@@ -17,7 +17,8 @@ insecure_skip_verify: false
 # Configure TCP and/or Unix socket listeners
 listen_tcp: 0.0.0.0:9000
 listen_unix: /run/crowdsec-spoa/spoa.sock
- challenge_http_listen: 127.0.0.1:9100
+challenge_http_listen: 127.0.0.1:9100
+
 # Caps how many pending AppSec challenge responses can be held in memory at once,
 #challenge_cache_max_entries: 1000
 #asn_database_path: /var/lib/crowdsec/data/GeoLite2-ASN.mmdb
 
@@ -16,104 +16,70 @@ defaults
 	timeout queue 15s
 	timeout tunnel 4h  # for websocket
 
-frontend test
-    mode http
-    bind *:9090
-    
+frontend http-in
+    bind *:80
+    option http-buffer-request
+
     unique-id-format %[uuid()]
     unique-id-header X-Unique-ID
     filter spoe engine crowdsec config /etc/haproxy/crowdsec.cfg
-    acl crowdsec_challenge_backend_path path_beg /crowdsec-challenge/ /crowdsec-internal/challenge/
-
-    # /crowdsec-internal/challenge/* bypasses the normal SPOE crowdsec-tcp/http
-    # checks below (it's how the bouncer relays challenge follow-up asset/proof
-    # requests to AppSec without re-triggering a fresh challenge decision), so it
-    # gets no dataset-based IP check from CrowdSec at that layer. Rate-limit it
-    # here independently, in addition to the IP/dataset ban check the bouncer
-    # itself now performs in handleInternalChallengeHTTP.
-    stick-table type ip size 100k expire 10s store http_req_rate(10s)
-    http-request track-sc0 src if crowdsec_challenge_backend_path
-    http-request deny status 429 if crowdsec_challenge_backend_path { sc_http_req_rate(0) gt 20 }
-
-    # ACL for body size limit (100000 bytes = ~100KB) - adjust here to change limit globally
-    # Note spop protocol has limitations on the size of the message, so altering this value will not ensure the whole
-    # body is sent for processing but should be enough to prevent overwhelming the SPOA bouncer.
-    acl body_within_limit req.body_size -m int le 51200  # 50KB - stay safely under SPOE frame limit
-
-    # HTML-capable client detection. Clients without an Accept header are treated as HTML-capable.
-    # '-m sub text/html' covers the common case; '*/*' covers wildcard acceptors.
-    # html_rejected excludes clients that include text/html but mark it as not acceptable (q=0).
+
+    acl crowdsec_challenge_backend_path path_beg /crowdsec-internal/challenge/
+    acl is_challenge var(txn.crowdsec.remediation) -m str "challenge"
+
+    # Body size limit: stay safely under SPOE frame limit (~50 KB)
+    acl body_within_limit req.body_size -m int le 51200
+
+    # HTML-capable client detection
     acl render_html req.hdr_cnt(Accept) eq 0
     acl render_html req.hdr(Accept) -m sub text/html
     acl render_html req.hdr(Accept) -m sub */*
-    # Single-quoted (not double-quoted): HAProxy expands $VAR references inside double-quoted
-    # strings, and this regex's own trailing "$" (end-of-line anchor) would otherwise be
-    # misparsed as the start of an environment variable reference.
-    acl html_rejected req.hdr(Accept) -m reg -i 'text/html[[:space:]]*;[[:space:]]*q=0(\.0+)?([,[:space:]]|$)'
+    acl html_rejected req.hdr(Accept) -m reg "text/html;q=0"
 
     acl has_contact_url var(txn.crowdsec.contact_us_url) -m found
     acl empty_contact_url var(txn.crowdsec.contact_us_url) -m str ""
 
-    ## If you don't want to render any content, you can use the following line
-    # tcp-request content reject if !{ var(txn.crowdsec.remediation) -m str "allow" }
-
-    ## Drop ban requests before http handler is called
-    # tcp-request content reject if { var(txn.crowdsec.remediation) -m str "ban" }
-
-    # Send HTTP group conditionally based on body size
-    # TCP handler already checked IP (triggered on client session), HTTP handler will use that remediation
-    # Send group with body when body size <= limit (or no body present)
-    http-request send-spoe-group crowdsec crowdsec-http-body if !crowdsec_challenge_backend_path body_within_limit || !crowdsec_challenge_backend_path !{ req.body_size -m found }
-    # Send group without body when body exists and size > limit
-    http-request send-spoe-group crowdsec crowdsec-http-no-body if !crowdsec_challenge_backend_path !body_within_limit { req.body_size -m found }
+    http-request send-spoe-group crowdsec crowdsec-http-body if body_within_limit || !{ req.body_size -m found }
+    http-request send-spoe-group crowdsec crowdsec-http-no-body if !body_within_limit { req.body_size -m found }
 
-    ## Set a custom header on the request for upstream services to use
     http-request set-header X-Crowdsec-Remediation %[var(txn.crowdsec.remediation)] if { var(txn.crowdsec.remediation) -m found }
-    ## Set a custom header on the request for upstream services to use
     http-request set-header X-Crowdsec-IsoCode %[var(txn.crowdsec.isocode)] if { var(txn.crowdsec.isocode) -m found }
 
