try this but too much restriction, probaly gonna use this safety in the future though

terraform/nginx_config.tftpl

@@ -9,14 +9,19 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-        if ($allowed_country = no) {
-            return 444; # Forbidden
-            # Or use 'return 444;' to close the connection without a response
-	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
-        }
+#        if ($allowed_country = no) {
+#            return 444; # Forbidden
+#            # Or use 'return 444;' to close the connection without a response
+#	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
+#        } 
 
         location / {
+		if ($allowed_country = yes) {
+
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
+                break;
+        }
+
                 proxy_set_header    Upgrade     $http_upgrade;
 		proxy_set_header Host $host;
                 ${extra-value-location}
@@ -33,6 +38,16 @@ server {
 	                proxy_pass  %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
 		}
                 %{ endif }
+
+        if ($ssl_client_verify != "SUCCESS") {
+            # Not UK AND no valid cert? Blocked.
+            return 403;
+        }
+
+        # 3. If NOT from UK but HAS cert, let them in.
+                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
+
+
         }
         location /.well-known/acme-challenge/ {
                 root /var/www/certbot;
@@ -69,7 +84,7 @@ server {
         ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
 
         # Client Certificate Config
-        ssl_client_certificate /etc/nginx/certs/MyPrivateCA.crt;
+        ssl_trusted_certificate /etc/nginx/certs/MyPrivateCA.crt;
         ssl_verify_client optional; # 'optional' so we can check the result manually