to enable use flag `-otel true`
env vars:
`OTEL_EXPORTER_OTLP_ENDPOINT` to set exporter endpoint
`OTEL_EXPORTER_OTLP_SECURE` set to `true` or `1` or else if you use TLS on your `otel` ingress. (Default insecure.)
`GO_GORILLA_SERVICE_NAME` the service name used to display traces

User ==(https)> GlobalLB with IAP enabled ==(http)> CloudRun GCS-proxy ==(https)> GCS Private bucket

 +---------------------------------------+
 |                Nginx                  |
 |    access control (basic auth/ip)     |
 +-----+---------------------------------+
       |
-----------------------------------------+
       |
       |
+------v-----+          +---------------+
|            |          |               |
|  gcsproxy  | +------> | Google Cloud  |
|            |          |    Storage    |
+------------+          +---------------+

Usage of gcsproxy:
  -b string
     Bind address. (default "127.0.0.1:8080")
  -c string
     The path to the keyfile. If not present, client will use your default application credentials.
  -i string
     Index page file name.
  -dn Use hostname as a bucket name.
  -otel bool
     Enable opentelemetry. (default false)
  -r Redirect to index.html if 404 not found.
  -s string
     Use SA key from secretManager. E.G. 'projects/937121755211/secrets/gcs-proxy/versions/1'
  -v Show access log.

[Unit]
Description=gcsproxy

[Service]
Type=simple
ExecStart=/opt/gcsproxy/gcsproxy -v
ExecStop=/bin/kill -SIGTERM $MAINPID

[Install]
WantedBy = multi-user.target

upstream gcsproxy {
    server '127.0.0.1:8080';
}

server {
    listen 8081;
    server_name _;

    # Logs
    access_log off;
    error_log /var/log/nginx/gcsproxy.error.log error;

    if ($request_method !~ "GET|HEAD|PURGE") {
        return 405;
    }

    location / {
        proxy_pass http://gcsproxy$uri;
    }
}