Cache successful Blossom responses

Cache returned files from Blossom on the Nginx hosts, until either
deleted by the user or hitting the global cache size limit (1 GB)

site-cookbooks/kosmos_blossom/attributes/default.rb

@@ -1 +1,3 @@
 # No attributes here, use the blossom cookbook's attributes
+
+node.default['blossom']['nginx_cache_max_size'] = '1g'

site-cookbooks/kosmos_blossom/recipes/nginx.rb

@@ -23,6 +23,7 @@ openresty_site domain do
             upstream_host: blossom_node['knife_zero']['host'],
             upstream_port: node['blossom']['port'],
             max_size_mb: node['blossom']['max_size'] / 1024 / 1024,
+            cache_max_size: node['blossom']['nginx_cache_max_size'],
             ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
             ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
 end

site-cookbooks/kosmos_blossom/templates/default/nginx_conf_blossom.erb

@@ -2,12 +2,16 @@ upstream _blossom {
   server <%= @upstream_host %>:<%= @upstream_port %>;
 }
 
+proxy_cache_path <%= node['openresty']['cache_dir'] %>/blossom
+                 keys_zone=blossom_cache:10m
+                 max_size=<%= @cache_max_size %> inactive=100y use_temp_path=off;
+
 server {
   server_name <%= @domain %>;
   listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
   listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
 
-  access_log "/var/log/nginx/<%= @domain %>.access.log";
+  access_log "/var/log/nginx/<%= @domain %>.access.log" json;
   error_log "/var/log/nginx/<%= @domain %>.error.log";
 
   client_max_body_size <%= @max_size_mb %>M;
@@ -15,6 +19,27 @@ server {
   ssl_certificate <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
+  location ~ ^/(?<sha256>[a-f0-9]{64})(\.[a-zA-Z0-9]+)?$ {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_pass http://_blossom;
+    proxy_http_version 1.1;
+
+    proxy_cache blossom_cache;
+    proxy_cache_key $sha256;
+    proxy_cache_valid 200 1y;
+    proxy_cache_lock on;
+    proxy_cache_use_stale error timeout updating;
+
+    log_by_lua_block {
+      if ngx.var.request_method == "DELETE" and ngx.status >= 200 and ngx.status < 300 then
+        os.remove("<%= node['openresty']['cache_dir'] %>/blossom/" .. ngx.md5(ngx.var.sha256))
+      end
+    }
+  }
+
   location / {
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;