upstream cups-endpoint {
    # in my case I'm using cups inside 
    # a docker container and exposing
    # it's default port 631 as 650
    server 127.0.0.1:650;
}

server {
    #... snippage
    location /app/cups/ {
        proxy_set_header Accept-Encoding "";
        set $subdir app;
        sub_filter 'href="/' 'href="/$subdir/cups/';
        sub_filter 'ACTION="/' 'ACTION="/$subdir/cups/';
        sub_filter 'URL=/' 'URL=/$subdir/cups/';
        sub_filter_once off;

        # you need to request CUPS via https 
        # to do admin functions
        proxy_pass https://cups-endpoint/;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
    }
}