anchor.diff:    listen <%= listen_address %>:<%= @port %>;
   <% end %>
     server_name <%= @fqdn %>;
  -  server_tokens off;     # don't show the version number, a security best practice
  +  server_tokens off; ## Don't show the nginx version number, a security best practice
     root /opt/gitlab/embedded/service/gitlab-rails/public;
  -
  -  <% if @https %>
  -  ssl on;
  -  ssl_certificate <%= @ssl_certificate %>;
  -  ssl_certificate_key <%= @ssl_certificate_key %>;
  -  ssl_ciphers '<%= @ssl_ciphers %>';
  -  ssl_prefer_server_ciphers <%= @ssl_prefer_server_ciphers %>;
  -  ssl_protocols  <%= @ssl_protocols %>;
  -  ssl_session_cache  <%= @ssl_session_cache %>;
  -  ssl_session_timeout  <%= @ssl_session_timeout %>;
  -  <% end %>
   
     ## Increase this if you want to upload large attachments
     ## Or if you want to accept large git objects over http
     client_max_body_size <%= @client_max_body_size %>;
  +    
  +  <% if @https %>
  +  ## Strong SSL Security
  +  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
  +  ssl on;
  +  ssl_certificate <%= @ssl_certificate %>;
  +  ssl_certificate_key <%= @ssl_certificate_key %>;
  +
  +  # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
  +  ssl_ciphers '<%= @ssl_ciphers %>';
  +  ssl_protocols  <%= @ssl_protocols %>;
  +  ssl_prefer_server_ciphers <%= @ssl_prefer_server_ciphers %>;
  +  ssl_session_cache  <%= @ssl_session_cache %>;
  +  ssl_session_timeout  <%= @ssl_session_timeout %>;
  +  <% end %>
   
     ## Individual nginx logs for this GitLab vhost
     access_log  <%= @log_directory %>/gitlab_access.log;
  
positive.code: # and run `sudo gitlab-ctl reconfigure`.
  
  ## GitLab
  ## Maintainer: @randx
  ##
  ## Lines starting with two hashes (##) are comments with information.
  ## Lines starting with one hash (#) are configuration parameters that can be uncommented.
  
negative.code: ###################################
  ##         configuration         ##
  ###################################
  
  upstream gitlab {
    server unix:<%= @socket %> fail_timeout=0;
  }
  
  <% if @https && @redirect_http_to_https %>
  ## Redirects all HTTP traffic to the HTTPS host
  server {
  <% @listen_addresses.each do |listen_address| %>
    listen <%= listen_address %>:<%= @redirect_http_to_https_port %>;
  <% end %>
    server_name <%= @fqdn %>;
    server_tokens off; ## Don't show the nginx version number, a security best practice
    return 301 https://<%= @fqdn %>:<%= @port %>$request_uri;
    access_log  <%= @log_directory %>/gitlab_access.log;
    error_log   <%= @log_directory %>/gitlab_error.log;
  