anchor.diff:        proxy_set_header X-NginX-Proxy true;
         proxy_pass http://<%= spec['backend'] %>;
         <%- if balancer['allowed'] -%>
  +      <%- if has_proto_protocol? -%>
  +      if ( $allowed_<%= id %> = "deny" ) { return 403; }
  +      <%- else -%>
         <%- (balancer['allowed'] || []).each do |x| -%>
         allow <%= x %>;
         <%- end -%>
         deny all;
  +      <%- end -%>
         <%- end -%>
       }
         <%- end -%>
  
positive.code:       # step: add the site to the list of provisioned sites
        sites[key] = name
    -%>
    server {
      <%- if has_proto_protocol? -%>
      listen <%= service[:port] %> proxy_protocol;
  
negative.code:   <%-
      sites = {}
      http_services.each do |service|
        id       = "#{service[:name]}_#{service[:port]}"
        name     = service[:name]
        balancer = service[:balancer]
        vhost    = balancer['vhost'] || 'default'
  