diff --git a/services/clsi/nginx.conf b/services/clsi/nginx.conf
new file mode 100644
index 0000000000..edb2126c44
--- /dev/null
+++ b/services/clsi/nginx.conf
@@ -0,0 +1,75 @@
+# keep in sync with clsi-startup.sh files
+
+server {
+  # Extra header for dev-env.
+  add_header 'X-Served-By' 'clsi-nginx' always;
+
+  listen 8080;
+  server_name clsi-proxy;
+  server_tokens off;
+  access_log off;
+  # Ignore symlinks possibly created by users
+  disable_symlinks on;
+  # enable compression for tex auxiliary files, but not for pdf files
+  gzip on;
+  gzip_types text/plain;
+  gzip_proxied any;
+  types {
+      text/plain log blg aux stdout stderr;
+      application/pdf pdf;
+  }
+  # handle output files for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+    if ($request_method = 'OPTIONS') {
+      # handle OPTIONS method for CORS requests
+      add_header 'Allow' 'GET,HEAD';
+      return 204;
+    }
+    alias /output/$1-$2/generated-files/$3/output.$4;
+  }
+  # handle output files for anonymous users
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z]+)$ {
+    if ($request_method = 'OPTIONS') {
+      # handle OPTIONS method for CORS requests
+      add_header 'Content-Type' 'text/plain charset=UTF-8';
+      add_header 'Allow' 'GET,HEAD';
+      return 200 'GET,HEAD';
+    }
+    alias /output/$1/generated-files/$2/output.$3;
+  }
+
+  # PDF range for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+    if ($request_method = 'OPTIONS') {
+      # handle OPTIONS method for CORS requests
+      add_header 'Content-Type' 'text/plain charset=UTF-8';
+      add_header 'Allow' 'GET,HEAD';
+      return 200 'GET,HEAD';
+    }
+    # Cache for one day
+    expires 1d;
+    alias /output/$1-$2/content/$3;
+  }
+  # PDF range for anonymous users
+  location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+    if ($request_method = 'OPTIONS') {
+      # handle OPTIONS method for CORS requests
+      add_header 'Content-Type' 'text/plain charset=UTF-8';
+      add_header 'Allow' 'GET,HEAD';
+      return 200 'GET,HEAD';
+    }
+    # Cache for one day
+    expires 1d;
+    alias /output/$1/content/$2;
+  }
+
+  # status endpoint for haproxy httpchk option
+  location /status {
+    return 200;
+  }
+
+  # load shedding probe
+  location = /instance-state {
+    alias /var/clsi/instance-state;
+  }
+}