# Include in nginx http context (for example /etc/nginx/conf.d/anonymous-logging.conf).
# Logging only: do not change real_ip or the application's proxy trust chain.
# Ranges verified against https://www.cloudflare.com/ips-v4 and /ips-v6 on 2026-11-10.
geo $remote_addr $anonymous_cloudflare_peer {
    default 0;
    173.245.48.0/20 1;
    103.21.244.0/22 1;
    103.22.200.0/22 1;
    103.31.4.0/22 1;
    141.101.64.0/18 1;
    108.162.192.0/18 1;
    190.93.240.0/20 1;
    188.114.96.0/20 1;
    197.234.240.0/22 1;
    198.41.128.0/17 1;
    162.158.0.0/15 1;
    104.16.0.0/13 1;
    104.24.0.0/14 1;
    172.64.0.0/13 1;
    131.0.72.0/22 1;
    2400:cb00::/32 1;
    2606:4700::/32 1;
    2803:f800::/32 1;
    2405:b500::/32 1;
    2405:8100::/32 1;
    2a06:98c0::/29 1;
    2c0f:f248::/32 1;
}
map "$anonymous_cloudflare_peer:$http_cf_connecting_ip" $anonymous_client_ip {
    default $remote_addr;
    ~^1:.+$ $http_cf_connecting_ip;
}
map $anonymous_cloudflare_peer $anonymous_cf_ray {
    default "";
    1 $http_cf_ray;
}
# Fixed route labels: no query strings, repository identifiers or file paths.
map $uri $anonymous_log_route {
    default "other";
    / "/";
    /api/healthcheck "/api/healthcheck";
    /api/user "/api/user";
    ~^/api/repo/[^/]+/file/ "/api/repo/:id/file/:path";
    ~^/api/repo/[^/]+/files/counts "/api/repo/:id/files/counts";
    ~^/api/repo/[^/]+/files/search "/api/repo/:id/files/search";
    ~^/api/repo/[^/]+/files "/api/repo/:id/files";
    ~^/api/repo/[^/]+/zip "/api/repo/:id/zip";
    ~^/api/repo/ "/api/repo/:id";
    ~^/(r|w|repository)/ "/viewer/:id/:path";
    ~^/github/ "/github/:action";
    ~^/api/admin/ "/api/admin/:action";
    ~^/api/user/ "/api/user/:action";
    ~^/(css|script|fonts|partials)/ "/assets/:path";
}
log_format anonymous_json escape=json
    '{"time":"$time_iso8601","host":"$host","server":"$server_name",'
    '"client_ip":"$anonymous_client_ip","peer_ip":"$remote_addr",'
    '"cloudflare_peer":"$anonymous_cloudflare_peer","cf_ray":"$anonymous_cf_ray",'
    '"edge_request_id":"$request_id","app_request_id":"$upstream_http_x_request_id",'
    '"method":"$request_method","route":"$anonymous_log_route","protocol":"$server_protocol",'
    '"status":$status,"limit_req_status":"$limit_req_status","upstream_status":"$upstream_status",'
    '"request_time":$request_time,"upstream_connect_time":"$upstream_connect_time",'
    '"upstream_header_time":"$upstream_header_time","upstream_response_time":"$upstream_response_time",'
    '"request_bytes":$request_length,"response_bytes":$bytes_sent, "completion":"$request_completion",'
    '"connection":"$connection","connection_requests":$connection_requests, "user_agent":"$http_user_agent"}';