In this case using nginx allow and deny statements was much easier than doing bit fiddling in Lua and returning 503s. Any time spent researching other options w

In this case using nginx allow and deny statements was much easier than doing bit fiddling in Lua and returning 503s. Any time spent researching other options would have been time not spent determining the problem. Often getting to the root of the problem as quickly as possible while simultaneously keeping the site up (practical) wins over always using correct HTTP response codes (pedantic).