nginx.conf

# Grab the entire querystring as a capture group.
location ~ ^/{{ PROJECT_SLUG }}/cloudsearch/(.*)$ {
    access_log /var/log/playgrounds2-cloudsearch.log;
    proxy_intercept_errors on;
    error_page 507 = @error;

    # If you're anything but a GET, you get a 403.
    if ($request_method != GET ) {
        return 403;
    }

    # Capture the group from above as a variable so we don't lose it
    # when we do more capture groups below.
    set $fakepath $1;

    # Set the resolver so we can proxy_pass to a domain.
    resolver 8.8.8.8;

    # This is the stupid part.
    # Parse the $args variable for 'callback'.
    # $1 will be all things up to the callback param.
    # $2 will be everything after.
    # The callback should be at the end of the URL.
    if ($args ~ (.*)callback=[^&]*(.*)){

        # Wrap the result with the callback.
        echo_before_body "$arg_callback(";

        # Proxy pass to AWS with the rest of the path appended.
        proxy_pass http://{{ CLOUD_SEARCH_DOMAIN }}/$fakepath$is_args$1;

        # Wrap the end with the callback.
        echo_after_body ");";
    }
}

location @error {
    access_log /var/log/playgrounds2-cloudsearch.log;
    return 202 "$arg_callback({ \"error\": \"507\" });";
}

location ~ ^/{{ PROJECT_SLUG }}/ {
    uwsgi_pass unix:///tmp/{{ PROJECT_SLUG }}.sock;
    include /etc/nginx/uwsgi_params;
}