Challenge 1: Restricting /admin/ to a Single IP in Nginx — Solution Walkthrough

The configuration:

  location /admin/ {
      allow 203.0.113.10;
      deny all;
  }

Why this works:

Nginx evaluates allow/deny rules in order, top to bottom, stopping at
the first match. Listing allow 203.0.113.10 first means that specific
address is explicitly permitted, and deny all immediately after
rejects every other address that didn't already match an allow rule
above it. Because this is configured inside the /admin/ location
block specifically, the restriction applies only to that path — other
paths on the same server are unaffected.

Why the order matters:

If deny all were listed before allow 203.0.113.10, every request —
including from 203.0.113.10 itself — would be rejected by the first
matching rule, since Nginx stops checking further rules once a match
is found. The permitted address has to be allowed before the
catch-all deny.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise is a direct, hands-on application of this chapter's own
allow/deny directive pair to a concrete single-IP scenario, correctly
scoping the restriction to one specific location block and ordering
the rules so the intended address is actually reachable.