commit ba17d445eacb5fcaab3d2468bacc854caa9ebb3f Author: Zoran Peričić Date: Thu Nov 5 11:15:22 2026 +0100 v1.40.2-1 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9c5b61e --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +# Downloaded upstream release binaries +envoy-[0-9]*.[0-9]*.[0-9]*-linux-x86_64 +envoy-[0-9]*.[0-9]*.[0-9]*-linux-aarch_64 +checksums.txt.asc diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..8604a8b --- /dev/null +++ b/NOTICE @@ -0,0 +1,4 @@ +Envoy +Copyright The Envoy Project Authors + +Licensed under Apache License 2.0. See LICENSE for terms. diff --git a/README.md b/README.md new file mode 100644 index 0000000..1acfd96 --- /dev/null +++ b/README.md @@ -0,0 +1,145 @@ +# Envoy RPM Package + +Envoy proxy packaged from the upstream release binaries +(`envoy--linux-x86_64` / `-linux-aarch_64`, standard build, not contrib). +Intended to sit behind angie/nginx (TLS termination) and route to containers +on the same host. + +``` +client → angie :443 (TLS) → envoy 127.0.0.1:10000 → containers 127.0.0.1: +``` + +## Package structure + +| Package | Contents | +|-------------------|--------------------------------------------------------------------------| +| `envoy` | `envoy` user (128:128), `/etc/envoy/{envoy,lds,cds}.yaml`, LICENSE/NOTICE | +| `envoy-service` | `/usr/libexec/envoy` binary, `envoy.service`, `/usr/bin/envoy` symlink | +| `envoy-container` | `envoy.container` quadlet (`Network=host`), `/usr/bin/envoy` shim (noarch) | + +`envoy-service` and `envoy-container` conflict; install one of them. Both +restart `envoy.service` on upgrade. + +## Configuration + +| File | Content | Applied | +|------------------------|-----------------------------|----------------------------| +| `/etc/envoy/envoy.yaml`| bootstrap: admin, xDS paths | `systemctl restart envoy` | +| `/etc/envoy/lds.yaml` | listeners and routes | live, polled every 5s | +| `/etc/envoy/cds.yaml` | clusters (upstreams) | live, polled every 5s | + +Defaults: listener `http` on `127.0.0.1:10000` (404 for everything), admin on +`127.0.0.1:9901`, WebSocket upgrades enabled, access log to stdout (journal). + +One trusted proxy hop (`use_remote_address: true`, `xff_num_trusted_hops: 1`): +the client address is the last `X-Forwarded-For` entry set by angie, passed +upstream as `x-envoy-external-address`. `X-Forwarded-Proto` from angie is kept. +Client-sent `x-envoy-*` headers are stripped from external requests. Since +angie connects over loopback, Envoy appends the host's own address (not +`127.0.0.1`) to `X-Forwarded-For`. + +LDS/CDS use `path_config_source.poll_interval`, so files can be edited in place +(no atomic `mv` needed). Only changed content is applied. + +- An invalid `lds.yaml`/`cds.yaml` is rejected; the last good configuration + stays active. Check `journalctl -u envoy`. +- `envoy --mode validate -c /etc/envoy/envoy.yaml` checks only the bootstrap, + not `lds.yaml`/`cds.yaml`. +- A route referencing a cluster not yet in `cds.yaml` is rejected + (`unknown cluster`). When adding both, save `cds.yaml` first; otherwise one + warning is logged and the listener is applied on the next poll. +- Admin state: `curl -s localhost:9901/ready`, `/clusters`, `/listeners`, + `/config_dump`. + +### Adding a container backend + +`cds.yaml`: + +```yaml +resources: +- "@type": type.googleapis.com/envoy.config.cluster.v3.Cluster + name: app + type: STATIC + connect_timeout: 5s + load_assignment: + cluster_name: app + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: { address: 127.0.0.1, port_value: 8080 } +``` + +`lds.yaml`, add a virtual host before `default`: + +```yaml + - name: app + domains: ["app.example.com"] + routes: + - match: { prefix: "/" } + route: { cluster: app } +``` + +### angie/nginx in front + +```nginx +location / { + proxy_pass http://127.0.0.1:10000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; +} +``` + +## Service (`envoy-service`) + +- `Type=simple`; Envoy has no sd_notify support. +- `ExecStartPre` validates the bootstrap; runs as `envoy` with + `CAP_NET_BIND_SERVICE` (ports < 1024 allowed). +- `--disable-hot-restart`: single instance, restarts are plain restarts. + +```bash +dnf install envoy-service +systemctl enable --now envoy +``` + +## Container (`envoy-container`) + +- Image `docker.io/envoyproxy/envoy:v` (Ubuntu based), `Network=host`. +- `/etc/envoy` mounted read-only. The image entrypoint remaps its `envoy` user + to `ENVOY_UID/ENVOY_GID=128`, matching the host user, and drops root. Ports + < 1024 are therefore not bindable in the container variant. +- Health: bash `/dev/tcp` request to admin `/ready` (image has no curl), + `Notify=healthy`, `HealthOnFailure=kill`. +- Enabled at boot via `/etc/containers/systemd/envoy.container.d/enable.conf`. +- `/usr/bin/envoy` shim runs `podman run --rm` of the same image, so + `envoy --mode validate -c /etc/envoy/envoy.yaml` works while the container is + stopped. Run as root. + +```bash +dnf install envoy-container +systemctl daemon-reload +systemctl start envoy +``` + +## Updating + +1. Bump `Version:` in `envoy.spec`. The image tag in `envoy.container` and the + shim follows automatically (`@VERSION@` substituted in `%install`). +2. Download and verify the release binaries: + +```bash +v=1.40.2 +base=https://github.com/envoyproxy/envoy/releases/download/v$v +for f in envoy-$v-linux-x86_64 envoy-$v-linux-aarch_64 checksums.txt.asc; do + curl -sSfLO "$base/$f" +done +grep -E "envoy-$v-linux-(x86_64|aarch_64)$" checksums.txt.asc | sha256sum -c +gpg --verify checksums.txt.asc # key: thirdparty/envoy/envoy-maintainers-public.key +``` + +3. Refresh `LICENSE`/`NOTICE` from `thirdparty/envoy` if changed, add a + `%changelog` entry. diff --git a/cds.yaml b/cds.yaml new file mode 100644 index 0000000..92835be --- /dev/null +++ b/cds.yaml @@ -0,0 +1,17 @@ +# Envoy clusters (CDS) +# +# Applied live within 5s of saving. An invalid file is rejected and the last +# good configuration stays active; check: journalctl -u envoy + +resources: +# - "@type": type.googleapis.com/envoy.config.cluster.v3.Cluster +# name: app +# type: STATIC +# connect_timeout: 5s +# load_assignment: +# cluster_name: app +# endpoints: +# - lb_endpoints: +# - endpoint: +# address: +# socket_address: { address: 127.0.0.1, port_value: 8080 } diff --git a/envoy-container-enable.conf b/envoy-container-enable.conf new file mode 100644 index 0000000..f612d8f --- /dev/null +++ b/envoy-container-enable.conf @@ -0,0 +1,2 @@ +[Install] +WantedBy=multi-user.target diff --git a/envoy-shim b/envoy-shim new file mode 100644 index 0000000..72c9f5d --- /dev/null +++ b/envoy-shim @@ -0,0 +1,5 @@ +#!/bin/sh +exec /usr/bin/podman run --rm -i --network=host \ + -v /etc/envoy:/etc/envoy:ro,z \ + -e ENVOY_UID=128 -e ENVOY_GID=128 \ + docker.io/envoyproxy/envoy:v@VERSION@ envoy "$@" diff --git a/envoy.container b/envoy.container new file mode 100644 index 0000000..c1ca2fe --- /dev/null +++ b/envoy.container @@ -0,0 +1,29 @@ +[Unit] +Description=Envoy Proxy +Documentation=https://www.envoyproxy.io/docs/envoy/latest/ +After=network-online.target +Wants=network-online.target + +[Container] +Image=docker.io/envoyproxy/envoy:v@VERSION@ +ContainerName=envoy +Network=host +Volume=/etc/envoy:/etc/envoy:ro,z +Volume=/etc/localtime:/etc/localtime:ro +Environment=ENVOY_UID=128 +Environment=ENVOY_GID=128 +Exec=envoy -c /etc/envoy/envoy.yaml --disable-hot-restart +Ulimit=nofile=1048576:1048576 +Notify=healthy +HealthCmd=bash -c 'exec 3<>/dev/tcp/127.0.0.1/9901 && { echo "GET /ready HTTP/1.1"; echo "Host: localhost"; echo "Connection: close"; echo; } >&3 && grep -q LIVE <&3' +HealthInterval=30s +HealthTimeout=10s +HealthRetries=5 +HealthStartPeriod=30s +HealthOnFailure=kill +LogDriver=journald + +[Service] +Restart=always +RestartSec=5 +TimeoutStartSec=900 diff --git a/envoy.service b/envoy.service new file mode 100644 index 0000000..790a0fe --- /dev/null +++ b/envoy.service @@ -0,0 +1,21 @@ +[Unit] +Description=Envoy Proxy +Documentation=https://www.envoyproxy.io/docs/envoy/latest/ +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +User=envoy +Group=envoy +ExecStartPre=/usr/libexec/envoy --mode validate -c /etc/envoy/envoy.yaml --log-level warn +ExecStart=/usr/libexec/envoy -c /etc/envoy/envoy.yaml --disable-hot-restart +AmbientCapabilities=CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +NoNewPrivileges=yes +LimitNOFILE=1048576 +Restart=always +RestartSec=3 + +[Install] +WantedBy=multi-user.target diff --git a/envoy.spec b/envoy.spec new file mode 100644 index 0000000..44bd2bf --- /dev/null +++ b/envoy.spec @@ -0,0 +1,146 @@ +# Upstream release binaries are already stripped +%global debug_package %{nil} + +Name: envoy +Version: 1.40.2 +Release: 1%{?dist} +Summary: Envoy - cloud-native edge and service proxy +License: Apache-2.0 +URL: https://www.envoyproxy.io + +Source0: https://github.com/envoyproxy/envoy/releases/download/v%{version}/envoy-%{version}-linux-x86_64 +Source1: https://github.com/envoyproxy/envoy/releases/download/v%{version}/envoy-%{version}-linux-aarch_64 +Source2: LICENSE +Source3: NOTICE +Source10: envoy.service +Source11: envoy.sysusers +Source12: envoy.yaml +Source13: lds.yaml +Source14: cds.yaml +Source15: envoy.container +Source16: envoy-shim +Source17: envoy-container-enable.conf + +ExclusiveArch: x86_64 aarch64 + +BuildRequires: systemd-rpm-macros + +%description +Envoy is an L7 proxy and communication bus designed for large modern +service oriented architectures. This base package ships the envoy user and +the configuration in /etc/envoy: a bootstrap (envoy.yaml) plus listeners +(lds.yaml) and clusters (cds.yaml) that are reloaded live on change. + +%package service +Summary: Envoy systemd service (native binary) +Requires: %{name} = %{version}-%{release} +Conflicts: %{name}-container +%{?systemd_requires} + +%description service +Runs Envoy as a native binary under systemd. Includes the upstream release +binary and the systemd unit. + +%package container +Summary: Envoy container (Podman quadlet) +BuildArch: noarch +Requires: %{name} = %{version}-%{release} +Requires: podman +Requires: containers-common +Conflicts: %{name}-service + +%description container +Runs Envoy as a Podman container via quadlet, using host networking. Includes +the container definition and an envoy CLI shim that runs the same image. + +%install +# Binary (for -service subpackage) → libexec +install -d -m 755 %{buildroot}%{_libexecdir} +%ifarch x86_64 +install -m 755 %{SOURCE0} %{buildroot}%{_libexecdir}/envoy +%endif + +%ifarch aarch64 +install -m 755 %{SOURCE1} %{buildroot}%{_libexecdir}/envoy +%endif + +# Shim (for -container subpackage) +sed 's|@VERSION@|%{version}|g' %{SOURCE16} > envoy-shim +install -m 755 envoy-shim %{buildroot}%{_libexecdir}/envoy-container + +# Base: license, sysusers, config +install -p -m 644 %{SOURCE2} %{SOURCE3} . +install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/envoy.conf + +install -d -m 750 %{buildroot}%{_sysconfdir}/envoy +install -p -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/envoy/envoy.yaml +install -p -m 640 %{SOURCE13} %{buildroot}%{_sysconfdir}/envoy/lds.yaml +install -p -m 640 %{SOURCE14} %{buildroot}%{_sysconfdir}/envoy/cds.yaml + +# Service subpackage +install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/envoy.service + +# Container subpackage +sed 's|@VERSION@|%{version}|g' %{SOURCE15} > envoy.container +install -p -D -m 644 envoy.container %{buildroot}%{_datadir}/containers/systemd/envoy.container +install -p -D -m 644 %{SOURCE17} %{buildroot}%{_sysconfdir}/containers/systemd/envoy.container.d/enable.conf + +%pre +%sysusers_create_compat %{SOURCE11} + +%post service +%systemd_post envoy.service + +%posttrans