anchor.diff:    ssl_protocols                 SSLv3 TLSv1 TLSv1.1 TLSv1.2;
     ssl_ciphers                   AES:HIGH:!ADH:!MDF;
     ssl_prefer_server_ciphers     on;
  +
   <% end %>
  -
   
     # individual nginx logs for this gitlab vhost
     access_log  /var/log/nginx/gitlab_access.log;
  
positive.code:   listen *:80 default_server;
    server_name <%= @fqdn %>;
    server_tokens off;
    root /nowhere; 
    rewrite ^ https://$server_name$request_uri permanent;
  
  <% else %>
  server {
    listen *:443 ssl default_server;
    server_name <%= @fqdn %>;
  
negative.code: ## MANAGED BY PUPPET
  
  upstream gitlab {
    server unix:/home/git/gitlab/tmp/sockets/gitlab.socket;
  }
  
  # setup server with or without https depending on gitlab::gitlab_ssl variable
  