diff --git a/Dockerfile b/Dockerfile
index a3bb6f3..e0cc6b3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,6 +21,8 @@ RUN apk add --no-cache ca-certificates \
 
 COPY --from=builder /build/target/release/rustyip /usr/local/bin/rustyip
 
+RUN mkdir -p /data && chown -R rustyip:rustyip /data
+
 WORKDIR /app
 RUN chown -R rustyip:rustyip /app
 
diff --git a/haproxy/haproxy.cfg b/haproxy/haproxy.cfg
index 90a359d..e05c057 100644
--- a/haproxy/haproxy.cfg
+++ b/haproxy/haproxy.cfg
@@ -11,7 +11,7 @@ defaults
     log     global
     mode    http
     option  httplog
-    option  dontlognormal
+    option  dontlog-normal
     timeout connect 5s
     timeout client  30s
     timeout server  30s
@@ -28,8 +28,7 @@ frontend https_in
     # Access to port 443 is already restricted to Cloudflare IPs at the UFW level
     # Therefore, all requests reaching HAProxy come from Cloudflare; no additional ACL validation is required.
 
-    # HAProxy's own forwardfor must be disabled, otherwise it will insert Cloudflare node IPs
-    no option forwardfor
+    # HAProxy's own forwardfor is not enabled; real IP is set explicitly below via CF-Connecting-IP
 
     # Overwrite standard headers directly with the real IP forcibly added by Cloudflare
     http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)]