# GeoIP databases
geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb
   {
        $geoip_country_code_x country iso_code;
        $geoip_continent_code_x continent code;
   }

# map the list of denied countries
# see e.g. https://dev.maxmind.com/geoip/legacy/codes/iso3166/ for allowable
# countries
map $geoip_country_code_x $denied_country {
   default yes;   # Add denied countries with no
   }

# map the list of allowed countries
map $geoip_country_code_x $allowed_country {
   default no;    # Add allowed countries with yes
   }

# map the continents to allow
map $geoip_city_continent_code_x $allowed_continent {
   default yes;   # Add allowed continents with yes.
   }

log_format geoipblock '[$time_local] - Geoip blocked $remote_addr - $geoip_country_code_x';
log_format geoipaccept '[$time_local] - Geoip accepted $remote_addr - $geoip_country_code_x';