--- src/common/core/ui/confs/default-server-http/ui.conf.orig	2026-09-21 08:05:39 UTC
+++ src/common/core/ui/confs/default-server-http/ui.conf
@@ -35,7 +35,9 @@
     # in http/ui.modsec-crs cannot match. Disable modsec on the UI proxy
     # locations only — other defenses (limit, badbehavior, crowdsec, allowlists)
     # still run via the BunkerWeb Lua pipeline.
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     proxy_pass $backendui;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
@@ -53,7 +55,9 @@
 }
 
 location = /login {
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     etag off;
     add_header Last-Modified "";
     proxy_pass $backendui;
@@ -73,7 +77,9 @@
 }
 
 location = /logout {
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     etag off;
     add_header Last-Modified "";
     proxy_pass $backendui;
@@ -94,7 +100,9 @@
 
 # Serve CSS, Fonts, Images, JavaScript and Libs without modifying the response body
 location ~ ^/setup/(css|fonts|img|js|libs|locales)(.*)$ {
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     # Capture the asset type and the remaining path
     # Example: /setup/js/app.js -> /js/app.js
     proxy_pass $backendui/$1$2;
@@ -122,7 +130,9 @@
 }
 
 location /setup {
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     etag off;
     add_header Last-Modified "";
     proxy_pass $backendui;
@@ -171,7 +181,9 @@
 }
 
 location /setup/loading {
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     etag off;
     add_header Last-Modified "";
     proxy_pass $backendui;
@@ -220,7 +232,9 @@
 }
 
 location /setup/check {
+    {% if has_modsecurity %}
     modsecurity off;
+    {% endif %}
     etag off;
     add_header Last-Modified "";
     add_header 'Access-Control-Allow-Origin' '*' always;