try this but too much restriction, probaly gonna use this safety in the future though

nginx-config.configmap.yaml

@@ -31,7 +31,7 @@ data:
     $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n        ''      close;\n\t}\n\n\tgeoip2
     /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
     iso_code;\n\t        $geoip2_data_city_name city names en;\n\t        $geoip2_data_country_name
-    country names en;\n\t}\n     \n\tmap $geoip2_data_country_iso_code::$ssl_client_verify
+    country names en;\n\t}\n     \n\tmap $geoip2_data_country_iso_code:$ssl_client_verify
     $allowed_country {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes;
     # Allow UK\n                \"~:SUCCESS$\"  yes;   # Allow anyone with a valid
     certificate (regardless of country)\n                #NL     yes; # Allow netherland\n\t\t#IN\tyes;

nginx.conf

@@ -64,7 +64,7 @@ http {
 	        $geoip2_data_country_name country names en;
 	}
      
-	map $geoip2_data_country_iso_code::$ssl_client_verify $allowed_country {
+	map $geoip2_data_country_iso_code:$ssl_client_verify $allowed_country {
 		default no;
 		FR	yes; # Allow France
 		GB	yes; # Allow UK

terraform/nginx_config.tftpl

@@ -9,14 +9,19 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-        if ($allowed_country = no) {
-            return 444; # Forbidden
-            # Or use 'return 444;' to close the connection without a response
-	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
-        }
+#        if ($allowed_country = no) {
+#            return 444; # Forbidden
+#            # Or use 'return 444;' to close the connection without a response
+#	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
+#        } 
 
         location / {
+		if ($allowed_country = yes) {
+
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
+                break;
+        }
+
                 proxy_set_header    Upgrade     $http_upgrade;
 		proxy_set_header Host $host;
                 ${extra-value-location}
@@ -33,6 +38,16 @@ server {
 	                proxy_pass  %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
 		}
                 %{ endif }
+
+        if ($ssl_client_verify != "SUCCESS") {
+            # Not UK AND no valid cert? Blocked.
+            return 403;
+        }
+
+        # 3. If NOT from UK but HAS cert, let them in.
+                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
+
+
         }
         location /.well-known/acme-challenge/ {
                 root /var/www/certbot;
@@ -69,7 +84,7 @@ server {
         ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
 
         # Client Certificate Config
-        ssl_client_certificate /etc/nginx/certs/MyPrivateCA.crt;
+        ssl_trusted_certificate /etc/nginx/certs/MyPrivateCA.crt;
         ssl_verify_client optional; # 'optional' so we can check the result manually