v1.40.2-1

2026-11-05 11:15:22 +01:00
commit ba17d445ea
@@ -0,0 +1,4 @@
+# Downloaded upstream release binaries
+envoy-[0-9]*.[0-9]*.[0-9]*-linux-x86_64
+envoy-[0-9]*.[0-9]*.[0-9]*-linux-aarch_64
+checksums.txt.asc
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -0,0 +1,4 @@
+Envoy
+Copyright The Envoy Project Authors
+
+Licensed under Apache License 2.0.  See LICENSE for terms.
@@ -0,0 +1,145 @@
+# Envoy RPM Package
+
+Envoy proxy packaged from the upstream release binaries
+(`envoy-<version>-linux-x86_64` / `-linux-aarch_64`, standard build, not contrib).
+Intended to sit behind angie/nginx (TLS termination) and route to containers
+on the same host.
+
+```
+client → angie :443 (TLS) → envoy 127.0.0.1:10000 → containers 127.0.0.1:<port>
+```
+
+## Package structure
+
+| Package           | Contents                                                                 |
+|-------------------|--------------------------------------------------------------------------|
+| `envoy`           | `envoy` user (128:128), `/etc/envoy/{envoy,lds,cds}.yaml`, LICENSE/NOTICE |
+| `envoy-service`   | `/usr/libexec/envoy` binary, `envoy.service`, `/usr/bin/envoy` symlink   |
+| `envoy-container` | `envoy.container` quadlet (`Network=host`), `/usr/bin/envoy` shim (noarch) |
+
+`envoy-service` and `envoy-container` conflict; install one of them. Both
+restart `envoy.service` on upgrade.
+
+## Configuration
+
+| File                   | Content                     | Applied                    |
+|------------------------|-----------------------------|----------------------------|
+| `/etc/envoy/envoy.yaml`| bootstrap: admin, xDS paths | `systemctl restart envoy`  |
+| `/etc/envoy/lds.yaml`  | listeners and routes        | live, polled every 5s      |
+| `/etc/envoy/cds.yaml`  | clusters (upstreams)        | live, polled every 5s      |
+
+Defaults: listener `http` on `127.0.0.1:10000` (404 for everything), admin on
+`127.0.0.1:9901`, WebSocket upgrades enabled, access log to stdout (journal).
+
+One trusted proxy hop (`use_remote_address: true`, `xff_num_trusted_hops: 1`):
+the client address is the last `X-Forwarded-For` entry set by angie, passed
+upstream as `x-envoy-external-address`. `X-Forwarded-Proto` from angie is kept.
+Client-sent `x-envoy-*` headers are stripped from external requests. Since
+angie connects over loopback, Envoy appends the host's own address (not
+`127.0.0.1`) to `X-Forwarded-For`.
+
+LDS/CDS use `path_config_source.poll_interval`, so files can be edited in place
+(no atomic `mv` needed). Only changed content is applied.
+
+- An invalid `lds.yaml`/`cds.yaml` is rejected; the last good configuration
+  stays active. Check `journalctl -u envoy`.
+- `envoy --mode validate -c /etc/envoy/envoy.yaml` checks only the bootstrap,
+  not `lds.yaml`/`cds.yaml`.
+- A route referencing a cluster not yet in `cds.yaml` is rejected
+  (`unknown cluster`). When adding both, save `cds.yaml` first; otherwise one
+  warning is logged and the listener is applied on the next poll.
+- Admin state: `curl -s localhost:9901/ready`, `/clusters`, `/listeners`,
+  `/config_dump`.
+
+### Adding a container backend
+
+`cds.yaml`:
+
+```yaml
+resources:
+- "@type": type.googleapis.com/envoy.config.cluster.v3.Cluster
+  name: app
+  type: STATIC
+  connect_timeout: 5s
+  load_assignment:
+    cluster_name: app
+    endpoints:
+    - lb_endpoints:
+      - endpoint:
+          address:
+            socket_address: { address: 127.0.0.1, port_value: 8080 }
+```
+
+`lds.yaml`, add a virtual host before `default`:
+
+```yaml
+          - name: app
+            domains: ["app.example.com"]
+            routes:
+            - match: { prefix: "/" }
+              route: { cluster: app }
+```
+
+### angie/nginx in front
+
+```nginx
+location / {
+    proxy_pass http://127.0.0.1:10000;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+}
+```
+
+## Service (`envoy-service`)
+
+- `Type=simple`; Envoy has no sd_notify support.
