<?php

return [

    /*
    | Turn the blocker on or off without removing the middleware.
    */
    'enabled' => env('BAD_IP_BLOCKER_ENABLED', true),

    /*
    | Register the middleware globally automatically. Disable this if you
    | prefer to add CheckBadIps yourself in bootstrap/app.php.
    */
    'auto_register' => env('BAD_IP_BLOCKER_AUTO_REGISTER', true),

    /*
    | Schedule `bad-ip-blocker:prune` daily to remove expired blocks.
    | Requires the Laravel scheduler (`schedule:run`) to be running.
    */
    'schedule_prune' => env('BAD_IP_BLOCKER_SCHEDULE_PRUNE', true),

    /*
    | Where the local JSON list of blocked IPs is stored.
    */
    'storage_path' => env('BAD_IP_BLOCKER_STORAGE_PATH', storage_path('app/bad-ip-blocker.json')),

    /*
    | Response returned to blocked clients.
    */
    'response' => [
        'status' => 418,
        'message' => 'Blocked.',
    ],

    /*
    | IPs or CIDR ranges that are never blocked. Private and loopback ranges
    | are included by default so that a misconfigured proxy setup (where
    | $request->ip() returns the load balancer's address) never blocks
    | every visitor. Configure TrustProxies so the real client IP is used.
    */
    'whitelist' => [
        '127.0.0.0/8',
        '::1',
        '10.0.0.0/8',
        '172.16.0.0/12',
        '192.168.0.0/16',
        'fc00::/7',
    ],

    /*
    | Automatically block clients that request paths no normal visitor asks
    | for. A hit only counts when the response is a 404, so routes that
    | actually exist in your app (e.g. a published security.txt) are never
    | affected. Patterns use Request::is() syntax.
    */
    'auto_block' => [
        'enabled' => env('BAD_IP_BLOCKER_AUTO_BLOCK', true),

        'paths' => [
            '.well-known/security.txt',
            'security.txt',
            '.env*',
            '*/.env*',
            '.git/*',
            '.aws/*',
            'wp-login.php',
            'wp-admin*',
            'wp-content/*',
            'wp-includes/*',
            'xmlrpc.php',
            'phpmyadmin*',
            'pma*',
            'vendor/phpunit/*',
            'cgi-bin/*',
            '*.php',
        ],

        // Number of matching 404 hits before the IP is blocked.
        'max_hits' => 1,

        // Seconds a hit counter is kept.
        'decay' => 3600,

        // Seconds an automatic block lasts (default 7 days). null = permanent.
        // Scanners rotate IPs, so permanent blocks mostly grow the list and
        // risk locking out shared addresses (mobile carriers, NAT) forever.
        'ttl' => env('BAD_IP_BLOCKER_AUTO_BLOCK_TTL', 60 * 60 * 24 * 7),
    ],

];