# Envoy Gateway Configuration for Zero-Trust WebAuthn Architecture
# Auto-generated by @vmenon25/mcp-server-webauthn-client
#
# This configuration provides:
# - JWT authentication for protected routes (/api/*)
# - Public routes for WebAuthn operations (no JWT required)
# - CORS support for web clients
# - Load balancing to backend services

static_resources:
  listeners:
    - name: main_listener
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 8000
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                codec_type: AUTO
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: backend
                      domains: ["*"]
                      routes:
                        # Public routes (no JWT required)
                        - match:
                            prefix: "/register"
                          route:
                            cluster: webauthn_server
                        - match:
                            prefix: "/authenticate"
                          route:
                            cluster: webauthn_server
                        - match:
                            prefix: "/.well-known/jwks.json"
                          route:
                            cluster: webauthn_server
                        - match:
                            prefix: "/health"
                          route:
                            cluster: webauthn_server
                        - match:
                            prefix: "/"
                            headers:
                              - name: ":path"
                                string_match:
                                  exact: "/"
                          route:
                            cluster: webauthn_server

                        # Protected routes (JWT required) - Explicit routes only
                        - match:
                            prefix: "/api/example"
                          route:
                            cluster: example_service
                        - match:
                            prefix: "/api/user"
                          route:
                            cluster: example_service

                http_filters:
                  # JWT Authentication filter
                  - name: envoy.filters.http.jwt_authn
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
                      providers:
                        webauthn_provider:
                          issuer: "mpo-webauthn"
                          audiences:
                            - "webauthn-clients"
                          remote_jwks:
                            http_uri:
                              uri: http://webauthn-server:8080/.well-known/jwks.json
                              cluster: webauthn_server
                              timeout: 5s
                            # JWKS cache duration (configured in generator, default: 300 seconds / 5 minutes)
                            cache_duration:
                              seconds: {{jwks_cache_duration_seconds}}
                          forward: true
                      rules:
                        # Require JWT for /api/* routes
                        - match:
                            prefix: "/api"
                          requires:
                            provider_name: webauthn_provider

                  # CORS filter
                  - name: envoy.filters.http.cors
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors

                  # Router filter (must be last)
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

  clusters:
    - name: webauthn_server
      connect_timeout: 0.25s
      type: STRICT_DNS
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: webauthn_server
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: webauthn-server
                      port_value: 8080

    - name: example_service
      connect_timeout: 0.25s
      type: STRICT_DNS
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: example_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: example-service-sidecar
                      port_value: 9000
      # mTLS configuration (connects to Istio sidecar)
      # Phase 2: Envoy Gateway uses mTLS to connect to example-service sidecar
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          common_tls_context:
            # Gateway's client certificate (for mTLS)
            tls_certificates:
              - certificate_chain:
                  filename: /etc/envoy/certs/gateway-cert.pem
                private_key:
                  filename: /etc/envoy/certs/gateway-key.pem
            # Trusted CA (validates service certificates)
            validation_context:
              trusted_ca:
                filename: /etc/envoy/certs/ca-cert.pem

admin:
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 9901