+- `ExecStartPre` validates the bootstrap; runs as `envoy` with
+  `CAP_NET_BIND_SERVICE` (ports < 1024 allowed).
+- `--disable-hot-restart`: single instance, restarts are plain restarts.
+
+```bash
+dnf install envoy-service
+systemctl enable --now envoy
+```
+
+## Container (`envoy-container`)
+
+- Image `docker.io/envoyproxy/envoy:v<version>` (Ubuntu based), `Network=host`.
+- `/etc/envoy` mounted read-only. The image entrypoint remaps its `envoy` user
+  to `ENVOY_UID/ENVOY_GID=128`, matching the host user, and drops root. Ports
+  < 1024 are therefore not bindable in the container variant.
+- Health: bash `/dev/tcp` request to admin `/ready` (image has no curl),
+  `Notify=healthy`, `HealthOnFailure=kill`.
+- Enabled at boot via `/etc/containers/systemd/envoy.container.d/enable.conf`.
+- `/usr/bin/envoy` shim runs `podman run --rm` of the same image, so
+  `envoy --mode validate -c /etc/envoy/envoy.yaml` works while the container is
+  stopped. Run as root.
+
+```bash
+dnf install envoy-container
+systemctl daemon-reload
+systemctl start envoy
+```
+
+## Updating
+
+1. Bump `Version:` in `envoy.spec`. The image tag in `envoy.container` and the
+   shim follows automatically (`@VERSION@` substituted in `%install`).
+2. Download and verify the release binaries:
+
+```bash
+v=1.40.2
+base=https://github.com/envoyproxy/envoy/releases/download/v$v
+for f in envoy-$v-linux-x86_64 envoy-$v-linux-aarch_64 checksums.txt.asc; do
+    curl -sSfLO "$base/$f"
+done
+grep -E "envoy-$v-linux-(x86_64|aarch_64)$" checksums.txt.asc | sha256sum -c
+gpg --verify checksums.txt.asc   # key: thirdparty/envoy/envoy-maintainers-public.key
+```
+
+3. Refresh `LICENSE`/`NOTICE` from `thirdparty/envoy` if changed, add a
+   `%changelog` entry.
@@ -0,0 +1,17 @@
+# Envoy clusters (CDS)
+#
+# Applied live within 5s of saving. An invalid file is rejected and the last
+# good configuration stays active; check: journalctl -u envoy
+
+resources:
+# - "@type": type.googleapis.com/envoy.config.cluster.v3.Cluster
+#   name: app
+#   type: STATIC
+#   connect_timeout: 5s
+#   load_assignment:
+#     cluster_name: app
+#     endpoints:
+#     - lb_endpoints:
+#       - endpoint:
+#           address:
+#             socket_address: { address: 127.0.0.1, port_value: 8080 }
@@ -0,0 +1,2 @@
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,5 @@
+#!/bin/sh
+exec /usr/bin/podman run --rm -i --network=host \
+	-v /etc/envoy:/etc/envoy:ro,z \
+	-e ENVOY_UID=128 -e ENVOY_GID=128 \
+	docker.io/envoyproxy/envoy:v@VERSION@ envoy "$@"
@@ -0,0 +1,29 @@
+[Unit]
+Description=Envoy Proxy
+Documentation=https://www.envoyproxy.io/docs/envoy/latest/
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=docker.io/envoyproxy/envoy:v@VERSION@
+ContainerName=envoy
+Network=host
+Volume=/etc/envoy:/etc/envoy:ro,z
+Volume=/etc/localtime:/etc/localtime:ro
+Environment=ENVOY_UID=128
+Environment=ENVOY_GID=128
+Exec=envoy -c /etc/envoy/envoy.yaml --disable-hot-restart
+Ulimit=nofile=1048576:1048576
+Notify=healthy
+HealthCmd=bash -c 'exec 3<>/dev/tcp/127.0.0.1/9901 && { echo "GET /ready HTTP/1.1"; echo "Host: localhost"; echo "Connection: close"; echo; } >&3 && grep -q LIVE <&3'
