# http context. Requires anonymous-logging.conf's trusted client IP variable.
# Empty keys exclude ZIP downloads, navigation, writes and unrelated APIs.
map "$request_method:$uri" $anonymous_file_limit_key {
    default "";
    ~*^(GET|HEAD):/api/repo/[^/]+/file/ $anonymous_client_ip;
}
map "$request_method:$uri" $anonymous_listing_limit_key {
    default "";
    ~*^(GET|HEAD):/api/repo/[^/]+/files(/|$) $anonymous_client_ip;
}
limit_req_zone $anonymous_file_limit_key zone=anonymous_file_requests:10m rate=4r/m;
limit_req_zone $anonymous_listing_limit_key zone=anonymous_listing_requests:10m rate=2r/m;

# Private operational entries are date-scoped regexes, never committed IP lists.
# An empty file disables targeted blocks. Date must match the host's log timezone.
map "$time_iso8601:$anonymous_client_ip" $anonymous_bulk_block {
    default 0;
    include /etc/nginx/anonymous-bulk-blocks.map;
}
map "$anonymous_bulk_block:$anonymous_file_limit_key:$anonymous_listing_limit_key" $anonymous_reject_bulk {
    default 0;
    ~^1:.+ 1;
    "1::" 0;
}
map $anonymous_reject_bulk $anonymous_bulk_retry {
    default 30;
    1 3600;
}