anchor.diff:  backend http-routers
       mode http
       balance roundrobin
  -    <% if p("ha_proxy.compress_types") != "" -%>
  +  <%- if p("ha_proxy.compress_types") != "" -%>
       compression algo gzip
       compression type <%= p("ha_proxy.compress_types") %>
  -    <% end -%>
  -
  -    <%
  -    backend_servers = []
  -    backend_port = nil
  -    if_link("http_backend") do |backend|
  -        backend_servers = backend.instances.map(&:address)
  -        backend_port = backend.p("port", p("ha_proxy.backend_port"))
  -    end.else_if_p("ha_proxy.backend_servers") do |servers|
  -        backend_servers = servers
  -        backend_port = p("ha_proxy.backend_port")
  +  <%- end -%>
  +<%
  +  backend_servers = []
  +  backend_port = nil
  +  if_link("http_backend") do |backend|
  +    backend_servers = backend.instances.map(&:address)
  +    backend_port = backend.p("port", p("ha_proxy.backend_port"))
  +  end.else_if_p("ha_proxy.backend_servers") do |servers|
  +    backend_servers = servers
  +    backend_port = p("ha_proxy.backend_port")
  +  end
  +  resolvers = ""
  +  if_p("ha_proxy.resolvers") do
  +    resolvers = "resolvers default "
  +  end
  +  backend_crt = ""
  +  if_p("ha_proxy.backend_crt") do
  +    backend_crt = "crt /var/vcap/jobs/haproxy/config/backend-crt.pem "
  +  end
  +  backend_ssl = ""
  +  if p("ha_proxy.backend_ssl").downcase == "verify" then
  +    backend_ssl = "ssl verify required ca-file /var/vcap/jobs/haproxy/config/backend-ca-certs.pem "
  +    if_p("ha_proxy.backend_ssl_verifyhost") do | verify_hostname |
  +      backend_ssl += "verifyhost #{verify_hostname} "
       end
  -    -%>
  -
  -    <% backend_servers.each_with_index do |ip, index| -%>
  -        server node<%= index %> <%= ip %>:<%= backend_port %> <% if_p("ha_proxy.resolvers") do -%>
  -        resolvers default <% end -%>
  -        <% if_p("ha_proxy.backend_crt") do -%> crt  /var/vcap/jobs/haproxy/config/backend-crt.pem <% end -%>
  -        check inter 1000 <% if p("ha_proxy.backend_ssl").downcase == "verify" then -%>
  -        ssl verify required ca-file /var/vcap/jobs/haproxy/config/backend-ca-certs.pem <% if_p("ha_proxy.backend_ssl_verifyhost") do | verify_hostname | -%>
  -        verifyhost <%= verify_hostname %> <% end -%>
  -        <% elsif p("ha_proxy.backend_ssl").downcase == "noverify" then -%>
  -        ssl verify none <% end -%>
  -
  -    <% end -%>
  -# }}}
  +  elsif p("ha_proxy.backend_ssl").downcase == "noverify" then
  +    backend_ssl = "ssl verify none "
  +  end
  +-%>
  +  <%- backend_servers.each_with_index do |ip, index| -%>
  +    server node<%= index %> <%= ip %>:<%= backend_port -%> <%= resolvers -%><%= backend_crt -%>check inter 1000 <%= backend_ssl %>
  +  <%- end -%>
  +# }}}
  +
   # Routed Backends {{{
   <% p('ha_proxy.routed_backend_servers').each do |prefix, data| -%>
  -<% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
  +  <%- prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
   backend http-routed-backend-<%= prefix_hash %>
       mode http
       balance roundrobin
  -    <% if p("ha_proxy.compress_types") != "" -%>
  +  <%- if p("ha_proxy.compress_types") != "" -%>
       compression algo gzip
       compression type <%= p("ha_proxy.compress_types") %>
  -    <% end -%>
  -    <% data["servers"].each_with_index do |ip, index| -%>
  -        server node<%= index %> <%= ip %>:<%= data["port"] %> <% if_p("ha_proxy.resolvers") do -%>
  -        resolvers default <% end -%>
  -        check inter 1000 <% if data["backend_ssl"] then -%>
  -           <% if data["backend_ssl"].downcase == "verify" then -%>
  -             ssl verify required ca-file /var/vcap/jobs/haproxy/config/backend-ca-certs.pem <% if data["backend_verifyhost"] then -%>
  -             verifyhost <%= data["backend_verifyhost"] %> <% end -%>
  -           <% elsif data["backend_ssl"].downcase == "noverify" then -%>
  -             ssl verify none <% end -%>
  -        <% end -%>
  -
  -    <% end -%>
  -<% end -%>
  -# }}}
  +  <%- end -%>
  +<%
  +  resolvers = ""
  +  if_p("ha_proxy.resolvers") do
  +    resolvers = "resolvers default "
  +  end
  +  backend_ssl = ""
  +  if data["backend_ssl"] then
  +    if data["backend_ssl"].downcase == "verify" then
  +      backend_ssl = "ssl verify required ca-file /var/vcap/jobs/haproxy/config/backend-ca-certs.pem "
  +      if data["backend_verifyhost"] then
  +        backend_ssl += "verifyhost #{data["backend_verifyhost"]} "
  +      end
  +    elsif data["backend_ssl"].downcase == "noverify" then
  +      backend_ssl = "ssl verify none "
  +    end
  +  end
  +-%>
  +  <%- data["servers"].each_with_index do |ip, index| -%>
  +    server node<%= index %> <%= ip %>:<%= data["port"] %> <%= resolvers -%>check inter 1000 <%= backend_ssl %>
  +  <%- end -%>
  +<% end -%>
  +# }}}
  +
   # TCP Routing  {{{
   <% if_link("tcp_router") do |tcp_router| -%>
  +
   frontend cf_tcp_routing
  -  mode tcp
  -  bind <%= p("ha_proxy.binding_ip") %>:<%= p("ha_proxy.tcp_routing.port_range") %>
  -  default_backend cf_tcp_routers
  +    mode tcp
  +    bind <%= p("ha_proxy.binding_ip") %>:<%= p("ha_proxy.tcp_routing.port_range") %>
  +    default_backend cf_tcp_routers
  +
   backend cf_tcp_routers
  -  mode tcp
  -  <% tcp_router.instances.each_with_index do |instance, index| %>
  -  server node<%= index %> <%= instance.address %> check port 80 inter 1000
  -  <% end -%>
  +    mode tcp
  +  <%- tcp_router.instances.each_with_index do |instance, index| -%>
  +    server node<%= index %> <%= instance.address %> check port 80 inter 1000
  +  <%- end -%>
   <% end -%>
   
