upstream google {
  server fonts.googleapis.com:80;
}

upstream gstatic {
  server fonts.gstatic.com:80;
}
proxy_temp_path  /your/path/tmp 1 2;
proxy_cache_path /your/path/cache levels=1:2 keys_zone=cache1:100m inactive=30d max_size=1g;

server {
  listen 80;
  server_name your.proxy.domain;
  root /your/path/;
  location /css {
    sub_filter 'fonts.gstatic.com' 'your.proxy.domain';
    sub_filter_once off;
    sub_filter_types text/css;
    proxy_pass_header Server;
    proxy_set_header Host fonts.googleapis.com;
    proxy_set_header Accept-Encoding '';
    proxy_redirect off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_pass http://google;
    proxy_cache cache1;
    proxy_cache_key $host$uri$is_args$args;
    proxy_cache_valid 200 304 10m;
    expires 365d;
  }
  location / {
    proxy_pass_header Server;
    proxy_set_header Host fonts.gstatic.com;
    proxy_redirect off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_pass http://gstatic;
    proxy_cache cache1;
    proxy_cache_key $host$uri$is_args$args;
    proxy_cache_valid 200 304 10m;
    expires 365d;
  }
}

server {
  listen 443 ssl http2;

  ssl on;
  ssl_certificate /etc/letsencrypt/live/your.proxy.domain/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/your.proxy.domain/privkey.pem;
  ssl_dhparam /etc/ssl/certs/dhparams.pem;
  ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers HIGH:!aNULL:!MD5;

  server_name your.proxy.domain;
  root /var/sites/fonts/;

  location /css {
    sub_filter 'http://fonts.gstatic.com' 'https://your.proxy.domain';
    sub_filter_once off;
    sub_filter_types text/css;
    proxy_pass_header Server;
    proxy_set_header Host fonts.googleapis.com;
    proxy_set_header Accept-Encoding '';
    proxy_redirect off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_pass http://google;
    proxy_cache cache1;
    proxy_cache_key $host$uri$is_args$args;
    proxy_cache_valid 200 304 10m;
    expires 365d;
  }

  location / {
    proxy_pass_header Server;
    proxy_set_header Host fonts.gstatic.com;
    proxy_redirect off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_pass http://gstatic;
    proxy_cache cache1;
    proxy_cache_key $host$uri$is_args$args;
    proxy_cache_valid 200 304 10m;
    expires 365d;
  }
}

valid_referers server_name *.your.domain.com *.other.domain.com;
if ($invalid_referer) {
  return 403;
}