# Nginx rate limits for anifan.az (and mail.anifan.az if same origin)
#
# Install:
#   1. Copy this file to /etc/nginx/conf.d/anifan-rate-limit.conf (or include from site vhost)
#   2. Inside your server { } block, add: include /path/to/anifan-rate-limit-locations.conf;
#   3. nginx -t && systemctl reload nginx
#
# Requires real client IP. If Cloudflare is in front, use $http_cf_connecting_ip instead of
# $binary_remote_addr in limit_req_zone (see zone definitions below).

# --- Option A: direct to origin (no Cloudflare on nginx) ---
limit_req_zone $binary_remote_addr zone=anifan_auth_register:10m rate=3r/m;
limit_req_zone $binary_remote_addr zone=anifan_auth_login:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=anifan_email_resend:10m rate=6r/m;
limit_req_zone $binary_remote_addr zone=anifan_api:10m rate=60r/m;
limit_req_zone $binary_remote_addr zone=anifan_general:10m rate=120r/m;

# --- Option B: behind Cloudflare (recommended) — comment Option A and use this ---
# map $http_cf_connecting_ip $anifan_limit_key {
#     ""      $binary_remote_addr;
#     default $http_cf_connecting_ip;
# }
# limit_req_zone $anifan_limit_key zone=anifan_auth_register:10m rate=3r/m;
# limit_req_zone $anifan_limit_key zone=anifan_auth_login:10m rate=10r/m;
# limit_req_zone $anifan_limit_key zone=anifan_email_resend:10m rate=6r/m;
# limit_req_zone $anifan_limit_key zone=anifan_api:10m rate=60r/m;
# limit_req_zone $anifan_limit_key zone=anifan_general:10m rate=120r/m;

# Return 429 instead of 503 for exceeded limits
limit_req_status 429;