   # TCP Backends
  
positive.code: frontend wss-in
      mode http
      bind <%= p("ha_proxy.binding_ip") %>:4443 <%= tls_bind_options %>
      <% if_p("ha_proxy.cidr_whitelist") do -%>
      acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
      tcp-request content accept if whitelist
      <% end -%>
      <% if_p("ha_proxy.cidr_blacklist") do -%>
      acl blacklist src -f /var/vcap/jobs/haproxy/config/blacklist_cidrs.txt
      tcp-request content reject if blacklist
      <% end -%>
      <% if p("ha_proxy.block_all") then -%>
      tcp-request content reject
      <% end -%>
  
      <% if mutual_tls_enabled -%>
      http-request set-header X-Forwarded-Client-Cert %[ssl_c_der,base64]
      <% end -%>
  
      <% if p("ha_proxy.hsts_enable") -%>
      http-response set-header Strict-Transport-Security max-age=<%= p("ha_proxy.hsts_max_age").to_i %>;<% if p("ha_proxy.hsts_include_subdomains") %>\ includeSubDomains;<% end %><% if p("ha_proxy.hsts_preload") %>\ preload;<% end %>
      <% end -%>
      capture request header Host len 256
      default_backend http-routers
  <% if_p("ha_proxy.headers") do |headers| -%>
    <% headers.each do |header, value| -%>
      reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
    <% end -%>
  <% end -%>
  
  <% if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
    <% rsp_headers.each do |rsp_header, value| -%>
      rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
    <% end -%>
  <% end -%>
  
  <% if p("ha_proxy.internal_only_domains").size > 0 -%>
      acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
  <% p("ha_proxy.internal_only_domains").each do |domain| -%>
      acl internal hdr(Host) -m sub <%= domain %>
  <% end -%>
      http-request deny if internal !private
  <% end -%>
  
  <% p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
      <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
      acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
      use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  <% end -%>
      acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
      reqadd X-Forwarded-Proto:\ https if ! xfp_exists
  # }}}
  
negative.code:     monitor-uri /health
      acl http-routers_down nbsrv(http-routers) eq 0
      monitor fail if http-routers_down
  <% end -%>
  
  <% if_p("ha_proxy.resolvers") do |resolvers| -%>
  resolvers default
      hold valid <%= p("ha_proxy.dns_hold") %>
    <%- resolvers.each do |resolver| -%>
      nameserver <%= resolver[0] %> <%= resolver[1] %>:53
    <%- end -%>
  <% end -%>
  
  <% unless p("ha_proxy.disable_http") -%>
  