[Unit]
Description=Envoy Proxy
Documentation=https://www.envoyproxy.io/docs/envoy/latest/
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=envoy
Group=envoy
ExecStartPre=/usr/libexec/envoy --mode validate -c /etc/envoy/envoy.yaml --log-level warn
ExecStart=/usr/libexec/envoy -c /etc/envoy/envoy.yaml --disable-hot-restart
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
LimitNOFILE=1048576
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target