map $remote_addr
    $krdsh_remote_type
{
    default  external;

    ## 127.0.0.0/8
    ~^127\..+$  internal;
    ## 10.0.0.0/8
 #  ~^10\..+$  internal;
    ## 172.16.0.0/12
 #  ~^172\.(?:1[6-9]|2[0-9]|3[01])\..+$  internal;
    ## 192.168.0.0/16
 #  ~^192\.168\..+$  internal;
    ## 192.0.2.0/24
    ~^192\.0\.2\..+$  internal;
    ## 198.51.0.0/24
 #  ~^198\.51\.0\..+$  internal;
    ## 198.18.0.0/15
 #  ~^198\.1[89]\..+$  internal;
    ## 203.0.113.0/24
 #  ~^203\.0\.113\..+$  internal;
    ## 240.0.0.0/4
    ~^2(?:4[0-9]|5[0-5])\..+$  internal;
}

map $scheme:$host
    $krdsh_need_ssl
{
    default 1;

    ~*^[^:]+:(?:nossl-)?geo-[^.]+\.krd\.sh$  "";

    ~*^https:       "";
    ~*^http:nossl-  "";
}

map $scheme:$host
    $krdsh_is_ssl
{
    ~*^https:nossl-  "";
    ~*^https:        1;
}

map $scheme:$host
    $krdsh_nossl_misuse
{
    ~*^https:nossl-  1;
}

map $host
    $krdsh_nossl_realhost
{
    ~*^nossl-(.+)$  $1;
}

map $scheme:$host
    $krdsh_need_redirect
{
    ~*^[^:]+:nossl-geo\.krd\.sh$             1;
    ~*^[^:]+:(?:nossl-)?geo-[^.]+\.krd\.sh$  1;
}

map $scheme:$host
    $krdsh_redirector
{
    default  http://krd.sh;

    ~*^[^:]+:nossl-geo\.krd\.sh$               $scheme://geo.krd.sh$uri;
    ~*^[^:]+:(?:nossl-)?geo-([^.]+)\.krd\.sh$  $scheme://geo.krd.sh/$1;
}

map $krdsh_need_ssl$krdsh_is_ssl$krdsh_need_redirect
    $krdsh_need_proxy
{
    ""  1;
}

map $host
    $krdsh_self_proxy_host
{
    default  $host;

    ~*^nossl-(.+)$  $1;
}

map $host
    $krdsh_self_proxy_uri
{
    default  https://$host;

    ~*^nossl-(.+)$  https://$1;
}