Behind a real HAProxy proxy that blocks /admin. The flag is only returned by POST /admin/rotate with a JSON body {"confirm":"yes"}. Smuggle that POST past the proxy.
/admin
POST /admin/rotate
{"confirm":"yes"}