server {
        listen 80;
        listen [::]:80;
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;
        server_name git.softwarelibre.mx;
        #root /srv/www/html/letsencrypt/public;

        # ssl
        ssl_certificate "/etc/letsencrypt/live/git.softwarelibre.mx/fullchain.pem";
        ssl_certificate_key "/etc/letsencrypt/live/git.softwarelibre.mx/privkey.pem";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_prefer_server_ciphers on;

        # include
        include include.d/letsencrypt.conf;

        location = / {
                 limit_conn   cons  5;
                 limit_req   zone=slow delay=5 ;
                 include include.d/forgejo-proxy.conf;
        }

        # Default con límite apretado para no sobrecargar de 404s al Forgejo
        location / {
                 limit_conn   cons  5;
                 limit_req   zone=crawler delay=5 burst=15 ;
                 include include.d/forgejo-proxy.conf;
        }

        location /api {
                 limit_conn   cons  3;
                 limit_req   zone=slow delay=5 burst=15 ;
                 include include.d/forgejo-proxy.conf;
        }

        # Aquí debe haber solo elementos estáticos
        location ~ ^/(assets|avatars)  {
                 limit_conn   cons  5;
                 limit_req   zone=reqs delay=5 burst=55 ;
                 include include.d/forgejo-proxy.conf;
        }

        # Rutas de consulta con un límite holgado
        location ~ ^/(issues|explore|milestones|notifications|pulls)  {
                 limit_conn   cons  3;
                 limit_req   zone=slow delay=5 burst=15 ;
                 include include.d/forgejo-proxy.conf;
        }

        # Rutas de administración con límite todavía utilizable
        location ~ ^/(admin|org|repo|user)  {
                 limit_conn   cons  3;
                 limit_req   zone=slowest delay=5 burst=15 ;
                 include include.d/forgejo-proxy.conf;
        }

        # Donde hay repos, un límite más holgado
        location ~ ^/(DBS|MxOS|SoftwareLibreMx|KBrown|imcsk8) {
                 limit_conn   cons  5;
                 limit_req   zone=slow delay=5 burst=15 ;
                 #limit_req   zone=crawler delay=5 burst=55 ;
                 #limit_conn   cons  1;
                 #limit_req   zone=crawler ;
                 include include.d/forgejo-proxy.conf;
        }

        # Aquí es donde están atacando, límite máximo
        location ~ ^/strepsirrhini {
                 #return 502;
                 limit_conn   cons  5;
                 limit_req   zone=bot delay=5 burst=55 ;
                 #limit_conn   cons  1;
                 #limit_req   zone=bot ;
                 include include.d/forgejo-proxy.conf;
        }

}