anchor.diff:      monitor-uri /health
       acl http-routers_down nbsrv(http-routers) eq 0
       monitor fail if http-routers_down
  -<% end %>
  +<% end -%>
   
   <% if_p("ha_proxy.resolvers") do |resolvers| -%>
   resolvers default
       hold valid <%= p("ha_proxy.dns_hold") %>
  -  <% resolvers.each do |resolver| %>
  -    nameserver <%= resolver.keys[0] %> <%= resolver.values[0] %>:53
  -  <% end -%>
  +  <%- resolvers.each do |resolver| -%>
  +    nameserver <%= resolver[0] %> <%= resolver[1] %>:53
  +  <%- end -%>
   <% end -%>
   
   <% unless p("ha_proxy.disable_http") -%>
  
positive.code: frontend http-in
      mode http
      bind <%= p("ha_proxy.binding_ip") %>:80
      <% if_p("ha_proxy.cidr_whitelist") do -%>
      acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
      tcp-request content accept if whitelist
      <% end -%>
      <% if_p("ha_proxy.cidr_blacklist") do -%>
      acl blacklist src -f /var/vcap/jobs/haproxy/config/blacklist_cidrs.txt
      tcp-request content reject if blacklist
      <% end -%>
      <% if p("ha_proxy.block_all") then -%>
      tcp-request content reject
      <% end -%>
  
      capture request header Host len 256
      default_backend http-routers
  <% if_p("ha_proxy.headers") do |headers| -%>
    <% headers.each do |header, value| -%>
      reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
    <% end -%>
  <% end -%>
  
  <% if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
    <% rsp_headers.each do |rsp_header, value| -%>
      rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.to_s.gsub(/(?!:\\) /, '\ ') %>
    <% end -%>
  <% end -%>
  
  <% if p("ha_proxy.internal_only_domains").size > 0 -%>
      acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
    <% p("ha_proxy.internal_only_domains").each do |domain| -%>
      acl internal hdr(Host) -m sub <%= domain %>
    <% end -%>
      http-request deny if internal !private
  <% end -%>
  
  <% p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
      <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
      acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
      use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  <% end -%>
      acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
      reqadd X-Forwarded-Proto:\ http if ! xfp_exists
  
  <% if p("ha_proxy.https_redirect_all") -%>
      redirect scheme https code 301 if !{ ssl_fc }
  <% end -%>
  <% unless p("ha_proxy.https_redirect_all") -%>
      acl ssl_redirect hdr(host),lower,map_end(/var/vcap/jobs/haproxy/config/ssl_redirect.map,false) -m str true
      redirect scheme https code 301 if ssl_redirect
  <% end -%>
  # }}}
  <% end -%>
  
  
negative.code:   }
  end -%>
  <% tcp.each do |tcp_proxy| -%>
  frontend tcp-frontend_<%= tcp_proxy["name"]%>
      mode tcp
    <%- if tcp_proxy["ssl"] -%>
      bind <%= p("ha_proxy.binding_ip") %>:<%= tcp_proxy["port"] %> <%= tls_bind_options %>
    <%- else -%>
      bind <%= p("ha_proxy.binding_ip") %>:<%= tcp_proxy["port"] %>
    <%- end -%>
      default_backend tcp-<%= tcp_proxy["name"] %>
  
  backend tcp-<%= tcp_proxy["name"] %>
      mode tcp
    <%- if tcp_proxy["balance"] -%>
      balance <%= tcp_proxy["balance"] %>
    <%- end -%>
  <%
    backend_port = tcp_proxy["port"]
    if tcp_proxy["backend_port"]
      backend_port = tcp_proxy["backend_port"]
    end
    resolvers = ""
    if_p("ha_proxy.resolvers") do
      resolvers = "resolvers default "
    end
    backend_ssl = ""
    if tcp_proxy["backend_ssl"] then
      if tcp_proxy["backend_ssl"].downcase == "verify" then
        backend_ssl = "ssl verify required ca-file /var/vcap/jobs/haproxy/config/backend-ca-certs.pem "
        if tcp_proxy["backend_verifyhost"] then
          backend_ssl += "verifyhost #{tcp_proxy["backend_verifyhost"]} "
        end
      elsif tcp_proxy["backend_ssl"].downcase == "noverify" then
        backend_ssl = "ssl verify none "
      end
    end
  -%>
    <%- tcp_proxy["backend_servers"].each_with_index do |ip, index| -%>
      server node<%= index %> <%= ip %>:<%= backend_port %> <%= resolvers -%>check inter 1000 <%= backend_ssl %>
    <%- end -%>
  
    <%- if tcp_proxy["health_check_http"] then -%>
  listen health_check_http_tcp-<%= tcp_proxy["name"] %>
      bind :<%= tcp_proxy["health_check_http"] %>
      mode http
      monitor-uri /health
      acl tcp-<%= tcp_proxy["name"] %>-routers_down nbsrv(tcp-<%= tcp_proxy["name"] %>) eq 0
      monitor fail if tcp-<%= tcp_proxy["name"] %>-routers_down
    <%- end -%>
  <% end -%>
  
  # }}}
  