limit_req_zone $server_name zone=radicle_api:150m rate=50r/s;
limit_req_zone $binary_remote_addr zone=radicle_raw:150m rate=50r/s;
proxy_cache_path /data/cache levels=1:2 keys_zone=rad_cache_zone_01:100m max_size=50g 
                 inactive=1440m use_temp_path=off;

upstream radicle {
	server 172.16.1.78:8080;
}

server {
	listen       80;
	#listen [::]:80;
	server_name rad.hardenedbsd.org;
	#lingering_time 360s;
	#lingering_timeout 280s;
	proxy_buffering on;
	http2 on;

	include /usr/local/etc/nginx/common.conf;
		proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
		proxy_cache_revalidate on;
		proxy_cache_background_update on;
		proxy_cache_lock on;
		add_header X-Cache-Status $upstream_cache_status;
		proxy_cache rad_cache_zone_01;
		proxy_ignore_headers Cache-Control;
		proxy_cache_valid any 1440m;

	if ($http_user_agent ~* "ExaSearchBot|crawler|SemrushBot|Semrush|AhrefsBot|MJ12bot|YandexBot|YandexImages|MegaIndex.ru|BLEXbot|BLEXBot|ZoominfoBot|YaK|VelenPublicWebCrawler|SentiBot|Vagabondo|SEOkicks|SEOkicks-Robot|mtbot/1.1.0i|SeznamBot|DotBot|Cliqzbot|coccocbot|python|Scrap|SiteCheck-sitecrawl|MauiBot|Java|GumGum|Clickagy|AspiegelBot|Yandex|TkBot|CCBot|Qwantify|MBCrawler|serpstatbot|AwarioSmartBot|Semantici|ScholarBot|proximic|MojeekBot|GrapeshotCrawler|IAScrawler|linkdexbot|contxbot|PlurkBot|PaperLiBot|BomboraBot|Leikibot|weborama-fetcher|NTENTbot|Screaming Frog SEO Spider|admantx-usaspb|Eyeotabot|VoluumDSP-content-bot|SirdataBot|adbeat_bot|TTD-Content|admantx|Nimbostratus-Bot|Mail.RU_Bot|Quantcastboti|Onespot-ScraperBot|Taboolabot|Baidu|Jobboerse|VoilaBot|Sogou|Jyxobot|Exabot|ZGrab|Proximi|Sosospider|Accoona|aiHitBot|Genieo|BecomeBot|ConveraCrawler|NerdyBot|OutclicksBot|findlinks|JikeSpider|Gigabot|CatchBot|Huaweisymantecspider|Offline Explorer|SiteSnagger|TeleportPro|WebCopier|WebReaper|WebStripper|WebZIP|Xaldon_WebSpider|BackDoorBot|AITCSRoboti|Arachnophilia|BackRub|BlowFishi|CherryPicker|CyberSpyder|EmailCollector|Foobot|GetURL|httplib|HTTrack|LinkScan|Openbot|Snooper|SuperBot|URLSpiderPro|MAZBot|EchoboxBot|SerendeputyBot|LivelapBot|linkfluence.com|TweetmemeBot|LinkisBot|CrowdTanglebot|openai\.com|GPTBot|gptbot|claudebot|PetalBot|BugBountyRecon")
	{
		return 403;
	}


	location ~ ^/api/v1/repos/.*/stats {
		return 403;
	}

	location ~ ^/raw/.*/archive {
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}

	location ~ ^/api {
		#return 404;
		limit_req zone=radicle_api burst=3;
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}

	location /raw {
		#return 404;
		limit_req zone=radicle_raw;
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}

	location / {
		#return 404;
		limit_req zone=radicle_api burst=3;
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}
}

server {
	listen 443 ssl;
	#listen [::]:443 ssl;
	server_name rad.hardenedbsd.org;
	#lingering_time 360s;
	#lingering_timeout 280s;
	#client_max_body_size 10G;
	proxy_buffering on;
	http2 on;

	include /usr/local/etc/nginx/common.conf;
		proxy_cache rad_cache_zone_01;
		proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
		proxy_cache_revalidate on;
		proxy_cache_background_update on;
		proxy_cache_lock on;
		add_header X-Cache-Status $upstream_cache_status;
		proxy_ignore_headers Cache-Control;
		proxy_cache_valid any 1440m;

	if ($http_user_agent ~* "SemrushBot|Semrush|AhrefsBot|MJ12bot|YandexBot|YandexImages|MegaIndex.ru|BLEXbot|BLEXBot|ZoominfoBot|YaK|VelenPublicWebCrawler|SentiBot|Vagabondo|SEOkicks|SEOkicks-Robot|mtbot/1.1.0i|SeznamBot|DotBot|Cliqzbot|coccocbot|python|Scrap|SiteCheck-sitecrawl|MauiBot|Java|GumGum|Clickagy|AspiegelBot|Yandex|TkBot|CCBot|Qwantify|MBCrawler|serpstatbot|AwarioSmartBot|Semantici|ScholarBot|proximic|MojeekBot|GrapeshotCrawler|IAScrawler|linkdexbot|contxbot|PlurkBot|PaperLiBot|BomboraBot|Leikibot|weborama-fetcher|NTENTbot|Screaming Frog SEO Spider|admantx-usaspb|Eyeotabot|VoluumDSP-content-bot|SirdataBot|adbeat_bot|TTD-Content|admantx|Nimbostratus-Bot|Mail.RU_Bot|Quantcastboti|Onespot-ScraperBot|Taboolabot|Baidu|Jobboerse|VoilaBot|Sogou|Jyxobot|Exabot|ZGrab|Proximi|Sosospider|Accoona|aiHitBot|Genieo|BecomeBot|ConveraCrawler|NerdyBot|OutclicksBot|findlinks|JikeSpider|Gigabot|CatchBot|Huaweisymantecspider|Offline Explorer|SiteSnagger|TeleportPro|WebCopier|WebReaper|WebStripper|WebZIP|Xaldon_WebSpider|BackDoorBot|AITCSRoboti|Arachnophilia|BackRub|BlowFishi|CherryPicker|CyberSpyder|EmailCollector|Foobot|GetURL|httplib|HTTrack|LinkScan|Openbot|Snooper|SuperBot|URLSpiderPro|MAZBot|EchoboxBot|SerendeputyBot|LivelapBot|linkfluence.com|TweetmemeBot|LinkisBot|CrowdTanglebot|openai\.com|GPTBot|gptbot|claudebot|PetalBot|BugBountyRecon")
	{
		return 403;
	}


	location ~ ^/api/v1/repos/.*/stats {
		return 403;
	}

	location ~ ^/raw/.*/archive {
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}

	location ~ ^/api {
		#return 404;
		limit_req zone=radicle_api burst=3;
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}

	location /raw {
		#return 404;
		limit_req zone=radicle_raw;
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}

	location / {
		#return 404;
		limit_req zone=radicle_api burst=3;
		proxy_pass http://radicle;
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $remote_addr;
		break;
	}
}