# Upstream release binaries are already stripped
%global debug_package %{nil}

Name:           envoy
Version:        1.40.2
Release:        1%{?dist}
Summary:        Envoy - cloud-native edge and service proxy
License:        Apache-2.0
URL:            https://www.envoyproxy.io

Source0:        https://github.com/envoyproxy/envoy/releases/download/v%{version}/envoy-%{version}-linux-x86_64
Source1:        https://github.com/envoyproxy/envoy/releases/download/v%{version}/envoy-%{version}-linux-aarch_64
Source2:        LICENSE
Source3:        NOTICE
Source10:       envoy.service
Source11:       envoy.sysusers
Source12:       envoy.yaml
Source13:       lds.yaml
Source14:       cds.yaml
Source15:       envoy.container
Source16:       envoy-shim
Source17:       envoy-container-enable.conf

ExclusiveArch:  x86_64 aarch64

BuildRequires:  systemd-rpm-macros

%description
Envoy is an L7 proxy and communication bus designed for large modern
service oriented architectures. This base package ships the envoy user and
the configuration in /etc/envoy: a bootstrap (envoy.yaml) plus listeners
(lds.yaml) and clusters (cds.yaml) that are reloaded live on change.

%package service
Summary:        Envoy systemd service (native binary)
Requires:       %{name} = %{version}-%{release}
Conflicts:      %{name}-container
%{?systemd_requires}

%description service
Runs Envoy as a native binary under systemd. Includes the upstream release
binary and the systemd unit.

%package container
Summary:        Envoy container (Podman quadlet)
BuildArch:      noarch
Requires:       %{name} = %{version}-%{release}
Requires:       podman
Requires:       containers-common
Conflicts:      %{name}-service

%description container
Runs Envoy as a Podman container via quadlet, using host networking. Includes
the container definition and an envoy CLI shim that runs the same image.

%install
# Binary (for -service subpackage) → libexec
install -d -m 755 %{buildroot}%{_libexecdir}
%ifarch x86_64
install -m 755 %{SOURCE0} %{buildroot}%{_libexecdir}/envoy
%endif

%ifarch aarch64
install -m 755 %{SOURCE1} %{buildroot}%{_libexecdir}/envoy
%endif

# Shim (for -container subpackage)
sed 's|@VERSION@|%{version}|g' %{SOURCE16} > envoy-shim
install -m 755 envoy-shim %{buildroot}%{_libexecdir}/envoy-container

# Base: license, sysusers, config
install -p -m 644 %{SOURCE2} %{SOURCE3} .
install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/envoy.conf

install -d -m 750 %{buildroot}%{_sysconfdir}/envoy
install -p -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/envoy/envoy.yaml
install -p -m 640 %{SOURCE13} %{buildroot}%{_sysconfdir}/envoy/lds.yaml
install -p -m 640 %{SOURCE14} %{buildroot}%{_sysconfdir}/envoy/cds.yaml

# Service subpackage
install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/envoy.service

# Container subpackage
sed 's|@VERSION@|%{version}|g' %{SOURCE15} > envoy.container
install -p -D -m 644 envoy.container %{buildroot}%{_datadir}/containers/systemd/envoy.container
install -p -D -m 644 %{SOURCE17} %{buildroot}%{_sysconfdir}/containers/systemd/envoy.container.d/enable.conf

%pre
%sysusers_create_compat %{SOURCE11}

%post service
%systemd_post envoy.service

%posttrans service
ln -sf %{_libexecdir}/envoy %{_bindir}/envoy

%preun service
%systemd_preun envoy.service

%postun service
%systemd_postun_with_restart envoy.service
if [ $1 -eq 0 ]; then
    rm -f %{_bindir}/envoy
fi

%post container
%systemd_post envoy.service

%posttrans container
ln -sf %{_libexecdir}/envoy-container %{_bindir}/envoy

%preun container
%systemd_preun envoy.service

%postun container
%systemd_postun_with_restart envoy.service
if [ $1 -eq 0 ]; then
    rm -f %{_bindir}/envoy
fi

%files
%license LICENSE NOTICE
%{_sysusersdir}/envoy.conf
%dir %attr(0750,root,envoy) %{_sysconfdir}/envoy
%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/envoy.yaml
%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/lds.yaml
%config(noreplace) %attr(0640,root,envoy) %{_sysconfdir}/envoy/cds.yaml

%files service
%{_libexecdir}/envoy
%ghost %{_bindir}/envoy
%{_unitdir}/envoy.service

%files container
%{_libexecdir}/envoy-container
%ghost %{_bindir}/envoy
%{_datadir}/containers/systemd/envoy.container
%dir %{_sysconfdir}/containers/systemd/envoy.container.d
%config(noreplace) %{_sysconfdir}/containers/systemd/envoy.container.d/enable.conf

%changelog
* Tue Nov 03 2026 Zoran Pericic <zpericic@netst.org> - 1.40.2-1
- Initial package with service and container subpackages
- File-based LDS/CDS in /etc/envoy, polled and applied live
- Trust one proxy hop (angie/nginx) for X-Forwarded-For
- Restart envoy.service on upgrade; -container is noarch