Refactor plugin configuration examples and improve formatting in documentation

- Replaced `config.yml` with modular configuration examples: `config-basic.yml`, `config-certbot.yml`, `config-deny-pages.yml`, and `config-jwt-validator.yml`.
- Improved examples with detailed usage instructions, prerequisites, and testing steps for each configuration.
- Fixed indentation and formatting inconsistencies across plugin files and HAProxy configuration generation.
- Streamlined README comparison table for static vs. dynamic discovery.
- Updated `docker-compose-jwt-validator.yml` to correct audience key formatting.

src/plugins/builtin/cloudflare.py

@@ -76,8 +76,8 @@ class CloudflarePlugin(PluginInterface):
 
         # Generate HAProxy config snippet
         haproxy_config = f"""# Cloudflare - Restore original visitor IP
-    acl from_cloudflare src -f {self.ip_list_path}
-    http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)] if from_cloudflare"""
+acl from_cloudflare src -f {self.ip_list_path}
+http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)] if from_cloudflare"""
 
         return PluginResult(
             haproxy_config=haproxy_config,

src/plugins/builtin/deny_pages.py

@@ -92,8 +92,8 @@ class DenyPagesPlugin(PluginInterface):
 
         # Generate HAProxy config snippet
         haproxy_config = f"""# Deny Pages - Block specific paths
-    acl denied_path path_beg {paths_str}
-    http-request deny deny_status {self.status_code} if denied_path"""
+acl denied_path path_beg {paths_str}
+http-request deny deny_status {self.status_code} if denied_path"""
 
         return PluginResult(
             haproxy_config=haproxy_config,

src/plugins/builtin/ip_whitelist.py

@@ -93,8 +93,8 @@ class IpWhitelistPlugin(PluginInterface):
 
         # Generate HAProxy config snippet
         haproxy_config = f"""# IP Whitelist - Only allow specific IPs
-    acl whitelisted_ip src {ips_str}
-    http-request deny deny_status {self.status_code} if !whitelisted_ip"""
+acl whitelisted_ip src {ips_str}
+http-request deny deny_status {self.status_code} if !whitelisted_ip"""
 
         return PluginResult(
             haproxy_config=haproxy_config,

src/plugins/builtin/jwt_validator.py

@@ -144,37 +144,37 @@ class JwtValidatorPlugin(PluginInterface):
         lines = ["# JWT Validator - Validate JWT tokens"]
 
         # Check for Authorization header
-        lines.append("    http-request deny content-type 'text/html' string 'Missing Authorization HTTP header' unless { req.hdr(authorization) -m found }")
+        lines.append("http-request deny content-type 'text/html' string 'Missing Authorization HTTP header' unless { req.hdr(authorization) -m found }")
 
         # Extract JWT parts
         lines.append("")
-        lines.append("    # Extract JWT header and payload")
-        lines.append("    http-request set-var(txn.alg) http_auth_bearer,jwt_header_query('$.alg')")
-        lines.append("    http-request set-var(txn.iss) http_auth_bearer,jwt_payload_query('$.iss')")
-        lines.append("    http-request set-var(txn.aud) http_auth_bearer,jwt_payload_query('$.aud')")
-        lines.append("    http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')")
+        lines.append("# Extract JWT header and payload")
+        lines.append("http-request set-var(txn.alg) http_auth_bearer,jwt_header_query('$.alg')")
+        lines.append("http-request set-var(txn.iss) http_auth_bearer,jwt_payload_query('$.iss')")
+        lines.append("http-request set-var(txn.aud) http_auth_bearer,jwt_payload_query('$.aud')")
+        lines.append("http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')")
 
         # Validate JWT
         lines.append("")
-        lines.append("    # Validate JWT")
-        lines.append(f"    http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless {{ var(txn.alg) -m str {self.algorithm} }}")
+        lines.append("# Validate JWT")
+        lines.append(f"http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless {{ var(txn.alg) -m str {self.algorithm} }}")
 
         # Validate issuer (if configured)
         if self.issuer:
-            lines.append(f"    http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless {{ var(txn.iss) -m str {self.issuer} }}")
+            lines.append(f"http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless {{ var(txn.iss) -m str {self.issuer} }}")
 
         # Validate audience (if configured)
         if self.audience:
-            lines.append(f"    http-request deny content-type 'text/html' string 'Invalid JWT audience' unless {{ var(txn.aud) -m str {self.audience} }}")
+            lines.append(f"http-request deny content-type 'text/html' string 'Invalid JWT audience' unless {{ var(txn.aud) -m str {self.audience} }}")
 
         # Validate signature
-        lines.append(f"    http-request deny content-type 'text/html' string 'Invalid JWT signature' unless {{ http_auth_bearer,jwt_verify(txn.alg,\"{pubkey_file}\") -m int 1 }}")
+        lines.append(f"http-request deny content-type 'text/html' string 'Invalid JWT signature' unless {{ http_auth_bearer,jwt_verify(txn.alg,\"{pubkey_file}\") -m int 1 }}")
 
         # Validate expiration
         lines.append("")
-        lines.append("    # Validate expiration")
-        lines.append("    http-request set-var(txn.now) date()")
-        lines.append("    http-request deny content-type 'text/html' string 'JWT has expired' if { var(txn.exp),sub(txn.now) -m int lt 0 }")
+        lines.append("# Validate expiration")
+        lines.append("http-request set-var(txn.now) date()")
+        lines.append("http-request deny content-type 'text/html' string 'JWT has expired' if { var(txn.exp),sub(txn.now) -m int lt 0 }")
 
         haproxy_config = "\n".join(lines)