From f6f0d5b22d6943195f54a5ab9a59e7da46b17cda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Sun, 16 Aug 2026 11:50:56 -0600
Subject: [PATCH] Cache successful Blossom responses

Cache returned files from Blossom on the Nginx hosts, until either
deleted by the user or hitting the global cache size limit (1 GB)
---
 .../kosmos_blossom/attributes/default.rb      |  2 ++
 .../kosmos_blossom/recipes/nginx.rb           |  1 +
 .../templates/default/nginx_conf_blossom.erb  | 27 ++++++++++++++++++-
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/site-cookbooks/kosmos_blossom/attributes/default.rb b/site-cookbooks/kosmos_blossom/attributes/default.rb
index b37838e..58e970d 100644
--- a/site-cookbooks/kosmos_blossom/attributes/default.rb
+++ b/site-cookbooks/kosmos_blossom/attributes/default.rb
@@ -1 +1,3 @@
 # No attributes here, use the blossom cookbook's attributes
+
+node.default['blossom']['nginx_cache_max_size'] = '1g'
diff --git a/site-cookbooks/kosmos_blossom/recipes/nginx.rb b/site-cookbooks/kosmos_blossom/recipes/nginx.rb
index 85c83c1..ef4cbd1 100644
--- a/site-cookbooks/kosmos_blossom/recipes/nginx.rb
+++ b/site-cookbooks/kosmos_blossom/recipes/nginx.rb
@@ -23,6 +23,7 @@ openresty_site domain do
             upstream_host: blossom_node['knife_zero']['host'],
             upstream_port: node['blossom']['port'],
             max_size_mb: node['blossom']['max_size'] / 1024 / 1024,
+            cache_max_size: node['blossom']['nginx_cache_max_size'],
             ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
             ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
 end
diff --git a/site-cookbooks/kosmos_blossom/templates/default/nginx_conf_blossom.erb b/site-cookbooks/kosmos_blossom/templates/default/nginx_conf_blossom.erb
index d76af4c..4631e73 100644
--- a/site-cookbooks/kosmos_blossom/templates/default/nginx_conf_blossom.erb
+++ b/site-cookbooks/kosmos_blossom/templates/default/nginx_conf_blossom.erb
@@ -2,12 +2,16 @@ upstream _blossom {
   server <%= @upstream_host %>:<%= @upstream_port %>;
 }
 
+proxy_cache_path <%= node['openresty']['cache_dir'] %>/blossom
+                 keys_zone=blossom_cache:10m
+                 max_size=<%= @cache_max_size %> inactive=100y use_temp_path=off;
+
 server {
   server_name <%= @domain %>;
   listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
   listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
 
-  access_log "/var/log/nginx/<%= @domain %>.access.log";
+  access_log "/var/log/nginx/<%= @domain %>.access.log" json;
   error_log "/var/log/nginx/<%= @domain %>.error.log";
 
   client_max_body_size <%= @max_size_mb %>M;
@@ -15,6 +19,27 @@ server {
   ssl_certificate <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
+  location ~ "^/(?<sha256>[a-f0-9]{64})(\.[a-zA-Z0-9]+)?$" {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_pass http://_blossom;
+    proxy_http_version 1.1;
+
+    proxy_cache blossom_cache;
+    proxy_cache_key $sha256;
+    proxy_cache_valid 200 1y;
+    proxy_cache_lock on;
+    proxy_cache_use_stale error timeout updating;
+
+    log_by_lua_block {
+      if ngx.var.request_method == "DELETE" and ngx.status >= 200 and ngx.status < 300 then
+        os.remove("<%= node['openresty']['cache_dir'] %>/blossom/" .. ngx.md5(ngx.var.sha256))
+      end
+    }
+  }
+
   location / {
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;