anchor.diff:      tcp-request content reject
       <% end -%>
   
  -    <% if mutual_tls_enabled == true -%>
  +    <% if mutual_tls_enabled -%>
       http-request set-header X-Forwarded-Client-Cert %[ssl_c_der,base64]
       <% end -%>
   
  
positive.code:     acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
      reqadd X-Forwarded-Proto:\ http if ! xfp_exists
  
  <% if p("ha_proxy.https_redirect_all") == true -%>
      redirect scheme https code 301 if !{ ssl_fc }
  <% end -%>
  <% unless p("ha_proxy.https_redirect_all") == true -%>
      acl ssl_redirect hdr(host),lower,map_end(/var/vcap/jobs/haproxy/config/ssl_redirect.map,false) -m str true
      redirect scheme https code 301 if ssl_redirect
  <% end -%>
  # }}}
  <% end -%>
  
  <% if ssl_enabled == true -%>
  # HTTPS Frontend {{{
  frontend https-in
      mode http
  
negative.code:     end
  end
  if_p("ha_proxy.crt_list") do
      if ssl_enabled
          abort("Conflicting configuration. Please configure either 'ssl_pem' OR 'crt_list', but not both")
      end
      ssl_enabled=true
  