anchor.diff:  <% end %>
   
   server {
  -  listen <%= @ip %>:<%= @port %>;
  +  listen *:<%= @port %>;
     server_name <%= @host %>;
     server_tokens off;     # don't show the version number, a security best practice
     root <%= @path %>/public;
   
  +  ## Strong SSL Security
  +  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
     <% if @port == '443' %>
     ssl on;
     ssl_certificate <%= @ssl_certificate_path %>/<%= @host %>.crt;
     ssl_certificate_key <%= @ssl_certificate_key_path %>/<%= @host %>.key;
  -  ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
  -  ssl_prefer_server_ciphers on;
  +  ssl_ciphers 'AES256+EECDH:AES256+EDH';
  +
  +  ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
  +  ssl_session_cache  builtin:1000  shared:SSL:10m;
  +
  +  ssl_prefer_server_ciphers   on;
  +
  +  add_header Strict-Transport-Security max-age=63072000;
  +  add_header X-Frame-Options SAMEORIGIN;
  +  add_header X-Content-Type-Options nosniff;
     <% end %>
   
  -  # Increase this if you want to upload large attachments
  -  # Or if you want to accept large git objects over http
  +  ## Increase this if you want to upload large attachments
  +  ## Or if you want to accept large git objects over http
     client_max_body_size <%= @client_max_body_size %>;
   
  -  # individual nginx logs for this gitlab vhost
  +  ## Individual nginx logs for this GitLab vhost
     access_log  /var/log/nginx/gitlab_access.log;
     error_log   /var/log/nginx/gitlab_error.log;
   
     location / {
  -    # serve static files from defined root folder;.
  -    # @gitlab is a named location for the upstream fallback, see below
  +    ## Serve static files from defined root folder.
  +    ## @gitlab is a named location for the upstream fallback, see below.
       try_files $uri $uri/index.html $uri.html @gitlab;
     }
   
  -  # if a file, which is not found in the root folder is requested,
  -  # then the proxy pass the request to the upsteam (gitlab unicorn)
  +  ## If a file, which is not found in the root folder is requested,
  +  ## then the proxy passes the request to the upsteam (gitlab unicorn).
     location @gitlab {
  -    # If you use https make sure you disable gzip compression
  -    # to be safe against BREACH attack
  +    ## If you use HTTPS make sure you disable gzip compression
  +    ## to be safe against BREACH attack.
       <% if @port == '443' %>
       gzip off;
       <% end %>
   
  -    proxy_read_timeout 300; # Some requests take more than 30 seconds.
  -    proxy_connect_timeout 300; # Some requests take more than 30 seconds.
  -    proxy_redirect     off;
  +    ## https://github.com/gitlabhq/gitlabhq/issues/694
  +    ## Some requests take more than 30 seconds.
  +    proxy_read_timeout      300;
  +    proxy_connect_timeout   300;
  +    proxy_redirect          off;
   
       proxy_set_header   X-Forwarded-Proto $scheme;
       proxy_set_header   Host              $http_host;
       proxy_set_header   X-Real-IP         $remote_addr;
       proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
       proxy_set_header   X-Frame-Options   SAMEORIGIN;
  +    <% if @port == '443' %>
  +    proxy_set_header   X-Forwarded-Ssl     on;
  +    <% end %>
   
       proxy_pass http://gitlab;
     }
   
  -  # Enable gzip compression as per rails guide: http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
  -  # WARNING: If you are using relative urls do remove the block below
  -  # See config/application.rb under "Relative url support" for the list of
  -  # other files that need to be changed for relative url support
  -  location ~ ^/(assets)/  {
  +  ## Enable gzip compression as per rails guide:
  +  ## http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
  +  ## WARNING: If you are using relative urls remove the block below
  +  ## See config/application.rb under "Relative url support" for the list of
  +  ## other files that need to be changed for relative url support
  +  location ~ ^/(assets)/ {
       root <%= @path %>/public;
       gzip_static on; # to serve pre-gzipped version
       expires max;
  
positive.code: 
  <% if @port == '443' %>
  server {
    listen <%= @ip %>:80;
    server_name <%= @host %>;
    server_tokens off;
    return 301 https://<%= @host %>$request_uri;
  
negative.code: ## GitLab
  ## Maintainer: @randx
  ##
  ## Lines starting with two hashes (##) are comments with information.
  ## Lines starting with one hash (#) are configuration parameters that can be uncommented.
  ##
  ##################################
  ##        CHUNKED TRANSFER      ##
  ##################################
  ##
  ## It is a known issue that Git-over-HTTP requires chunked transfer encoding [0]
  ## which is not supported by Nginx < 1.3.9 [1]. As a result, pushing a large object
  ## with Git (i.e. a single large file) can lead to a 411 error. In theory you can get
  ## around this by tweaking this configuration file and either:
  ## - installing an old version of Nginx with the chunkin module [2] compiled in, or
  ## - using a newer version of Nginx.
  ##
  ## At the time of writing we do not know if either of these theoretical solutions works.
  ## As a workaround users can use Git over SSH to push large files.
  ##
  ## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99
  ## [1] https://github.com/agentzh/chunkin-nginx-module#status
  ## [2] https://github.com/agentzh/chunkin-nginx-module
  ##
  ###################################
  ##         configuration         ##
  ###################################
  ##
  ## See installation.md#using-https for additional HTTPS configuration details.
  
  upstream gitlab {
    server unix:/<%= @path %>/tmp/sockets/gitlab.socket;
  