haproxy.cfg

# https://www.haproxy.com/documentation/hapee/latest/onepage/#home
global
    log stdout format raw local0
    tune.bufsize 65536  # 64KB - increased for WAF body inspection
    stats socket /tmp/haproxy.sock mode 660 level admin
    stats timeout 30s
    lua-prepend-path /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/?.lua
    lua-load /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/crowdsec.lua
    setenv CROWDSEC_BAN_TEMPLATE_PATH /var/lib/crowdsec-haproxy-spoa-bouncer/html/ban.html
    setenv CROWDSEC_CAPTCHA_TEMPLATE_PATH /var/lib/crowdsec-haproxy-spoa-bouncer/html/captcha.html

defaults
    log global
    option httplog
    option http-buffer-request
    timeout client 1m
	timeout server 1m
	timeout connect 10s
	timeout http-keep-alive 2m
	timeout queue 15s
	timeout tunnel 4h  # for websocket

frontend test
    mode http
    bind *:9090
    
    unique-id-format %[uuid()]
    unique-id-header X-Unique-ID
    filter spoe engine crowdsec config /etc/haproxy/crowdsec.cfg

    # ACL for body size limit (100000 bytes = ~100KB) - adjust here to change limit globally
    # Note spop protocol has limitations on the size of the message, so altering this value will not ensure the whole
    # body is sent for processing but should be enough to prevent overwhelming the SPOA bouncer.
    acl body_within_limit req.body_size -m int le 51200  # 50KB - stay safely under SPOE frame limit

    ## If you don't want to render any content, you can use the following line
    # tcp-request content reject if !{ var(txn.crowdsec.remediation) -m str "allow" }

    ## Drop ban requests before http handler is called
    # tcp-request content reject if { var(txn.crowdsec.remediation) -m str "ban" }

    # Send HTTP group conditionally based on body size
    # TCP handler already checked IP (triggered on client session), HTTP handler will use that remediation
    # Send group with body when body size <= limit (or no body present)
    http-request send-spoe-group crowdsec crowdsec-http-body if body_within_limit || !{ req.body_size -m found }
    # Send group without body when body exists and size > limit
    http-request send-spoe-group crowdsec crowdsec-http-no-body if !body_within_limit { req.body_size -m found }

    ## Set a custom header on the request for upstream services to use
    http-request set-header X-Crowdsec-Remediation %[var(txn.crowdsec.remediation)] if { var(txn.crowdsec.remediation) -m found }
    ## Set a custom header on the request for upstream services to use
    http-request set-header X-Crowdsec-IsoCode %[var(txn.crowdsec.isocode)] if { var(txn.crowdsec.isocode) -m found }

    ## Handle 302 redirect for successful captcha validation (redirect to current request URL)
    http-request redirect code 302 location %[url] if { var(txn.crowdsec.remediation) -m str "allow" } { var(txn.crowdsec.redirect) -m found }
    
    ## Call lua script only for ban and captcha remediations (performance optimization)
    http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "captcha" }
    http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "ban" }

    ## Handle captcha cookie management via HAProxy (new approach)
    ## Set captcha cookie when SPOA provides captcha_status (pending or valid)
    http-after-response set-header Set-Cookie %[var(txn.crowdsec.captcha_cookie)] if { var(txn.crowdsec.captcha_status) -m found } { var(txn.crowdsec.captcha_cookie) -m found }
    ## Clear captcha cookie when cookie exists but no captcha_status (Allow decision)
    http-after-response set-header Set-Cookie %[var(txn.crowdsec.captcha_cookie)] if { var(txn.crowdsec.captcha_cookie) -m found } !{ var(txn.crowdsec.captcha_status) -m found }

    use_backend test_backend

backend test_backend
    mode http
    server s1 whoami:2020
    
backend crowdsec-spoa
    mode tcp
    timeout connect 2s
    timeout server 60s
    server s2 spoa:9000