anchor.diff:  LoadModule ssl_module modules/mod_ssl.so
  -
  +<% if @puppet_central_ca -%>
  +LoadModule proxy_http_module modules/mod_proxy_http.so
  +<% end -%>
   Listen <%= puppet_passenger_port %>
   
   <VirtualHost *:<%= puppet_passenger_port %>>
  
positive.code: <% @proxy_allow_from.each do |host| -%>
      Allow from <%= host %>
  <% end -%>
      Deny from all
    </Proxy>
  
    ProxyVia On
  
negative.code:   SSLVerifyClient         optional
    SSLVerifyDepth          1
    SSLOptions              +StdEnvVars
  
  
    RequestHeader unset X-Forwarded-For
  
    RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
  