# Include inside HTTPS server{} for public sites.
# Rule: overseas + Shanghai allow; other mainland CN → 403 Chinese notice.
# Requires: systemd wyrs-geo-guard on 127.0.0.1:18099

auth_request /_wyrs_geo_check;
error_page 403 /wyrs-cn-denied.html;

location = /_wyrs_geo_check {
    internal;
    auth_request off;
    proxy_pass http://127.0.0.1:18099/check;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_connect_timeout 100ms;
    proxy_read_timeout 100ms;
}

location = /wyrs-cn-denied.html {
    internal;
    auth_request off;
    default_type text/html;
    charset utf-8;
    alias /var/www/wyrs-geo-deny/index.html;
}