Protect static assets with a rails app

_nginx_protect_static_assets.conf

upstream backend {
    server localhost:3000;
}
server {
    listen 9000;
    server_name localhost;

    root /path_of_rails_app/public;
    try_files $uri/index.html $uri @app;

    location @app {
        proxy_pass http://app;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_redirect off;
    }

    location /private/ {
        root /path_to_protected_resources;
        index index.html;
        auth_request     /auth;
        auth_request_set $auth_status $upstream_status;
        expires -1;
        add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
    }
}

app-controllers-auth_controller.rb

class AuthController < ApplicationController
  before_action :authenticate_user!, only: :index

  # Setup a rails app with devise using a model named User.

  def index
    # add empty view file
  end

  def auth
    status = user_signed_in? ? 200 : 403
    render(status: status, plain: "")
  end
end

config-routes.rb

Rails.application.routes.draw do
  root "auth#index"

  get "/auth", to: "auth#auth"

  devise_for :users
end

links.html.erb

    <% if user_signed_in? %>
      <%= button_to(
        "Log Out",
        destroy_user_session_path,
        method: :delete,
        'data-turbo': false
      ) %>
      <%#= link_to "Logoff", destroy_user_session_path, data: { turbo_method: :delete } %> |
      <%= current_user.email %>

    <% else %>
      <%= link_to "Signup", new_user_registration_path %> |
      <%= link_to "Login", new_user_session_path %>

    <% end %>