anchor.diff:  frontend wss-in
       mode http
       bind <%= p("ha_proxy.binding_ip") %>:4443 <%= tls_bind_options %>
  -    <% if_p("ha_proxy.cidr_whitelist") do -%>
  +  <%- if_p("ha_proxy.cidr_whitelist") do -%>
       acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
       tcp-request content accept if whitelist
  -    <% end -%>
  -    <% if_p("ha_proxy.cidr_blacklist") do -%>
  +  <%- end -%>
  +  <%- if_p("ha_proxy.cidr_blacklist") do -%>
       acl blacklist src -f /var/vcap/jobs/haproxy/config/blacklist_cidrs.txt
       tcp-request content reject if blacklist
  -    <% end -%>
  -    <% if p("ha_proxy.block_all") then -%>
  +  <%- end -%>
  +  <%- if p("ha_proxy.block_all") then -%>
       tcp-request content reject
  -    <% end -%>
  -
  -    <% if mutual_tls_enabled -%>
  +  <%- end -%>
  +  <%- if mutual_tls_enabled -%>
       http-request set-header X-Forwarded-Client-Cert %[ssl_c_der,base64]
  -    <% end -%>
  -
  -    <% if p("ha_proxy.hsts_enable") -%>
  +  <%- end -%>
  +  <%- if p("ha_proxy.hsts_enable") -%>
       http-response set-header Strict-Transport-Security max-age=<%= p("ha_proxy.hsts_max_age").to_i %>;<% if p("ha_proxy.hsts_include_subdomains") %>\ includeSubDomains;<% end %><% if p("ha_proxy.hsts_preload") %>\ preload;<% end %>
  -    <% end -%>
  +  <%- end -%>
       capture request header Host len 256
       default_backend http-routers
  -<% if_p("ha_proxy.headers") do |headers| -%>
  -  <% headers.each do |header, value| -%>
  +  <%- if_p("ha_proxy.headers") do |headers| -%>
  +    <%- headers.each do |header, value| -%>
       reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
  -  <% end -%>
  -<% end -%>
  -
  -<% if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
  -  <% rsp_headers.each do |rsp_header, value| -%>
  +    <%- end -%>
  +  <%- end -%>
  +  <%- if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
  +    <%- rsp_headers.each do |rsp_header, value| -%>
       rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
  -  <% end -%>
  -<% end -%>
  -
  -<% if p("ha_proxy.internal_only_domains").size > 0 -%>
  +    <%- end -%>
  +  <%- end -%>
  +  <%- if p("ha_proxy.internal_only_domains").size > 0 -%>
       acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
  -<% p("ha_proxy.internal_only_domains").each do |domain| -%>
  +    <%- p("ha_proxy.internal_only_domains").each do |domain| -%>
       acl internal hdr(Host) -m sub <%= domain %>
  -<% end -%>
  +    <%- end -%>
       http-request deny if internal !private
  -<% end -%>
  -
  -<% p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
  -    <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
  +  <%- end -%>
  +  <%- p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
  +    <%- prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
       acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
       use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  -<% end -%>
  +  <%- end -%>
       acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
       reqadd X-Forwarded-Proto:\ https if ! xfp_exists
   # }}}
  
positive.code: frontend http-in
      mode http
      bind <%= p("ha_proxy.binding_ip") %>:80
      <% if_p("ha_proxy.cidr_whitelist") do -%>
      acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
      tcp-request content accept if whitelist
      <% end -%>
      <% if_p("ha_proxy.cidr_blacklist") do -%>
      acl blacklist src -f /var/vcap/jobs/haproxy/config/blacklist_cidrs.txt
      tcp-request content reject if blacklist
      <% end -%>
      <% if p("ha_proxy.block_all") then -%>
      tcp-request content reject
      <% end -%>
  
      capture request header Host len 256
      default_backend http-routers
  <% if_p("ha_proxy.headers") do |headers| -%>
    <% headers.each do |header, value| -%>
      reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
    <% end -%>
  <% end -%>
  
  <% if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
    <% rsp_headers.each do |rsp_header, value| -%>
      rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
    <% end -%>
  <% end -%>
  
  <% if p("ha_proxy.internal_only_domains").size > 0 -%>
      acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
    <% p("ha_proxy.internal_only_domains").each do |domain| -%>
      acl internal hdr(Host) -m sub <%= domain %>
    <% end -%>
      http-request deny if internal !private
  <% end -%>
  
  <% p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
      <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
      acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
      use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  <% end -%>
      acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
      reqadd X-Forwarded-Proto:\ http if ! xfp_exists
  
  <% if p("ha_proxy.https_redirect_all") -%>
      redirect scheme https code 301 if !{ ssl_fc }
  <% end -%>
  <% unless p("ha_proxy.https_redirect_all") -%>
      acl ssl_redirect hdr(host),lower,map_end(/var/vcap/jobs/haproxy/config/ssl_redirect.map,false) -m str true
      redirect scheme https code 301 if ssl_redirect
  <% end -%>
  # }}}
  <% end -%>
  
  
negative.code:     timeout queue           <%= (p("ha_proxy.queue_timeout").to_f      * 1000).to_i %>ms
  
  <% if p("ha_proxy.stats_enable") -%>
    <%- 1.upto(p("ha_proxy.threads")) do |proc| %>
  listen stats_<%= proc %>
      bind <%= stat_prefix %><%= stat_port + (proc - 1) %>
      bind-process <%= proc %>
  