-    ## Handle 302 redirect for successful captcha validation (redirect to current request URL)
+    ## Redirect after successful captcha validation
     http-request redirect code 302 location %[url] if { var(txn.crowdsec.remediation) -m str "allow" } { var(txn.crowdsec.redirect) -m found }
-    acl is_challenge var(txn.crowdsec.remediation) -m str "challenge"
-    http-request set-path %[var(txn.crowdsec.challenge_url)] if is_challenge { var(txn.crowdsec.challenge_url) -m found }
 
-    ## Render ban and captcha remediations with native HAProxy templates.
-    ## Template paths are fixed at /var/lib/crowdsec-haproxy-spoa-bouncer/html/; edit the lf-file
-    ## directives below if you need custom locations (the old CROWDSEC_*_TEMPLATE_PATH env vars
-    ## are not read by this non-Lua config).
+    ## Serve remediation pages with native HAProxy lf-file directives (no Lua needed)
     http-request return status 200 content-type "text/html; charset=utf-8" hdr Cache-Control "no-cache, no-store" lf-file /var/lib/crowdsec-haproxy-spoa-bouncer/html/captcha.html if { var(txn.crowdsec.remediation) -m str "captcha" } render_html !html_rejected
     http-request return status 403 content-type "text/html; charset=utf-8" hdr Cache-Control "no-cache, no-store" lf-file /var/lib/crowdsec-haproxy-spoa-bouncer/html/ban-with-contact.html if { var(txn.crowdsec.remediation) -m str "ban" } render_html !html_rejected has_contact_url !empty_contact_url
     http-request return status 403 content-type "text/html; charset=utf-8" hdr Cache-Control "no-cache, no-store" lf-file /var/lib/crowdsec-haproxy-spoa-bouncer/html/ban.html if { var(txn.crowdsec.remediation) -m str "ban" } render_html !html_rejected !has_contact_url
     http-request return status 403 content-type "text/html; charset=utf-8" hdr Cache-Control "no-cache, no-store" lf-file /var/lib/crowdsec-haproxy-spoa-bouncer/html/ban.html if { var(txn.crowdsec.remediation) -m str "ban" } render_html !html_rejected empty_contact_url
-    ## Non-HTML clients get plain-text responses; captcha returns 200 to preserve the old
-    ## Lua handler's status code (captcha is a challenge, not a hard rejection).
+    ## Plain-text fallback for non-HTML clients
     http-request return status 200 content-type text/plain hdr Cache-Control "no-cache, no-store" string "Captcha required\n" if { var(txn.crowdsec.remediation) -m str "captcha" } !render_html
     http-request return status 200 content-type text/plain hdr Cache-Control "no-cache, no-store" string "Captcha required\n" if { var(txn.crowdsec.remediation) -m str "captcha" } html_rejected
     http-request return status 403 content-type text/plain hdr Cache-Control "no-cache, no-store" string "Forbidden\n" if { var(txn.crowdsec.remediation) -m str "ban" } !render_html
     http-request return status 403 content-type text/plain hdr Cache-Control "no-cache, no-store" string "Forbidden\n" if { var(txn.crowdsec.remediation) -m str "ban" } html_rejected
 
-    ## Handle captcha cookie management via HAProxy (new approach)
-    ## Set captcha cookie when SPOA provides captcha_status (pending or valid)
+    ## Captcha cookie management
     http-after-response set-header Set-Cookie %[var(txn.crowdsec.captcha_cookie)] if { var(txn.crowdsec.captcha_status) -m found } { var(txn.crowdsec.captcha_cookie) -m found }
-    ## Clear captcha cookie when cookie exists but no captcha_status (Allow decision)
     http-after-response set-header Set-Cookie %[var(txn.crowdsec.captcha_cookie)] if { var(txn.crowdsec.captcha_cookie) -m found } !{ var(txn.crowdsec.captcha_status) -m found }
 
     # REQUIRED if you use challenge mode - do not remove the following line.
     http-request set-header X-Crowdsec-Real-Src %[src] if crowdsec_challenge_backend_path
-
+    
+    http-request set-path %[var(txn.crowdsec.challenge_url)] if is_challenge { var(txn.crowdsec.challenge_url) -m found }
     use_backend crowdsec-challenge if is_challenge { var(txn.crowdsec.challenge_url) -m found }
     use_backend crowdsec-challenge if crowdsec_challenge_backend_path
-    use_backend test_backend
+    use_backend app
 
-backend test_backend
-    mode http
-    server s1 whoami:2020
-    
 backend crowdsec-spoa
     mode tcp
     timeout connect 2s
     timeout server 60s
-    server s2 spoa:9000
+    server spoa 127.0.0.1:9000
+
+backend app
+    mode http
+    http-request return status 200 content-type "text/html" string "<html><body><h1>Hello from HAProxy</h1></body></html>"
 
 backend crowdsec-challenge
     mode http
@@ -123,4 +89,4 @@ backend crowdsec-challenge
     # Challenge responses are cached in the bouncer process that handled SPOE.
     # Keep this backend pinned to that same instance; do not load-balance it
     # independently unless challenge is shared.
-    server s3 spoa:9100
+    server s2 127.0.0.1:9100
@@ -7,6 +7,7 @@ global
 
 defaults
     log global
+    mode   http
     option httplog
     option http-buffer-request
     timeout client 1m
@@ -18,7 +19,6 @@ defaults
 
 frontend http-in
     bind *:80
-    option http-buffer-request
 
     unique-id-format %[uuid()]
     unique-id-header X-Unique-ID