Nginx auth_request Setup

# =========================================================================
# Antibot Nginx Edge Protection Configuration
# =========================================================================

upstream antibot_agent {
    server 127.0.0.1:8081;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name shop.example.com;

    ssl_certificate /etc/ssl/certs/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/privkey.pem;

    # 1. Internal Subrequest Check to Antibot Agent (<1ms local evaluation)
    location = /__antibot_check {
        internal;
        proxy_pass http://antibot_agent/v1/check;
        proxy_method POST;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header Host $host;
        proxy_set_header X-Original-Host $host;
        proxy_set_header X-Original-Method $request_method;
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Request-ID $request_id;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header User-Agent $http_user_agent;
        proxy_set_header Accept $http_accept;
        proxy_set_header Accept-Language $http_accept_language;
        proxy_set_header Sec-CH-UA-Platform $http_sec_ch_ua_platform;
        proxy_set_header Sec-Fetch-Dest $http_sec_fetch_dest;
        proxy_set_header Sec-Fetch-Mode $http_sec_fetch_mode;
        proxy_set_header Sec-Fetch-Site $http_sec_fetch_site;
        proxy_set_header Cookie $http_cookie;
    }

    # 2. Challenge media and verification stay local to the agent.
    location ^~ /__antibot/ {
        proxy_pass http://antibot_agent;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    # 3. The signed ticket returned by /v1/check selects PoW or CAPTCHA.
    location = /__antibot_challenge_internal {
        internal;
        proxy_pass http://antibot_agent/__antibot/challenge?ticket=$antibot_ticket&method=$antibot_method&return=$request_uri;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    location @__antibot_denied {
        if ($antibot_status = 429) { return 429 "Too many requests\n"; }
        proxy_pass http://antibot_agent/__antibot/block;
        proxy_set_header Host $host;
    }

    # 4. Main Protected Application (100% full site protection including GET /)
    location / {
        auth_request /__antibot_check;
        auth_request_set $antibot_status $upstream_http_x_antibot_status;
        auth_request_set $antibot_ticket $upstream_http_x_antibot_challenge_ticket;
        auth_request_set $antibot_method $upstream_http_x_antibot_challenge_method;

        error_page 401 = /__antibot_challenge_internal;
        error_page 403 429 = @__antibot_denied;

        proxy_pass http://your_upstream_app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 1. Test unverified request (should return the agent-local signed challenge)
curl -i https://shop.example.com/

# 2. Test a request expected to hit a hard rule (should return 403 or 429)
curl -i -A "Googlebot" https://shop.example.com/