# Optional alternative to the bhim_per_ip zone in http-context.conf.
# Replace the documentation CIDR with an explicitly reviewed shared/NAT range.
geo $bhim_shared_client {
    default 0;
    198.51.100.0/24 1;
}
map $bhim_shared_client $bhim_standard_key {
    0 $binary_remote_addr;
    1 "";
}
map $bhim_shared_client $bhim_shared_key {
    0 "";
    1 $binary_remote_addr;
}
limit_req_zone $bhim_standard_key zone=bhim_standard:20m rate=100r/s;
limit_req_zone $bhim_shared_key zone=bhim_shared:20m rate=1000r/s;
limit_req_status 429;
# In the intended existing location use BOTH of these (empty keys are ignored):
# limit_req zone=bhim_standard burst=100 nodelay;
# limit_req zone=bhim_shared burst=1000 nodelay;