# Ban sao cau hinh dang chay tren may web: /etc/nginx/conf.d/tradingauto-gioi-han.conf (26/09/2026).
# Tuong lua Hestia (khong nam trong git): cong 80/443 chi nhan tu ipset 'cloudflare'
# (tu cap nhat tu https://www.cloudflare.com/ips-v4), LAN 192.168.8.0/24, Tailscale 100.64.0.0/10.
# Mo lai tam thoi neu can: sudo /usr/local/hestia/bin/v-add-firewall-rule ACCEPT 0.0.0.0/0 80,443 TCP WEB
# 26/09/2026 - gioi han toc do theo IP THAT cua khach (sau real_ip Cloudflare), lop du phong sau Cloudflare.
# Khong ap cho may noi bo: keysync (192.168.8.203 ~30.000 lan/ngay), LAN, Tailscale, localhost.
geo $ta_noi_bo {
    default         0;
    127.0.0.0/8     1;
    192.168.8.0/24  1;
    100.64.0.0/10   1;
}
map $ta_noi_bo $ta_khoa_gioi_han {
    1  "";
    0  $binary_remote_addr;
}
limit_req_zone $ta_khoa_gioi_han zone=ta_theo_ip:10m rate=20r/s;
limit_req zone=ta_theo_ip burst=80 nodelay;
limit_req_status 429;
limit_req_log_level warn;