http {
    # 定义10MB内存用于访问统计
    statistics_zone 10m; 

    # IP黑名单配置
    ip_blacklist on;
    ip_blacklist_size 10240;
    ip_blacklist_timeout 120;
    ip_blacklist_mode local;

    # 限流配置（令牌桶算法）
    limit_req_zone $binary_remote_addr zone=mudoom:10m rate=10r/s;

    # 行为识别配置
    ip_behavior_zone zone=brand:10m sample_base=10 sample_cycle=2s;

    # IP白名单定义
    geo $ip_wl {
        ranges;
        default 0;
        127.0.0.1-127.0.0.1 1;
    }

    # UA白名单定义
    whitelist_ua $ua_wl {
        caseless;
        "Baiduspider" ".*\\.baidu\\.com";
        "Googlebot" ".*\\.google\\.com";
        # ...其他UA规则
    }
}

server {
    # 虚拟主机配置
    virtual_server_name www.mudoom.cn;
    ip_behavior zone=brand type=sensitive_url;

    # 机器人防护配置
    location @process {
        robot_mitigation_global_whitelist ua_var_name=ua_wl ip_var_name=ip_wl;
        robot_mitigation on;
        robot_mitigation_mode js;
        robot_mitigation_blacklist 50;
        robot_mitigation_timeout 600;
    }

    # 管理接口配置
    location /blacklist_show {
        allow 127.0.0.1;
        deny all;
        ip_blacklist_show;
    }

    # 安全防护location
    location /mudoom {
        ip_behavior_sensitive;
        limit_req zone=mudoom burst=100 forbid_action=@process;

        # Cookie防护配置
        cookie_poisoning_whitelist ua_var_name=ua_wl ip_var_name=ip_wl;
        cookie_poisoning off;
        cookie_poisoning_action block,blacklist,5;

        # Naxsi规则配置
        naxsi_whitelist ua_var_name=ua_wl ip_var_name=ip_wl;
        LearningMode;
        DeniedUrl "/RequestDenied";
        CheckRule "$XSS >= 4" BLOCK;
        CheckRule "$SQL >= 8" BLOCK;
    }
}