# ============================================================
# Bot Protection - http{} context (loaded globally by nginx)
# ============================================================

# Sites blocked for rebuild — return 503 to all requests.
# Cleared 2026-06-23: ordereats.ca is LIVE (serving orders, final landing = 200);
# the stale flag was a dormant landmine that would 503 real customers on any
# nginx include-order/redirect change. Targeted wishlist-attack block remains
# in users/ordereats/block-wishlist-attack.conf.
map $host $site_blocked_for_rebuild {
    default               0;
}

# Rate limiting zones
limit_req_zone $binary_remote_addr zone=general:20m rate=10r/s;
limit_req_zone $binary_remote_addr zone=wordpress:20m rate=5r/s;
limit_req_zone $binary_remote_addr zone=joomla:20m rate=5r/s;
limit_req_zone $binary_remote_addr zone=bots:20m rate=1r/s;
limit_req_zone $binary_remote_addr zone=expensive:20m rate=2r/s;

# Connection limiting
limit_conn_zone $binary_remote_addr zone=addr:20m;

# Bad bot / scanner user-agent map
map $http_user_agent $bad_bot {
    default             0;
    ""                  1;  # no UA = scanner/bot
    ~*SemrushBot        1;
    ~*AhrefsBot         1;
    ~*PetalBot          1;
    ~*MJ12bot           1;
    ~*DotBot            1;
    ~*DataForSeoBot     1;
    ~*BLEXBot           1;
    ~*serpstatbot       1;
    ~*SEOkicks          1;
    ~*Bytespider        1;
    ~*GPTBot            1;
    ~*ClaudeBot         1;
    ~*anthropic-ai      1;
    ~*CCBot             1;
    ~*omgili            1;
    ~*SecurityScanner   1;
    ~*masscan           1;
    ~*zgrab             1;
    ~*nuclei            1;
    ~*nikto             1;
    ~*sqlmap            1;
    ~*nmap              1;
    ~*python-requests   1;
    ~*Python-urllib     1;
    ~*Go-http-client    1;
    ~*libwww-perl       1;
    ~*curl/             1;
    ~*wget/             1;
    ~*HeadlessChrome    1;
    ~*zgrab             1;
    ~*Scrapy            1;
    ~*acunetix          1;
    ~*burpsuite         1;
    ~*nessus            1;
    ~*SERankingBacklinks 1;
    ~*SERanking         1;
    ~*MauiBot           1;
    ~*PaperLiBot        1;
    ~*linkdexbot        1;
    ~*Exabot            1;
    ~*TurnitinBot       1;
    ~*YandexBot         1;
    ~*bingbot           0;  # allow Bing - legitimate
}

# Known scanner/attacker IP blocks
geo $blocked_ip {
    default              0;
    20.203.202.103       1;  # Azure webshell scanner - active NOW
    103.168.67.159       1;  # SecurityScanner credential/shell probing
    151.115.52.19        1;  # aggressive crawler
    185.191.171.0/24     1;  # AhrefsBot aggressive range
    93.123.109.0/24      1;  # SemrushBot range
    85.208.96.0/22       1;  # SemrushBot range
    195.178.110.0/24     1;  # aggressive crawler
    109.107.178.0/24     1;  # aggressive crawler
    159.65.42.165        1;  # aggressive crawler
    102.184.32.0/24      1;  # aggressive crawler
    47.128.0.0/16        1;  # AWS Singapore - bot traffic
}