tftsr_ai/tftsr_nginx-hardening/roles/geo_blocking/templates/geo-block.nft.j2

#!/usr/sbin/nft -f
# Managed by Ansible — do not edit manually

# Ensure table exists, then flush for idempotency
add table inet geo_block
flush table inet geo_block

table inet geo_block {
    set blocked_countries {
        type ipv4_addr
        flags interval
{% if geo_blocked_cidrs | length > 0 %}
        elements = {
{% for cidr in geo_blocked_cidrs %}
            {{ cidr }}{% if not loop.last %},{% endif %}

{% endfor %}
        }
{% endif %}
    }

    chain prerouting {
        type filter hook prerouting priority -100; policy accept;
        ip saddr @blocked_countries drop
    }
}