TILEZZA GEO FILTER — PHP VERSION (shared hosting and VPS)
=========================================================

What it does: visitors from the countries and data-centre networks you select
are logged only, sent to a check page, or refused (403). The decision is made
on YOUR server; no visitor data leaves it. Once a day it downloads only the
signed IP lists of the countries you selected from Tilezza.

If Tilezza is unreachable or anything fails, visitors pass and the last good
list stays in use. The filter cannot take your site down.

Requires: PHP 7.4–8.4 with the sodium extension (bundled by default), a Tilezza
API key (tlz_…), and HTTPS for the web setup page.
For static sites without PHP use the nginx agent: https://tilezza.eu/bot-gate/


1. UPLOAD
---------
Upload the "geoszuro" folder into your web root (next to index.php) via FTP
or your host's file manager, e.g.:
    /home/user/public_html/geoszuro/geoszuro.php


2. HOOK IT IN — pick one
------------------------
The web setup page ("Bekötés") and  php geoszuro-proba.php bekotes  print
these lines with your exact path. Below, /PATH/ is the geoszuro folder.

 a) Shared hosting (PHP-FPM or LiteSpeed): in the web root, create or edit
    .user.ini:
        auto_prepend_file = "/PATH/geoszuro.php"
    Takes effect within 5 minutes.
    Apache + mod_php hosts (where .user.ini is ignored), in .htaccess:
        php_value auto_prepend_file "/PATH/geoszuro.php"

 b) VPS, nginx + PHP-FPM: inside the .php location, next to fastcgi_pass:
        fastcgi_param PHP_VALUE "auto_prepend_file=/PATH/geoszuro.php";
    then:  nginx -t && systemctl reload nginx
    Or for every site, in the PHP-FPM pool (e.g. /etc/php/8.3/fpm/pool.d/www.conf):
        php_admin_value[auto_prepend_file] = /PATH/geoszuro.php
    then:  systemctl restart php8.3-fpm

 c) VPS, Apache: with mod_php, in the vhost or .htaccess:
        php_value auto_prepend_file "/PATH/geoszuro.php"
    With PHP-FPM (proxy_fcgi), use the pool line from b).

 d) If none of these work: at the very top of index.php (wp-config.php for
    WordPress), below <?php :
        require '/PATH/geoszuro.php';


3. SETUP
--------
Open:  https://your-site.com/geoszuro/geoszuro-beallito.php
First time: your Tilezza API key + a new password (12+ characters). The key is
verified with Tilezza, so nobody without your key can claim the page.
Then tick the countries, choose the mode, save. (The page is in Hungarian;
"Csak figyel" = log only, "Ellenőrző lap" = check page, "Tiltás" = block.)

Recommended: run "log only" for 1–2 weeks, check the statistics, then switch.

EU/EEA countries cannot be selected: EU Regulation 2018/302 prohibits
blocking EU visitors by country.

Search engines, AI search crawlers, link previews and uptime monitors always
pass, as do robots.txt and the sitemap.

Manual setup (no HTTPS, or if you prefer): copy geoszuro-beallitas-minta.php
to geoszuro-beallitas.php and edit it.


4. CHECK IT WORKS
-----------------
- All lines in "Állapot" (status) on the setup page are green.
- "Próba": enter an IP from a selected country; the page tells you what the
  filter would do.
- Over SSH:  php geoszuro-proba.php          (status)
             php geoszuro-proba.php ip 1.2.3.4
             php geoszuro-proba.php stat


5. TURN IT OFF INSTANTLY
------------------------
Delete or comment out the line from step 2, or rename geoszuro.php
(e.g. geoszuro.php.off). With the "require" variant, delete the line instead.


6. AFTER SETUP
--------------
At the bottom of the setup page: "Beállító kikapcsolása" (disable the page;
the filter keeps working), or delete geoszuro-beallito.php.
Re-enable:        php geoszuro-proba.php beallito be
Forgot password:  php geoszuro-proba.php jelszo   — or via FTP set 'admin_hash'
                  to '' in geoszuro-beallitas.php.


7. UPDATING
-----------
Upload the new files over the old ones. Your settings file
(geoszuro-beallitas.php) is not in the zip, so it is kept.


DATA
----
Data folder: geoszuro/geoszuro-adat (moved outside the web root by the setup
page when possible). Not readable from the web: .htaccess denies it, and the
log, secret and login attempts are .php files that output nothing.
The log has no IP addresses and is kept for 14 days.
IP data: iptoasn.com (PDDL 1.0, public domain).
