anchor.diff:  # [environment envlist]
   # [method methodlist]
   # [auth[enthicated] {yes|no|on|off|any}]
  -# allow [host|backreference|*]
  -# deny [host|backreference|*]
  +# allow [host|backreference|*|regex]
  +# deny [host|backreference|*|regex]
   # allow_ip [ip|cidr|ip_wildcard|*]
   # deny_ip [ip|cidr|ip_wildcard|*]
   #
  -# The path match can either be a simple prefix match or a regular 
  +# The path match can either be a simple prefix match or a regular
   # expression. `path /file` would match both `/file_metadata` and
   # `/file_content`. Regex matches allow the use of backreferences
   # in the allow/deny directives.
  -# 
  +#
   # The regex syntax is the same as for Ruby regex, and captures backreferences
   # for use in the `allow` and `deny` lines of that stanza
   #
   # Examples:
  -# path ~ ^/path/to/resource    # equivalent to `path /path/to/resource`
  -# allow *
   #
  -# path ~ ^/catalog/([^/]+)$    # permit access only for the
  -# allow $1                     # node whose cert matches the path
  +# path ~ ^/path/to/resource    # Equivalent to `path /path/to/resource`.
  +# allow *                      # Allow all authenticated nodes (since auth
  +#                              # defaults to `yes`).
  +#
  +# path ~ ^/catalog/([^/]+)$    # Permit nodes to access their own catalog (by
  +# allow $1                     # certname), but not any other node's catalog.
  +#
  +# path ~ ^/file_(metadata|content)/extra_files/  # Only allow certain nodes to
  +# auth yes                                       # access the "extra_files"
  +# allow /^(.+)\.example\.com$/                   # mount point; note this must
  +# allow_ip 192.168.100.0/24                      # go ABOVE the "/file" rule,
  +#                                                # since it is more specific.
   #
   # environment:: restrict an ACL to a comma-separated list of environments
   # method:: restrict an ACL to a comma-separated list of HTTP methods
  
positive.code: method save
  allow *
  
  # unconditionally allow access to all file services
  # which means in practice that fileserver.conf will
  # still be used
  path /file
  allow *
  
  ### Unauthenticated ACL, for clients for which the current master doesn't
  ### have a valid certificate; we allow authenticated users, too, because
  ### there isn't a great harm in letting that request through.
  
  # allow access to the master CA
  path /certificate/ca
  auth any
  method find
  allow *
  
  path /certificate/
  auth any
  method find
  allow *
  
  path /certificate_request
  auth any
  method find, save
  
negative.code: # This is the default auth.conf file, which implements the default rules
  # used by the puppet master. (That is, the rules below will still apply
  # even if this file is deleted.)
  #
  # The ACLs are evaluated in top-down order. More specific stanzas should
  # be towards the top of the file and more general ones at the bottom;
  # otherwise, the general rules may "steal" requests that should be
  # governed by the specific rules.
  #
  # See http://docs.puppetlabs.com/guides/rest_auth_conf.html for a more complete
  # description of auth.conf's behavior.
  #
  # Supported syntax:
  # Each stanza in auth.conf starts with a path to match, followed
  # by optional modifiers, and finally, a series of allow or deny
  # directives.
  #
  # Example Stanza
  # ---------------------------------
  