How do you configure NGINX rate limiting and connection limiting to protect against DDoS and abuse?

# Rate limiting zones (defined in http block)
http {
    # 10 requests/second per IP, 10MB shared memory
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    
    # Strict limit for auth endpoints
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    
    # Connection limit
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    
    # Return 429 instead of 503
    limit_req_status 429;
    limit_conn_status 429;
    
    server {
        # General API: 10 req/s with burst of 20
        location /api/ {
            limit_req zone=api burst=20 delay=10;
            # First 10 burst requests processed immediately,
            # next 10 queued, beyond 30 total → 429
            limit_conn addr 50;  # Max 50 concurrent connections per IP
            proxy_pass http://backend;
        }
        
        # Login: strict 1 req/s
        location /api/auth/login {
            limit_req zone=login burst=5 nodelay;
            proxy_pass http://backend;
        }
        
        # Whitelist internal IPs
        geo $limit {
            default 1;
            10.0.0.0/8 0;    # Internal network
            172.16.0.0/12 0;  # Internal network
        }
        map $limit $limit_key {
            0 "";
            1 $binary_remote_addr;
        }
        limit_req_zone $limit_key zone=external:10m rate=5r/s;
    }
}