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=5
+HealthStartPeriod=30s
+HealthOnFailure=kill
+LogDriver=journald
+
+[Service]
+Restart=always
+RestartSec=5
+TimeoutStartSec=900
@@ -0,0 +1,21 @@
+[Unit]
+Description=Envoy Proxy
+Documentation=https://www.envoyproxy.io/docs/envoy/latest/
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=envoy
+Group=envoy
+ExecStartPre=/usr/libexec/envoy --mode validate -c /etc/envoy/envoy.yaml --log-level warn
+ExecStart=/usr/libexec/envoy -c /etc/envoy/envoy.yaml --disable-hot-restart
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=yes
+LimitNOFILE=1048576
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,146 @@
+# Upstream release binaries are already stripped
+%global debug_package %{nil}
+
+Name:           envoy
+Version:        1.40.2
+Release:        1%{?dist}
+Summary:        Envoy - cloud-native edge and service proxy
+License:        Apache-2.0
+URL:            https://www.envoyproxy.io
+
+Source0:        https://github.com/envoyproxy/envoy/releases/download/v%{version}/envoy-%{version}-linux-x86_64
+Source1:        https://github.com/envoyproxy/envoy/releases/download/v%{version}/envoy-%{version}-linux-aarch_64
+Source2:        LICENSE
+Source3:        NOTICE
+Source10:       envoy.service
+Source11:       envoy.sysusers
+Source12:       envoy.yaml
+Source13:       lds.yaml
+Source14:       cds.yaml
+Source15:       envoy.container
+Source16:       envoy-shim
+Source17:       envoy-container-enable.conf
+
+ExclusiveArch:  x86_64 aarch64
+
+BuildRequires:  systemd-rpm-macros
+
+%description
+Envoy is an L7 proxy and communication bus designed for large modern
+service oriented architectures. This base package ships the envoy user and
+the configuration in /etc/envoy: a bootstrap (envoy.yaml) plus listeners
+(lds.yaml) and clusters (cds.yaml) that are reloaded live on change.
+
+%package service
+Summary:        Envoy systemd service (native binary)
+Requires:       %{name} = %{version}-%{release}
+Conflicts:      %{name}-container
+%{?systemd_requires}
+
+%description service
+Runs Envoy as a native binary under systemd. Includes the upstream release
+binary and the systemd unit.
+
+%package container
+Summary:        Envoy container (Podman quadlet)
+BuildArch:      noarch
+Requires:       %{name} = %{version}-%{release}
+Requires:       podman
+Requires:       containers-common
+Conflicts:      %{name}-service
+
+%description container
+Runs Envoy as a Podman container via quadlet, using host networking. Includes
+the container definition and an envoy CLI shim that runs the same image.
+
+%install
+# Binary (for -service subpackage) → libexec
+install -d -m 755 %{buildroot}%{_libexecdir}
+%ifarch x86_64
+install -m 755 %{SOURCE0} %{buildroot}%{_libexecdir}/envoy
+%endif
+
+%ifarch aarch64
+install -m 755 %{SOURCE1} %{buildroot}%{_libexecdir}/envoy
+%endif
+
+# Shim (for -container subpackage)
+sed 's|@VERSION@|%{version}|g' %{SOURCE16} > envoy-shim
+install -m 755 envoy-shim %{buildroot}%{_libexecdir}/envoy-container
+
+# Base: license, sysusers, config
+install -p -m 644 %{SOURCE2} %{SOURCE3} .
