anchor.diff:  
   strict_sni = ""
   if_p("ha_proxy.strict_sni") do |sni|
  -  if sni == true
  +  if sni
       strict_sni = "strict-sni"
     end
   end
   
   tls_options = "#{crt_config} #{strict_sni}"
  -if mutual_tls_enabled == true
  +if mutual_tls_enabled
     tls_options = "#{tls_options} ca-file #{client_ca_certs} verify optional"
     if_p("ha_proxy.client_cert_ignore_err") do |ignore_errs|
       tls_options = "#{tls_options} crt-ignore-err #{ignore_errs}"
  
positive.code:     tcp-request content reject
      <% end -%>
  
      <% if mutual_tls_enabled == true -%>
      http-request set-header X-Forwarded-Client-Cert %[ssl_c_der,base64]
      <% end -%>
  
  
negative.code:     acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
      reqadd X-Forwarded-Proto:\ http if ! xfp_exists
  
  <% if p("ha_proxy.https_redirect_all") -%>
      redirect scheme https code 301 if !{ ssl_fc }
  <% end -%>
  <% unless p("ha_proxy.https_redirect_all") -%>
      acl ssl_redirect hdr(host),lower,map_end(/var/vcap/jobs/haproxy/config/ssl_redirect.map,false) -m str true
      redirect scheme https code 301 if ssl_redirect
  <% end -%>
  # }}}
  <% end -%>
  
  <% if ssl_enabled -%>
  # HTTPS Frontend {{{
  frontend https-in
      mode http
  