Reverse proxy

https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live/

const ORIGIN_BASE = "https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live";
const PROXY_PATH = "/local-guides";

/**
 * Whether this request belongs to the Obvlo mount rather than to the rest of the site.
 *
 * The route this Worker is bound to has to end in `*`, because Cloudflare matches a route pattern
 * against the whole URL including the query string — without the wildcard, `/local-guides?utm_source=x`
 * never reaches the Worker at all. That same wildcard also matches `/local-guides-elsewhere`, which is
 * not the mount, so the boundary is checked here where it can be exact rather than left to a route
 * pattern that cannot express it. An empty PROXY_PATH is a whole-host mount, where every path is ours.
 */
function isMounted(pathname) {
  if (PROXY_PATH === "") return true;
  return pathname === PROXY_PATH || pathname.startsWith(PROXY_PATH + "/");
}

/** Move a root-relative URL inside the mount, so an absolute asset path still resolves. */
function mounted(value) {
  return value.startsWith("/") && !value.startsWith("//") ? PROXY_PATH + value : value;
}

export default {
  async fetch(request) {
    const url = new URL(request.url);

    if (!isMounted(url.pathname)) {
      return fetch(request);
    }

    // Sliced rather than replaced: the prefix is known to be at the front, and a `replace` would also
    // rewrite a later occurrence of the same string inside a page slug.
    const targetPath = url.pathname.slice(PROXY_PATH.length) || "/";
    const originUrl = `${ORIGIN_BASE}${targetPath}${url.search}`;

    const headers = new Headers(request.headers);
    headers.set("Host", "sites.obvlo.com");
    headers.set("X-Forwarded-Host", url.hostname);
    headers.set("X-Forwarded-Proto", "https");

    try {
      const response = await fetch(originUrl, {
        method: request.method,
        headers,
        body: request.body,
        redirect: "follow",
      });

      // Re-instantiated so the headers are mutable, before either branch below returns it.
      const proxied = new Response(response.body, response);
      proxied.headers.delete("x-served-by");
      proxied.headers.delete("x-cache");
      proxied.headers.delete("x-cache-hit");
      proxied.headers.delete("x-cloud-trace-context");

      const contentType = proxied.headers.get("Content-Type") || "";
      if (!contentType.includes("text/html")) {
        return proxied;
      }

      return new HTMLRewriter()
        .on("link, script, img, source, a", {
          element(element) {
            for (const attribute of ["href", "src"]) {
              const value = element.getAttribute(attribute);
              if (value !== null) element.setAttribute(attribute, mounted(value));
            }

            // `srcset` is a comma-separated candidate list, so each URL in it is moved on its own.
            // Prefixing the attribute whole rewrites the first candidate and corrupts every other.
            const srcset = element.getAttribute("srcset");
            if (srcset !== null) {
              const candidates = srcset.split(",").map((candidate) => {
                const parts = candidate.trim().split(/\s+/);
                parts[0] = mounted(parts[0]);
                return parts.join(" ");
              });
              element.setAttribute("srcset", candidates.join(", "));
            }
          },
        })
        .transform(proxied);
    } catch (err) {
      return new Response(`Proxy error: ${err.message}`, { status: 502 });
    }
  },
};

server {
    listen 443 ssl;
    server_name customer-domain.com;

    ssl_certificate /etc/nginx/ssl/customer-domain.com.crt;
    ssl_certificate_key /etc/nginx/ssl/customer-domain.com.key;

    location /local-guides/ {
        proxy_pass https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live/;
        proxy_set_header Host sites.obvlo.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_redirect off;

        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

<VirtualHost *:443>
    ServerName customer-domain.com
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key

    ProxyPass "/local-guides/" "https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live/"
    ProxyPassReverse "/local-guides/" "https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live/"

    ProxyPreserveHost Off
    RequestHeader set Host "sites.obvlo.com"
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Host "customer-domain.com"
</VirtualHost>

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="ObvloProxy" stopProcessing="true">
          <match url="^local-guides/?(.*)$" />
          <action type="Rewrite"
            url="https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live/{R:1}" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

customer-domain.com {
    reverse_proxy /local-guides/* https://sites.obvlo.com/live/orgs/{orgId}/sites/{siteId}/live/ {
        header_up Host sites.obvlo.com
        header_up X-Forwarded-Host {host}
    }
}