+install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/envoy.conf
+
+install -d -m 750 %{buildroot}%{_sysconfdir}/envoy
+install -p -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/envoy/envoy.yaml
+install -p -m 640 %{SOURCE13} %{buildroot}%{_sysconfdir}/envoy/lds.yaml
+install -p -m 640 %{SOURCE14} %{buildroot}%{_sysconfdir}/envoy/cds.yaml
+
+# Service subpackage
+install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/envoy.service
+
+# Container subpackage
+sed 's|@VERSION@|%{version}|g' %{SOURCE15} > envoy.container
+install -p -D -m 644 envoy.container %{buildroot}%{_datadir}/containers/systemd/envoy.container
+install -p -D -m 644 %{SOURCE17} %{buildroot}%{_sysconfdir}/containers/systemd/envoy.container.d/enable.conf
+
+%pre
+%sysusers_create_compat %{SOURCE11}
+
+%post service
+%systemd_post envoy.service
+
+%posttrans service
+ln -sf %{_libexecdir}/envoy %{_bindir}/envoy
+
+%preun service
+%systemd_preun envoy.service
+
+%postun service
+%systemd_postun_with_restart envoy.service
+if [ $1 -eq 0 ]; then
+    rm -f %{_bindir}/envoy
+fi
+
+%post container
+%systemd_post envoy.service
+
+%posttrans container
+ln -sf %{_libexecdir}/envoy-container %{_bindir}/envoy
+
+%preun container
+%systemd_preun envoy.service
+
+%postun container
+%systemd_postun_with_restart envoy.service
+if [ $1 -eq 0 ]; then
+    rm -f %{_bindir}/envoy
+fi
+
+%files
+%license LICENSE NOTICE
+%{_sysusersdir}/envoy.conf
+%dir %attr(0750,root,envoy) %{_sysconfdir}/envoy
+%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/envoy.yaml
+%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/lds.yaml
+%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/cds.yaml
+
+%files service
+%{_libexecdir}/envoy
+%ghost %{_bindir}/envoy
+%{_unitdir}/envoy.service
+
+%files container
+%{_libexecdir}/envoy-container
+%ghost %{_bindir}/envoy
+%{_datadir}/containers/systemd/envoy.container
+%dir %{_sysconfdir}/containers/systemd/envoy.container.d
+%config(noreplace) %{_sysconfdir}/containers/systemd/envoy.container.d/enable.conf
+
+%changelog
+* Tue Nov 03 2026 Zoran Pericic <zpericic@netst.org> - 1.40.2-1
+- Initial package with service and container subpackages
+- File-based LDS/CDS in /etc/envoy, polled and applied live
+- Trust one proxy hop (angie/nginx) for X-Forwarded-For
+- Restart envoy.service on upgrade; -container is noarch
@@ -0,0 +1,2 @@
+g envoy 128
+u envoy 128:128 "Envoy Proxy" - -
@@ -0,0 +1,34 @@
+# Envoy bootstrap configuration
+#
+# Listeners and clusters are loaded from lds.yaml and cds.yaml. Both files are
+# polled and applied live when their content changes, no restart needed.
+# Changes to this file require: systemctl restart envoy
+#
+# Validate: envoy --mode validate -c /etc/envoy/envoy.yaml
+
+node:
+  id: envoy
+  cluster: envoy
+
+admin:
+  address:
+    socket_address: { address: 127.0.0.1, port_value: 9901 }
+
+dynamic_resources:
+  cds_config:
+    resource_api_version: V3
+    path_config_source:
+      path: /etc/envoy/cds.yaml
+      poll_interval: 5s
+  lds_config:
+    resource_api_version: V3
+    path_config_source:
+      path: /etc/envoy/lds.yaml
+      poll_interval: 5s
+
+overload_manager:
+  resource_monitors:
+  - name: envoy.resource_monitors.global_downstream_max_connections
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+      max_active_downstream_connections: 50000
@@ -0,0 +1,44 @@
+# Envoy listeners (LDS)
+#
+# Applied live within 5s of saving. An invalid file is rejected and the last
+# good configuration stays active; check: journalctl -u envoy
+#
+# Clusters referenced by routes must exist in cds.yaml.
+
+resources:
+- "@type": type.googleapis.com/envoy.config.listener.v3.Listener
+  name: http
+  address:
+    socket_address: { address: 127.0.0.1, port_value: 10000 }
+  filter_chains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        stat_prefix: http
+        # Behind angie/nginx: client address is the last X-Forwarded-For entry
+        use_remote_address: true
+        xff_num_trusted_hops: 1
+        upgrade_configs:
+        - upgrade_type: websocket
+        access_log:
+        - name: envoy.access_loggers.stdout
+          typed_config:
+            "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
+        route_config:
+          name: local
+          virtual_hosts:
+          # - name: app
+          #   domains: ["app.example.com"]
+          #   routes:
+          #   - match: { prefix: "/" }
+          #     route: { cluster: app }
+          - name: default
+            domains: ["*"]
+            routes:
+            - match: { prefix: "/" }
+              direct_response: { status: 404 }
+        http_filters:
+        - name: envoy.filters.http.router
+          typed_config:
+            "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router