On AWS, a CloudFront distribution for acme.com routes the /docs* path to
a NookDocs origin, and a CloudFront Function tags requests with the headers
we need. See Host at a subpath for the overall model.
1. Add the NookDocs origin
In your CloudFront distribution → Origins → Create origin:
| Field | Value |
| Origin domain | acme.nookdocs.site (your project subdomain) |
| Protocol | HTTPS only |
| Origin path | (leave empty — the /docs path is kept) |
2. Add a behavior for /docs*
Behaviors → Create behavior:
| Field | Value |
| Path pattern | /docs* |
| Origin | the NookDocs origin above |
| Viewer protocol policy | Redirect HTTP to HTTPS |
| Allowed methods | GET, HEAD (+ OPTIONS) |
| Cache policy | CachingDisabled (or a short TTL) |
| Origin request policy | AllViewer (forward host + headers) |
This makes CloudFront send acme.com/docs/* to NookDocs while everything else
keeps hitting your default origin.
3. Tag requests with a CloudFront Function
Functions → Create function (viewer request), attach it to the /docs*
behavior:
function handler(event) {
var request = event.request;
request.headers["x-nookdocs-host"] = { value: "acme.com" };
request.headers["x-nookdocs-base-path"] = { value: "/docs" };
return request;
}The dashboard shows this function pre-filled — Settings → Domains → Show proxy setup.
4. Route 53
Point acme.com (A/AAAA alias) at the CloudFront distribution as usual. No
record points at NookDocs directly — CloudFront fronts everything.
Verify
curl -sI https://acme.com/docs | grep -i content-type
curl -s https://acme.com/docs/llms.txt | head -1Notes
Use CachingDisabled (or low TTL) on the
/docs*behavior so doc edits appear quickly; NookDocs already sends sensible cache headers.Sending a CSP via CloudFront response headers? See CSP.