my_site_nginx.conf

upstream backend {
    server 127.0.0.1:5000;
}
 
server {
    listen 80;
    server_name my_site.localhost.com;
    set $static /home/taar/git/MySite/my_site/admin/static;
    root $static;
    keepalive_timeout 60;
 
    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Sendfile-Type X-Accel-Redirect;
        proxy_set_header X-Accel-Mapping /home/taar/uploads/my_site/images/=/protected_image;
        proxy_redirect off;
        proxy_pass https://backend;
    }
 
    location /static {
        alias $static;
        expires 30d;
    }
 
    location /protected_image {
        internal;
        alias /home/taar/uploads/my_site/images/;
    }
}

views.py

@bpm.route("/image/static/<tool_tag>/<path:filename>", methods=["GET"])
@login_required
def static_image(tool_tag, filename):
    prefix = request.headers['X-Accel-Mapping'].split("=")[-1]
    url = join(prefix, safe_join(tool_tag, filename))
    return Response(
        status=200,
        headers={'X-Accel-Redirect': url},
        content_type="application/octet-stream"
    )