anchor.diff:      monitor fail if http-routers_down
   <% end %>
   
  -<%# HTTP Frontend %>
  -
  -<%
  -if_p("ha_proxy.resolvers") do |resolvers|
  -%>
  +<% if_p("ha_proxy.resolvers") do |resolvers| -%>
   resolvers default
       hold valid <%= p("ha_proxy.dns_hold") %>
  -<%
  -    resolvers.each do |resolver|
  -%>
  +  <% resolvers.each do |resolver| %>
       nameserver <%= resolver.keys[0] %> <%= resolver.values[0] %>:53
  -<%
  -  end
  -end
  -%>
  -
  -
  -<% unless p("ha_proxy.disable_http") %>
  +  <% end -%>
  +<% end -%>
  +
  +<% unless p("ha_proxy.disable_http") -%>
  +# HTTP Frontend {{{
   frontend http-in
       mode http
       bind <%= p("ha_proxy.binding_ip") %>:80 <%= accept_proxy %>
       <% if_p("ha_proxy.cidr_whitelist") do -%>
       acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
       tcp-request content accept if whitelist
  -    <% end %>
  -    <% if_p("ha_proxy.cidr_blacklist") do %>
  +    <% end -%>
  +    <% if_p("ha_proxy.cidr_blacklist") do -%>
       acl blacklist src -f /var/vcap/jobs/haproxy/config/blacklist_cidrs.txt
       tcp-request content reject if blacklist
  -    <% end %>
  -    <% if p("ha_proxy.block_all") then %>
  +    <% end -%>
  +    <% if p("ha_proxy.block_all") then -%>
       tcp-request content reject
  -    <% end %>
  +    <% end -%>
   
       capture request header Host len 256
       default_backend http-routers
  -<%
  -if_p("ha_proxy.headers") do |headers|
  -  headers.each do |header, value|
  -%>
  +<% if_p("ha_proxy.headers") do |headers| -%>
  +  <% headers.each do |header, value| -%>
       reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  -<%
  -  end
  -end
  -%>
  -
  -<%
  -if_p("ha_proxy.rsp_headers") do |rsp_headers|
  -  rsp_headers.each do |rsp_header, value|
  -%>
  +  <% end -%>
  +<% end -%>
  +
  +<% if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
  +  <% rsp_headers.each do |rsp_header, value| -%>
       rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  -<%
  -  end
  -end
  -%>
  -
  -<% if p("ha_proxy.internal_only_domains").size > 0 %>
  +  <% end -%>
  +<% end -%>
  +
  +<% if p("ha_proxy.internal_only_domains").size > 0 -%>
       acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
  -<% p("ha_proxy.internal_only_domains").each do |domain| %>
  +  <% p("ha_proxy.internal_only_domains").each do |domain| -%>
       acl internal hdr(Host) -m sub <%= domain %>
  -<% end %>
  +  <% end -%>
       http-request deny if internal !private
  -<% end %>
  -
  -<% p('ha_proxy.routed_backend_servers').keys.each do |prefix| %>
  -<% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] %>
  +<% end -%>
  +
  +<% p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
  +    <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
       acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
       use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  -<% end %>
  +<% end -%>
       acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
       reqadd X-Forwarded-Proto:\ http if ! xfp_exists
   
  -<% if p("ha_proxy.https_redirect_all") == true %>
  +<% if p("ha_proxy.https_redirect_all") == true -%>
       redirect scheme https code 301 if !{ ssl_fc }
  -<% end %>
  -<% unless p("ha_proxy.https_redirect_all") == true %>
  +<% end -%>
  +<% unless p("ha_proxy.https_redirect_all") == true -%>
       acl ssl_redirect hdr(host),lower,map_end(/var/vcap/jobs/haproxy/config/ssl_redirect.map,false) -m str true
       redirect scheme https code 301 if ssl_redirect
  -<% end %>
  -
  -<% end %>
  -
  -<%# HTTPS Frontend %>
  +<% end -%>
  +# }}}
  +<% end -%>
   
   <% if ssl_enabled == true -%>
  -# HTTPS Frontend
  +# HTTPS Frontend {{{
   frontend https-in
       mode http
       bind <%= p("ha_proxy.binding_ip") %>:443 <%= tls_bind_options %>
  -
       <% if_p("ha_proxy.cidr_whitelist") do -%>
       acl whitelist src -f /var/vcap/jobs/haproxy/config/whitelist_cidrs.txt
       tcp-request content accept if whitelist
  -    <% end %>
  -    <% if_p("ha_proxy.cidr_blacklist") do %>
  +    <% end -%>
  +    <% if_p("ha_proxy.cidr_blacklist") do -%>
       acl blacklist src -f /var/vcap/jobs/haproxy/config/blacklist_cidrs.txt
       tcp-request content reject if blacklist
  -    <% end %>
  -    <% if p("ha_proxy.block_all") then %>
  +    <% end -%>
  +    <% if p("ha_proxy.block_all") then -%>
       tcp-request content reject
  -    <% end %>
  +    <% end -%>
   
