anchor.diff:      <% end -%>
   <% end -%>
   # }}}
  -
  -# TCP Routing  {{{
  -<% if_link("tcp_router") do |tcp_router| %>
  +# TCP Routing  {{{ 
  +<% if_link("tcp_router") do |tcp_router| -%>
   frontend cf_tcp_routing
     mode tcp
     bind <%= p("ha_proxy.binding_ip") %>:<%= p("ha_proxy.tcp_routing.port_range") %>
  
positive.code:     <% end -%>
      capture request header Host len 256
      default_backend http-routers
  <%
  if_p("ha_proxy.headers") do |headers|
    headers.each do |header, value|
  %>
      reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  <%
    end
  end
  %>
  
  <%
  if_p("ha_proxy.rsp_headers") do |rsp_headers|
    rsp_headers.each do |rsp_header, value|
  -%>
      rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  <%
    end
  end
  -%>
  
  <% if p("ha_proxy.internal_only_domains").size > 0 %>
      acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
  <% p("ha_proxy.internal_only_domains").each do |domain| %>
      acl internal hdr(Host) -m sub <%= domain %>
  <% end %>
      http-request deny if internal !private
  <% end %>
  
  <% p('ha_proxy.routed_backend_servers').keys.each do |prefix| %>
  <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] %>
    acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
    use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  <% end %>
      acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
      reqadd X-Forwarded-Proto:\ https if ! xfp_exists
  # }}}
  <% end %>
  
  # Default Backend {{{
  backend http-routers
      mode http
      balance roundrobin
      <% if p("ha_proxy.compress_types") != "" %>
      compression algo gzip
      compression type <%= p("ha_proxy.compress_types") %>
      <% end %>
  
      <%
      backend_servers = []
  
negative.code: end
  
  client_ca_certs = "/etc/ssl/certs/ca-certificates.crt"
  if_p("ha_proxy.client_ca_file") do
    client_ca_certs = "/var/vcap/jobs/haproxy/config/client-ca-certs.pem"
  end
  
  strict_sni = ""
  if_p("ha_proxy.strict_sni") do |sni|
    if sni == true
      strict_sni = "strict-sni"
    end
  end
  
  tls_options = "#{crt_config} #{strict_sni}"
  