vhost.conf

  location ~* ^/convenient_url/(.+)$ {
    internal;

    set $host_name some.secret.cdn.hostname.com;
    set $content_ip 10.11.12.13;
    set $content_url http://$content_ip/$1;

    proxy_set_header Host $host_name;

    add_header Content-Type 'application/octet-stream';
    proxy_hide_header Content-Disposition;
    add_header Content-Disposition 'attachment; filename="$1"';

    proxy_max_temp_file_size 0;
    proxy_pass $content_url;
  }