       <% if mutual_tls_enabled == true -%>
       http-request set-header X-Forwarded-Client-Cert %[ssl_c_der,base64]
  -    <% end %>
  -
  -    <% if p("ha_proxy.hsts_enable") %>
  +    <% end -%>
  +
  +    <% if p("ha_proxy.hsts_enable") -%>
       http-response set-header Strict-Transport-Security max-age=<%= p("ha_proxy.hsts_max_age").to_i %>;<% if p("ha_proxy.hsts_include_subdomains") %>\ includeSubDomains;<% end %><% if p("ha_proxy.hsts_preload") %>\ preload;<% end %>
  -    <% end %>
  +    <% end -%>
       capture request header Host len 256
       default_backend http-routers
  -<%
  -if_p("ha_proxy.headers") do |headers|
  -  headers.each do |header, value|
  -%>
  +<% if_p("ha_proxy.headers") do |headers| -%>
  +  <% headers.each do |header, value| -%>
       reqadd <%= header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  -<%
  -  end
  -end
  -%>
  -
  -<%
  -if_p("ha_proxy.rsp_headers") do |rsp_headers|
  -  rsp_headers.each do |rsp_header, value|
  -%>
  +  <% end -%>
  +<% end -%>
  +
  +<% if_p("ha_proxy.rsp_headers") do |rsp_headers| -%>
  +  <%  rsp_headers.each do |rsp_header, value| -%>
       rspadd <%= rsp_header.gsub(/(?!:\\)( )/, '\ ') %>:\ <%= value.gsub(/(?!:\\) /, '\ ') %>
  -<%
  -  end
  -end
  -%>
  -
  -<% if p("ha_proxy.internal_only_domains").size > 0 %>
  +  <% end -%>
  +<% end -%>
  +
  +<% if p("ha_proxy.internal_only_domains").size > 0 -%>
       acl private src <%= p("ha_proxy.trusted_domain_cidrs") %>
  -<% p("ha_proxy.internal_only_domains").each do |domain| %>
  +<% p("ha_proxy.internal_only_domains").each do |domain| -%>
       acl internal hdr(Host) -m sub <%= domain %>
  -<% end %>
  +<% end -%>
       http-request deny if internal !private
  -<% end %>
  -
  -<% p('ha_proxy.routed_backend_servers').keys.each do |prefix| %>
  -<% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] %>
  -  acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
  -  use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  -<% end %>
  +<% end -%>
  +
  +<% p('ha_proxy.routed_backend_servers').keys.each do |prefix| -%>
  +  <% prefix_hash = (Digest::SHA256.hexdigest prefix.to_s)[0..5] -%>
  +    acl routed_backend_<%= prefix_hash %> path_beg <%= prefix %>
  +    use_backend http-routed-backend-<%= prefix_hash %> if routed_backend_<%= prefix_hash %>
  +<% end -%>
       acl xfp_exists hdr_cnt(X-Forwarded-Proto) gt 0
       reqadd X-Forwarded-Proto:\ https if ! xfp_exists
   
  -<% end %>
  -
  -<%# HTTPS Websockets Frontend %>
  -
  -<% if p("ha_proxy.enable_4443") == true %>
  +# }}}
  +<% end -%>
  +
  +<% if p("ha_proxy.enable_4443") == true -%>
  +# HTTPS Websockets Frontend {{{
   frontend wss-in
       mode http
       bind <%= p("ha_proxy.binding_ip") %>:4443 <%= tls_bind_options %>
  
positive.code:         <% end -%>
    <% end -%>
  
    <% if tcp_proxy["health_check_http"] then %>
  listen health_check_http_tcp-<%= tcp_proxy["name"] %>
      bind :<%= tcp_proxy["health_check_http"] %>
      mode http
  
negative.code: global
      log <%= p('ha_proxy.syslog_server') %> syslog <%= p('ha_proxy.log_level') %>
      daemon
      <% if p("ha_proxy.threads") > 1 -%>
      nbproc <%= p("ha_proxy.threads") %>
      <% end -%>
      user vcap
      group vcap
      maxconn 64000
      spread-checks 4
      tune.ssl.default-dh-param <%= p("ha_proxy.default_dh_param") %>
      tune.bufsize <%= p("ha_proxy.buffer_size_bytes") %>
      <% if p("ha_proxy.threads") > 1 -%>
        <% 1.upto(p("ha_proxy.threads")) do |proc| -%>
      stats socket /var/vcap/sys/run/haproxy/stats<%= proc%>.sock mode 600 level admin process <%= proc%>
        <% end -%>
      <% else -%>
      stats socket /var/vcap/sys/run/haproxy/stats.sock mode 600 level admin
      <% end -%>
      stats timeout 2m
      ssl-default-bind-options <%= ssl_flags %>
      ssl-default-bind-ciphers <%= p("ha_proxy.ssl_ciphers") %>
  