diff --git a/tasks/main.yml b/tasks/main.yml
index a506a20..35f1cb0 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -21,8 +21,31 @@
           update-status: "false"
         config:
           use-forwarded-headers: "true"
+          compute-full-forwarded-for: "true"
           allow-snippet-annotations: "true"
           annotations-risk-level: "Critical"
+          # Abusive address ranges, refused with 403 on every host.
+          http-snippet: |
+            geo $blocked_ip {
+              default 0;
+              102.165.1.0/24 1;
+              102.165.5.0/24 1;
+              185.176.207.0/24 1;
+              185.213.247.0/24 1;
+              193.58.104.0/24 1;
+              194.53.140.0/24 1;
+              5.45.36.0/24 1;
+              86.105.185.0/24 1;
+            }
+            map $blocked_ip $block {
+              1 1;
+              default 0;
+            }
+            server {
+              if ($block) {
+                return 403;
+              }
+            }
         metrics:
           enabled: true