IPAPI.GR for Next.js

# .env.local (server-only: never prefix it with NEXT_PUBLIC_)
IPAPI_KEY=your_api_key_here

// proxy.ts (Next.js 16+; called middleware.ts before v16). Runs before every matched route.
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

const LOOKUP = 'https://ipapi.gr/api/lookup/';
const AI_CLAIM = /GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|Claude-SearchBot|Claude-User|PerplexityBot|Perplexity-User/i;

type Lookup = {
  country_code?: string;
  timezone?: string;
  risk?: { is_ai: boolean; is_crawler: boolean; is_scanner: boolean }; // paid plans only
};

// Missing values come back as the string "No Data".
const known = (v?: string) => (v && v !== 'No Data' ? v : '');

// On Vercel the platform sets these headers. Self-hosted, make sure your reverse proxy overwrites them.
function clientIp(request: NextRequest): string | null {
  return request.headers.get('x-real-ip') ?? request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? null;
}

async function lookup(ip: string): Promise<Lookup | null> {
  try {
    const res = await fetch(`${LOOKUP}${encodeURIComponent(ip)}?key=${encodeURIComponent(process.env.IPAPI_KEY ?? '')}`, {
      signal: AbortSignal.timeout(1500),
    });
    return res.ok ? ((await res.json()) as Lookup) : null;
  } catch {
    return null; // timeout or network error: fail open
  }
}

export async function proxy(request: NextRequest) {
  const ip = clientIp(request);
  const claimsAi = AI_CLAIM.test(request.headers.get('user-agent') ?? '');
  const saved = request.cookies.get('visitor_country')?.value;

  // Visitors keep their country in a cookie, so only the first request costs a lookup.
  // Fine for localisation; a cookie is easy to forge, so bot claims are always checked by IP.
  if (!ip || (saved && !claimsAi)) {
    const headers = new Headers(request.headers);
    headers.set('x-visitor-country', saved ?? '');
    return NextResponse.next({ request: { headers } });
  }

  const data = await lookup(ip);
  if (data?.risk && claimsAi && !data.risk.is_ai) {
    return new NextResponse('Unverified crawler', { status: 403 });
  }

  const country = known(data?.country_code);
  const headers = new Headers(request.headers);
  headers.set('x-visitor-country', country);
  headers.set('x-visitor-timezone', known(data?.timezone));
  const response = NextResponse.next({ request: { headers } });
  if (country) response.cookies.set('visitor_country', country, { maxAge: 60 * 60 * 24, sameSite: 'lax' });
  return response;
}

export const config = {
  // Skip static files, images and API routes.
  matcher: ['/((?!api|_next/static|_next/image|favicon.ico|.*\\.(?:png|jpg|svg|webp)$).*)'],
};

// app/page.tsx: read what proxy.ts set, in any Server Component.
import { headers } from 'next/headers';

export default async function Page() {
  const h = await headers();
  const country = h.get('x-visitor-country') || null; // e.g. "GR", or null when unknown
  return <p>{country === 'GR' ? 'Γεια σας!' : 'Hello!'}</p>;
}