chore: update

templates/haproxy.cfg.j2

@@ -18,6 +18,10 @@ frontend fe_https
     mode http
     option forwardfor
     http-request set-header X-Forwarded-Proto https
+    # Force le Host envoye aux backends : sans ca, un scan/requete directe sur l'IP
+    # publique (Host: <IP> ou absent) fait grimper le score d'anomalie ModSecurity
+    # (rule 920280 "Missing a Host Header") et se fait bloquer en 403 cote WAF.
+    http-request set-header Host {{ domain_name }}
 
     # /api/* et /uploads/* -> pool backend (Go), tout le reste -> pool frontend (SPA)
     acl is_api path_beg /api/ /uploads/ /webhook/telegram /webhook/nowpayment
@@ -30,7 +34,7 @@ frontend fe_https
 # ============================================================
 backend be_api
     mode http
-    option httpchk GET /api/health
+    http-check send meth GET uri /api/health hdr Host {{ domain_name }}
     http-check expect status 200
 
     server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2
@@ -41,7 +45,7 @@ backend be_api
 # ============================================================
 backend be_frontend
     mode http
-    option httpchk GET /
+    http-check send meth GET uri / hdr Host {{ domain_name }}
     http-check expect status 200
 
     server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2