IPAPI.GR for Express

# Keep the key out of source control
export IPAPI_KEY="your_api_key_here"
node app.js

// ipapi.js: Express middleware that adds req.geo for the visitor's IP.
// Node.js 18+ (global fetch). Set IPAPI_KEY in the environment.
const { BlockList, isIP } = require('node:net');

const LOOKUP = 'https://ipapi.gr/api/lookup/';
const TTL_MS = 60 * 60 * 1000; // keep answers for an hour
const MAX_ENTRIES = 10000;
const cache = new Map();

// Private, loopback and link-local addresses have no public location: skip them.
const local = new BlockList();
for (const [net, bits] of [['10.0.0.0', 8], ['172.16.0.0', 12], ['192.168.0.0', 16], ['127.0.0.0', 8], ['169.254.0.0', 16], ['100.64.0.0', 10]]) local.addSubnet(net, bits, 'ipv4');
for (const [net, bits] of [['::1', 128], ['fc00::', 7], ['fe80::', 10]]) local.addSubnet(net, bits, 'ipv6');

// Missing values come back as the string "No Data".
const known = (v) => (v === undefined || v === null || v === '' || v === 'No Data' ? null : v);

async function lookup(ip) {
  const hit = cache.get(ip);
  if (hit && hit.expires > Date.now()) return hit.data;

  const url = LOOKUP + encodeURIComponent(ip) + '?key=' + encodeURIComponent(process.env.IPAPI_KEY);
  const res = await fetch(url, { signal: AbortSignal.timeout(1500) });
  if (!res.ok) return null; // 4xx/5xx: carry on without data
  const body = await res.json();

  const data = {
    ip: body.ip,
    country: known(body.country),
    countryCode: known(body.country_code),
    region: known(body.region),
    city: known(body.city),
    timezone: known(body.timezone),
    asn: known(body.asn),
    isp: known(body.isp),
    risk: body.risk || null // { is_ai, is_crawler, is_scanner } on paid plans only
  };
  if (cache.size >= MAX_ENTRIES) cache.delete(cache.keys().next().value); // drop the oldest
  cache.set(ip, { data, expires: Date.now() + TTL_MS });
  return data;
}

function ipapiGeo() {
  return async (req, res, next) => {
    const ip = String(req.ip || '').replace(/^::ffff:/, ''); // IPv4-mapped IPv6 to plain IPv4
    const family = isIP(ip);
    req.geo = null;
    if (family && !local.check(ip, family === 6 ? 'ipv6' : 'ipv4')) {
      try {
        req.geo = await lookup(ip);
      } catch {
        // Timeout or network error: fail open, never block a visitor because of a lookup.
      }
    }
    next();
  };
}

module.exports = { ipapiGeo, lookup };

// app.js
const express = require('express');
const { ipapiGeo } = require('./ipapi');

const app = express();
app.set('trust proxy', 1); // exactly one reverse proxy (e.g. nginx) in front of the app
app.use(ipapiGeo());

// Paid plans: refuse requests that claim to be an AI crawler but don't come from a known AI crawler address.
const AI_CLAIM = /GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|Claude-SearchBot|Claude-User|PerplexityBot|Perplexity-User/i;
app.use((req, res, next) => {
  const risk = req.geo && req.geo.risk;
  if (risk && AI_CLAIM.test(req.get('user-agent') || '') && !risk.is_ai) {
    return res.status(403).send('Unverified crawler');
  }
  next();
});

app.get('/', (req, res) => {
  res.json({ country: req.geo ? req.geo.countryCode : null, timezone: req.geo ? req.geo.timezone : null });
});

app.listen(process.env.PORT || 3000);