limit_req_zone $binary_remote_addr zone=aercbot:1m rate=1r/s;

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	server_name bot.diabeteman.com;

	ssl_certificate /etc/dehydrated/certs/diabeteman.com/fullchain.pem;
	ssl_certificate_key /etc/dehydrated/certs/diabeteman.com/privkey.pem;

	client_max_body_size 150K;
	limit_req zone=aercbot burst=10 nodelay;

	location / {
		allow 46.23.81.128/25;
		allow 2a03:6000:1813::/48;
		deny all;
		proxy_http_version 1.1;
		proxy_set_header Host $http_host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_redirect off;
		proxy_buffering off;
		proxy_request_buffering off;
		proxy_pass http://127.0.0.1:7777;
	}
}

server {
	listen 80;
	listen [::]:80;
	server_name bot.diabeteman.com;
	return 301 https://$host$request_uri;
}