#if the module doesn't load, search a similar path for this module and paste it there 
# ls -l /usr/lib/nginx/modules/ngx_http_geoip2_module.so

load_module "/usr/lib/nginx/modules/ngx_http_geoip2_module.so";
#modules/ngx_http_geoip_module.so";
user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /run/nginx.pid;


events {
    worker_connections  1024;
}




http {
	geoip2 /data/dbip-country-lite-2026-01.mmdb{
		$geoip2_data_country_iso_code country iso_code;
	        $geoip2_data_city_name city names en;
	        $geoip2_data_country_name country names en;
	}
     
	map $geoip2_data_country_iso_code $allowed_country {
		default yes;
		IN no;
	        CN      no;  # Block China
		RU      no;  # Block Russia
		KP      no;  # Block North Korea
	}
	log_format main_ext '$remote_addr - $remote_user [$time_local] '
		'"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent" '
                '$geoip2_data_city_name $geoip2_data_country_name';


#code below coming from AI , not tested 

    server {
        listen 80;
        server_name yourdomain.com;

        # 4. The actual block logic
        if ($allowed_country = no) {
            return 403; # Forbidden
            # Or use 'return 444;' to close the connection without a response
	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
        }

        location / {
            proxy_pass http://your_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }

}