diff --git a/server-ce/Dockerfile b/server-ce/Dockerfile
index 8361b7a8ea..ff8aabd9a6 100644
--- a/server-ce/Dockerfile
+++ b/server-ce/Dockerfile
@@ -38,6 +38,7 @@ ADD server-ce/runit /etc/service
 # ---------------
 ADD server-ce/nginx/nginx.conf.template /etc/nginx/templates/nginx.conf.template
 ADD server-ce/nginx/sharelatex.conf /etc/nginx/sites-enabled/sharelatex.conf
+ADD server-ce/nginx/clsi-nginx.conf /etc/nginx/sites-enabled/clsi-nginx.conf
 
 
 # Configure log rotation
diff --git a/server-ce/nginx/clsi-nginx.conf b/server-ce/nginx/clsi-nginx.conf
new file mode 100644
index 0000000000..fa546a16d8
--- /dev/null
+++ b/server-ce/nginx/clsi-nginx.conf
@@ -0,0 +1,53 @@
+# keep in sync with clsi-startup.sh files
+# keep in sync with clsi/nginx.conf
+# Changes to the above:
+#  - added debug header
+#  - remove CORS rules, Server-CE/Server-Pro runs behind a single origin
+#  - change /output path to /var/lib/sharelatex/data/output
+
+server {
+  # Extra header for debugging.
+  add_header 'X-Served-By' 'clsi-nginx' always;
+
+  # Security-Headers
+  add_header 'X-Content-Type-Options' 'nosniff' always;
+  add_header 'X-Download-Options' 'noopen' always;
+  add_header 'X-Frame-Options' 'SAMEORIGIN' always;
+  add_header 'X-XSS-Protection' '1; mode=block' always;
+
+  listen 8080;
+  server_name clsi-nginx;
+  server_tokens off;
+  access_log off;
+  # Ignore symlinks possibly created by users
+  disable_symlinks on;
+  # enable compression for tex auxiliary files, but not for pdf files
+  gzip on;
+  gzip_types text/plain;
+  gzip_proxied any;
+  types {
+      text/plain log blg aux stdout stderr;
+      application/pdf pdf;
+  }
+  # handle output files for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+    alias /var/lib/sharelatex/data/output/$1-$2/generated-files/$3/output.$4;
+  }
+  # handle output files for anonymous users
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+    alias /var/lib/sharelatex/data/output/$1/generated-files/$2/output.$3;
+  }
+
+  # PDF range for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+    # Cache for one day
+    expires 1d;
+    alias /var/lib/sharelatex/data/output/$1-$2/content/$3;
+  }
+  # PDF range for anonymous users
+  location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+    # Cache for one day
+    expires 1d;
+    alias /var/lib/sharelatex/data/output/$1/content/$2;
+  }
+}
diff --git a/server-ce/nginx/nginx.conf.template b/server-ce/nginx/nginx.conf.template
index e3cf283e85..663ca21c81 100644
--- a/server-ce/nginx/nginx.conf.template
+++ b/server-ce/nginx/nginx.conf.template
@@ -44,6 +44,7 @@ http {
 
 	gzip on;
 	gzip_disable "msie6";
+	gzip_proxied any; # allow upstream server to compress.
 
 	client_max_body_size 50m;
 
diff --git a/server-ce/nginx/sharelatex.conf b/server-ce/nginx/sharelatex.conf
index 4da8fb25ee..94db444b0a 100644
--- a/server-ce/nginx/sharelatex.conf
+++ b/server-ce/nginx/sharelatex.conf
@@ -40,4 +40,25 @@ server {
 	location /img {
 		expires 1y;
 	}
+
+  # handle output files for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+  # handle output files for anonymous users
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+  # PDF range for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+  # PDF range for anonymous users
+  location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
 }
diff --git a/services/clsi/nginx.conf b/services/clsi/nginx.conf
index edb2126c44..60320a1099 100644
--- a/services/clsi/nginx.conf
+++ b/services/clsi/nginx.conf
@@ -1,4 +1,7 @@
 # keep in sync with clsi-startup.sh files
+# keep in sync with server-ce/nginx/clsi-nginx.conf
+# Changes to the above:
+#  - added debug header
 
 server {
   # Extra header for dev-env.
diff --git a/services/web/frontend/js/features/pdf-preview/components/pdf-file-list.js b/services/web/frontend/js/features/pdf-preview/components/pdf-file-list.js
index e039e2f4e9..7e2764e769 100644
--- a/services/web/frontend/js/features/pdf-preview/components/pdf-file-list.js
+++ b/services/web/frontend/js/features/pdf-preview/components/pdf-file-list.js
@@ -10,12 +10,16 @@ function PdfFileList({ fileList }) {
     return null
   }
 
+  function basename(file) {
+    return file.path.split('/').pop()
+  }
+
   return (
     <>
       <MenuItem header>{t('other_output_files')}</MenuItem>
 
       {fileList.top.map(file => (
-        <MenuItem download href={file.url} key={file.path}>
+        <MenuItem download={basename(file)} href={file.url} key={file.path}>
           <b>{file.path}</b>
         </MenuItem>
       ))}
@@ -25,7 +29,7 @@ function PdfFileList({ fileList }) {
       )}
 
       {fileList.other.map(file => (
-        <MenuItem download href={file.url} key={file.path}>
+        <MenuItem download={basename(file)} href={file.url} key={file.path}>
           <b>{file.path}</b>
         </MenuItem>
       ))}