] = csp

The server is configured like this:

  # ...


  add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;

  # ...

  location ~* ^/(core|apps|js|dist)/(.+)(\?v=[a-f0-9]+)?
    expires 12h;
    add_header Cache-Control "public, max-age=43200";
    proxy_pass https://nxcld_backend;

  location /
    return 404;

  # ...

Is this a brilliant or dumb idea?

in my eyes this is pretty uncommon. most resources should be cached by the browser… in my test the browser downloads far less than 1MB when visiting Nextcloud instance second time… if this is not the case you should review your browser cache settings and if you brake caching somehow (e.g. setting to short cache time)…

is definitely weird… I think it’s easy to break a system doing stuff it was not designed to…