Module geoip 

GeoIP lookup for geo-based ACL predicates (DW-050, feature analysis 5-Security “Geo-blocking”).

A single MaxMind-format database file (GeoLite2-Country, GeoLite2- ASN, or a combined DB) is opened once and held behind an [arc_swap::ArcSwapOption] on the dataplane; authorization rules (authorization.geoip) consult it with the EFFECTIVE client IP (the same XFF-resolved address ip_acl uses — behind a trusted proxy or PROXY-protocol LB, geo decisions follow the real client, not the hop).

Semantics frozen with the design:

• Country is the ISO 3166-1 alpha-2 code, UPPERCASE, preferring country over registered_country (the MaxMind convention: the more specific of the two).
• ASN is autonomous_system_number.
• An address the database does not resolve (private/reserved ranges, not-in-DB, or no database loaded) yields None — “unknown” — and matches NEITHER allow nor deny lists in the authorization rule: a deny-list keeps passing unknowns (geo blocking must not fail closed on unlocatable addresses — they are usually infrastructure), an allow-list keeps rejecting them (an allow-list that admitted unknowns would filter nothing).
• The database HOT-RELOADS: the watcher in dwara-bin polls the file’s mtime and swaps the reader; in-flight lookups keep the reader they loaded (an Arc swap — no torn state).

Structs

GeoipDb

An opened MaxMind database.

GeoipError

Why a GeoIP database could not be opened.