<commit_before>map $uri $nominatim_script_name {
    ~^(.+?\.php)         $1;
    ~^/([^/]+)           $1.php;
    ^$                   search.php;
}

map $uri $nominatim_path_info {
    ~^/([^/]+)(.*)$      $2;
}

map $query_string $email_id {
    ~(^|&)email=([^&]+)  $2;
}

upstream nominatim_service {
  server 127.0.0.1:<%= @pools[:www][:port ]%>;
}

# Whitelisted IPs
geo $limit {
    default 1;
    fc00:db20:35b:7399::5:6 0;
    fc00:db20:35b:7399::5:7 0;
    fc00:db20:35b:7399::5:8 0;
    fc00:db20:35b:7399::5:b 0;
    fc00:db20:35b:7399::5:c 0;
    fc00:db20:35b:7399::5:d 0;
    172.16.17.32 0;
    192.168.127.12 0;
    192.168.3.11 0;
    192.168.3.11 0;
    172.16.58.3 0;
    192.168.3.11 0;
    192.168.3.11 0;
    172.16.17.32 0;
    192.168.127.12 0; # gnome
}

map $http_user_agent $blocked_user_agent {
   default 0;
   include <%= @confdir %>/nginx_blocked_user_agent.conf;
}

map $http_referer $blocked_referrer {
   default 0;
   include <%= @confdir %>/nginx_blocked_referrer.conf;
}

map $limit $limit_key {
    0 "";
    1 $binary_remote_addr;
}

map $blocked_user_agent $limit_tarpit {
    0 "";
    1 $binary_remote_addr;
    2 $binary_remote_addr;
}

limit_req_zone $limit zone=www:50m rate=2r/s;
limit_req_zone $limit_tarpit zone=tarpit:10m rate=1r/s;
limit_req_zone $binary_remote_addr zone=blocked:10m rate=20r/m;

server {
    # IPv4
    listen       80 deferred backlog=16384 reuseport fastopen=2048 default_server;
    listen       443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
    # IPv6
    listen       [::]:80 deferred backlog=16384 reuseport fastopen=2048 default_server;
    listen       [::]:443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
    server_name  localhost;

    ssl_certificate /etc/ssl/certs/<%= node[:fqdn] %>.pem;
    ssl_certificate_key /etc/ssl/private/<%= node[:fqdn] %>.key;

    root <%= @directory %>/website;<commit_msg>nominatim: fix limit key for request limiting<commit_after>map $uri $nominatim_script_name {
    ~^(.+?\.php)         $1;
    ~^/([^/]+)           $1.php;
    ^$                   search.php;
}

map $uri $nominatim_path_info {
    ~^/([^/]+)(.*)$      $2;
}

map $query_string $email_id {
    ~(^|&)email=([^&]+)  $2;
}

upstream nominatim_service {
  server 127.0.0.1:<%= @pools[:www][:port ]%>;
}

# Whitelisted IPs
geo $whitelisted {
    default 0;
    fc00:db20:35b:7399::5:6 1;
    2fdf8:f53e:61e4::18:7 1;
    2fdf8:f53e:61e4::18:8 1;
    20fd00:c2b6:b24b:be67:2827:688d:e6a1:6a3b:b 1;
    20fd00:c2b6:b24b:be67:2827:688d:e6a1:6a3b:c 1;
    2fdf8:f53e:61e4::18:d 1;
    172.16.17.32 1;
    192.168.127.12 1;
    192.168.3.11 1;
    192.168.3.11 1;
    172.16.58.3 1;
    192.168.3.11 1;
    192.168.3.11 1;
    172.16.17.32 1;
    192.168.127.12 1; # gnome
}

map $http_user_agent $blocked_user_agent {
   default 0;
   include <%= @confdir %>/nginx_blocked_user_agent.conf;
}

map $http_referer $blocked_referrer {
   default 0;
   include <%= @confdir %>/nginx_blocked_referrer.conf;
}

map $whitelisted $limit_www {
    1 "";
    0 $binary_remote_addr;
}

map $blocked_user_agent $limit_tarpit {
    0 "";
    1 $binary_remote_addr;
    2 $binary_remote_addr;
}

limit_req_zone $limit_www zone=www:50m rate=2r/s;
limit_req_zone $limit_tarpit zone=tarpit:10m rate=1r/s;
limit_req_zone $binary_remote_addr zone=blocked:10m rate=20r/m;

server {
    # IPv4
    listen       80 deferred backlog=16384 reuseport fastopen=2048 default_server;
    listen       443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
    # IPv6
    listen       [::]:80 deferred backlog=16384 reuseport fastopen=2048 default_server;
    listen       [::]:443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
    server_name  localhost;

    ssl_certificate /etc/ssl/certs/<%= node[:fqdn] %>.pem;
    ssl_certificate_key /etc/ssl/private/<%= node[:fqdn] %>.key;

    root <%= @directory %>/website;
{'fraction_non_alphanumeric': 0.15508559919436052, 'fraction_numerical': 0.12739174219536759, 'mean_word_length': 3.1602094240837695, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 20, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4931482', 'n_tokens_mistral': 2017, 'n_tokens_neox': 1690, 'n_words': 301}