service +ln -sf %{_libexecdir}/envoy %{_bindir}/envoy + +%preun service +%systemd_preun envoy.service + +%postun service +%systemd_postun_with_restart envoy.service +if [ $1 -eq 0 ]; then + rm -f %{_bindir}/envoy +fi + +%post container +%systemd_post envoy.service + +%posttrans container +ln -sf %{_libexecdir}/envoy-container %{_bindir}/envoy + +%preun container +%systemd_preun envoy.service + +%postun container +%systemd_postun_with_restart envoy.service +if [ $1 -eq 0 ]; then + rm -f %{_bindir}/envoy +fi + +%files +%license LICENSE NOTICE +%{_sysusersdir}/envoy.conf +%dir %attr(0750,root,envoy) %{_sysconfdir}/envoy +%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/envoy.yaml +%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/lds.yaml +%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/cds.yaml + +%files service +%{_libexecdir}/envoy +%ghost %{_bindir}/envoy +%{_unitdir}/envoy.service + +%files container +%{_libexecdir}/envoy-container +%ghost %{_bindir}/envoy +%{_datadir}/containers/systemd/envoy.container +%dir %{_sysconfdir}/containers/systemd/envoy.container.d +%config(noreplace) %{_sysconfdir}/containers/systemd/envoy.container.d/enable.conf + +%changelog +* Tue Nov 03 2026 Zoran Pericic - 1.40.2-1 +- Initial package with service and container subpackages +- File-based LDS/CDS in /etc/envoy, polled and applied live +- Trust one proxy hop (angie/nginx) for X-Forwarded-For +- Restart envoy.service on upgrade; -container is noarch diff --git a/envoy.sysusers b/envoy.sysusers new file mode 100644 index 0000000..19e763e --- /dev/null +++ b/envoy.sysusers @@ -0,0 +1,2 @@ +g envoy 128 +u envoy 128:128 "Envoy Proxy" - - diff --git a/envoy.yaml b/envoy.yaml new file mode 100644 index 0000000..39944cb --- /dev/null +++ b/envoy.yaml @@ -0,0 +1,34 @@ +# Envoy bootstrap configuration +# +# Listeners and clusters are loaded from lds.yaml and cds.yaml. Both files are +# polled and applied live when their content changes, no restart needed. +# Changes to this file require: systemctl restart envoy +# +# Validate: envoy --mode validate -c /etc/envoy/envoy.yaml + +node: + id: envoy + cluster: envoy + +admin: + address: + socket_address: { address: 127.0.0.1, port_value: 9901 } + +dynamic_resources: + cds_config: + resource_api_version: V3 + path_config_source: + path: /etc/envoy/cds.yaml + poll_interval: 5s + lds_config: + resource_api_version: V3 + path_config_source: + path: /etc/envoy/lds.yaml + poll_interval: 5s + +overload_manager: + resource_monitors: + - name: envoy.resource_monitors.global_downstream_max_connections + typed_config: + "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig + max_active_downstream_connections: 50000 diff --git a/lds.yaml b/lds.yaml new file mode 100644 index 0000000..dd0d8bd --- /dev/null +++ b/lds.yaml @@ -0,0 +1,44 @@ +# Envoy listeners (LDS) +# +# Applied live within 5s of saving. An invalid file is rejected and the last +# good configuration stays active; check: journalctl -u envoy +# +# Clusters referenced by routes must exist in cds.yaml. + +resources: +- "@type": type.googleapis.com/envoy.config.listener.v3.Listener + name: http + address: + socket_address: { address: 127.0.0.1, port_value: 10000 } + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: http + # Behind angie/nginx: client address is the last X-Forwarded-For entry + use_remote_address: true + xff_num_trusted_hops: 1 + upgrade_configs: + - upgrade_type: websocket + access_log: + - name: envoy.access_loggers.stdout + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + route_config: + name: local + virtual_hosts: + # - name: app + # domains: ["app.example.com"] + # routes: + # - match: { prefix: "/" } + # route: { cluster: app } + - name: default + domains: ["*"] + routes: + - match: { prefix: "/" } + direct_response: { status: 404 } + http_filters: + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router