anchor.diff:      proxy_connect_timeout   300;
       proxy_redirect          off;
   
  -    proxy_set_header   X-Forwarded-Proto $scheme;
  -    proxy_set_header   Host              $http_host;
  -    proxy_set_header   X-Real-IP         $remote_addr;
  -    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
  -    proxy_set_header   X-Frame-Options   SAMEORIGIN;
  +    proxy_set_header    Host                $http_host;
  +    proxy_set_header    X-Real-IP           $remote_addr;
  +    <% if @https %>
  +    proxy_set_header    X-Forwarded-Ssl     on;
  +    <% end %>
  +    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
  +    proxy_set_header    X-Forwarded-Proto   $scheme;
  +    proxy_set_header    X-Frame-Options     SAMEORIGIN;
   
  -    <% if @https %>
  -    proxy_set_header   X-Forwarded-Ssl     on;
  -    <% end %>
       proxy_pass http://gitlab;
     }
   
  
positive.code: # and run `sudo gitlab-ctl reconfigure`.
  
  ## GitLab
  ## Maintainer: @randx
  ##
  ## Lines starting with two hashes (##) are comments with information.
  ## Lines starting with one hash (#) are configuration parameters that can be uncommented.
  
negative.code:   listen <%= listen_address %>:<%= @port %>;
  <% end %>
    server_name <%= @fqdn %>;
    server_tokens off; ## Don't show the nginx version number, a security best practice
    root /opt/gitlab/embedded/service/gitlab-rails/public;
  
    ## Increase this if you want to upload large attachments
    ## Or if you want to accept large git objects over http
    client_max_body_size <%= @client_max_body_size %>;
      
    <% if @https %>
    ## Strong SSL Security
    ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
    ssl on;
    ssl_certificate <%= @ssl_certificate %>;
    ssl_certificate_key <%= @ssl_certificate_key %>;
  
    # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
    ssl_ciphers '<%= @ssl_ciphers %>';
    ssl_protocols  <%= @ssl_protocols %>;
    ssl_prefer_server_ciphers <%= @ssl_prefer_server_ciphers %>;
    ssl_session_cache  <%= @ssl_session_cache %>;
    ssl_session_timeout  <%= @ssl_session_timeout %>;
    <% end %>
  
    ## Individual nginx logs for this GitLab vhost
    access_log  <%= @log_directory %>/gitlab_access.log;
  