GeoIP2 (Stream)

The stream {} version of nginx-module-geoip2. Same MaxMind GeoIP2 lookups, same variables, but available inside nginx's stream module for raw TCP and UDP proxying. If you're running nginx as a TCP load balancer, SNI-based router, or proxy for non-HTTP traffic (databases, mail, game servers, VPNs), this gives you geographic variables in that context. Config is the same as the HTTP module: load databases, define variables, use them in stream {} blocks. If your nginx only does HTTP, skip this one.

• Route TCP connections to geographically close backends
• Restrict access to database proxy endpoints by geography
• Log geographic data for non-HTTP traffic
• Geographic-based decisions for TCP load balancing

A starting point. Adjust to taste.

stream {
  geoip2 /var/lib/GeoIP/GeoLite2-Country.mmdb {
    $geoip2_country_code country iso_code;
  }

  map $geoip2_country_code $backend {
    default backend_us;
    DE      backend_eu;
    FR      backend_eu;
  }

  upstream backend_us { server 10.0.1.1:5432; }
  upstream backend_eu { server 10.0.2.1:5432; }

  server {
    listen     5432;
    proxy_pass $backend;
  }
}

You'll need nginx from nginx.org configured first. These packages won't load on the distro nginx. Then add the Blendbyte repository if you haven't already:

sudo install -d -m 0755 /etc/apt/keyrings

curl -fsSL https://apt.blendbyte.net/nginx/blendbyte-archive-keyring.gpg \
  | sudo tee /etc/apt/keyrings/blendbyte.gpg >/dev/null

echo "deb [signed-by=/etc/apt/keyrings/blendbyte.gpg] https://apt.blendbyte.net/nginx $(lsb_release -cs) main" \
  | sudo tee /etc/apt/sources.list.d/blendbyte.list

sudo apt update
sudo apt install nginx-module-stream-geoip2

Most modules auto-enable on install. If yours didn't:

$ sudo ln -s /etc/nginx/modules-available/50-mod-stream-geoip2.conf \
  /etc/nginx/modules-enabled/
$ sudo nginx -t && sudo systemctl reload nginx

This replaces libnginx-mod-stream-geoip2 from the old Sury nginx repository. The package declares Replaces and Conflicts, so once your apt sources point at nginx.org and Blendbyte, a regular apt upgrade swaps it in. No manual cleanup.

Switching sources also moves you from Sury's nginx binary to nginx.org's. The migration guide walks through it in one go.

We package this from the upstream open-source project. If it's a bug in the module itself (not in our packaging), report it upstream at github.com/leev/ngx_http_geoip2_module ↗