.env.example

# ─────────────────────────────────────────────────────────────────────────────
# IPGeolocation.io – Next.js Middleware · Environment Variables
# ─────────────────────────────────────────────────────────────────────────────
# Get your free API key at https://ipgeolocation.io
# ─────────────────────────────────────────────────────────────────────────────

# ── Required ──────────────────────────────────────────────────────────────────

IPGEOLOCATION_API_KEY=


# ── Country controls ──────────────────────────────────────────────────────────

# Allow-list: ONLY these countries can access your app (others → block page).
# Leave empty to allow all countries.
# Format: comma-separated ISO 3166-1 alpha-2 codes (case-insensitive)
# Example: US,CA,GB,AU
IPGEO_ALLOWED_COUNTRIES=

# Block-list: these countries are always redirected to the block page.
# Format: comma-separated ISO 3166-1 alpha-2 codes (case-insensitive)
# Example: CN,RU,KP
IPGEO_BLOCKED_COUNTRIES=

# Country-based path redirects (JSON map).
# Users from a matching country are redirected to the given path once.
# Example: {"US":"/us","GB":"/uk","PK":"/pk","DE":"/de"}
IPGEO_COUNTRY_REDIRECTS={}


# ── Security controls ─────────────────────────────────────────────────────────

# Block VPN users
IPGEO_BLOCK_VPN=false

# Block proxy connections (datacenter / anonymous proxies)
IPGEO_BLOCK_PROXY=false

# Block Tor exit nodes (recommended: true)
IPGEO_BLOCK_TOR=true

# Block cloud / datacenter IP ranges (AWS, GCP, Azure, etc.)
IPGEO_BLOCK_CLOUD_PROVIDER=false

# Block known bots / scrapers
IPGEO_BLOCK_BOT=false

# Block IPs flagged as spam sources
IPGEO_BLOCK_SPAM=false

# Block IPs with a known attack history
IPGEO_BLOCK_KNOWN_ATTACKER=false

# Block if threat score ≥ this value. Leave empty to disable.
# Range: 0–100. Recommended starting value: 75
# Example: 75
IPGEO_THREAT_SCORE_BLOCK_THRESHOLD=


# ── Behavior ──────────────────────────────────────────────────────────────────

# Path to redirect blocked requests to
IPGEO_BLOCK_PATH=/blocked

# Prefix for geo headers forwarded to your app
# Your app can read e.g. request.headers.get('x-ipgeo-country')
IPGEO_HEADER_PREFIX=x-ipgeo

# API request timeout in milliseconds (default: 3000)
IPGEO_TIMEOUT_MS=3000

# In-memory cache TTL in milliseconds (default: 60000 = 1 minute)
# Set to 0 to disable caching entirely.
IPGEO_CACHE_TTL_MS=60000

# fail-closed: if the geo lookup fails (timeout / API error), block the request
# instead of passing it through. Default: false (fail-open = safer for uptime)
IPGEO_FAIL_CLOSED=false

# Trust the FIRST IP in x-forwarded-for instead of the last.
# On Vercel, the LAST IP is injected by Vercel's edge and is most trustworthy.
# Only set this to true if you're behind a custom reverse proxy that you control.
IPGEO_TRUST_FIRST_XFF=false