force $ssl=true if $ssl_only, otherwise generates broken config