Configuration¶

Django settings¶

Setting	Required	Description
`GEOIP_PATH`	Recommended	Path to the GeoLite2/GeoIP2 Country `.mmdb` file, or a directory containing `GeoLite2-Country.mmdb`
`NAI_SECURITY_EXEMPT_PATHS`	Optional	Paths that skip security middleware checks
`NAI_SECURITY_TRUST_PROXY_HEADERS`	Optional	If `True`, trust `X-Forwarded-For` / `X-Real-IP`. Default `False` (clients cannot spoof IP)

Exempt paths¶

Default exempt paths:

/health/
/ready/
/favicon.ico

Override:

NAI_SECURITY_EXEMPT_PATHS = [
    "/health/",
    "/health",
    "/ready/",
    "/ready",
    "/favicon.ico",
    "/metrics/",
]

Runtime settings (admin / DB)¶

Most knobs live in the singleton model SecuritySettings (Django admin), not in settings.py:

Enable/disable IP, country, user-agent blocking
Auto-block thresholds / durations
Login anomaly flags
Sync toggles for disposable domains / bad bots
Axes: max attempts, cooloff minutes, attempt expiry

Changes apply without restart (cached values are invalidated on save).

Country modes¶

Blocklist mode: use BlockedCountry
Allowlist mode: use AllowedCountry (only listed countries pass)

Configure which mode is active in SecuritySettings.

Optional package settings¶

django-axes¶

See Axes-Integration.

django-ratelimit¶

Use django-ratelimit decorators/middleware as usual.
RateLimitLoggingMiddleware only logs when request.limited is true; it does not enforce limits by itself.

Localhost behavior¶

Localhost IPs (127.0.0.1, ::1) bypass blocking checks so local development keeps working.