# Envoy Sidecar for Example Service (Istio-style mTLS)
# Auto-generated by @vmenon25/mcp-server-webauthn-client
#
# This Envoy sidecar provides:
# - mTLS termination (requires valid client certificate from Envoy Gateway)
# - Proxying to local application on port 9001
# - Zero-trust service mesh security
#
# Architecture:
#   Envoy Gateway (port 8000) --mTLS--> Envoy Sidecar (port 9000) --HTTP--> App (port 9001)
#
static_resources:
  listeners:
    - name: service_listener
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 9000  # External port (accessed by gateway)
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: service_http
                codec_type: AUTO
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: local_service
                      domains: ["*"]
                      routes:
                        # Proxy all traffic to local application
                        - match:
                            prefix: "/"
                          route:
                            cluster: local_app
                http_filters:
                  # Router filter (required, must be last)
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
          # mTLS termination - require client certificate
          transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              require_client_certificate: true  # Enforce mTLS
              common_tls_context:
                # Service's own certificate
                tls_certificates:
                  - certificate_chain:
                      filename: /etc/certs/service-cert.pem
                    private_key:
                      filename: /etc/certs/service-key.pem
                # Trusted CA (validates client certificates)
                validation_context:
                  trusted_ca:
                    filename: /etc/certs/ca-cert.pem

  clusters:
    - name: local_app
      connect_timeout: 0.25s
      type: STATIC
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: local_app
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      # Localhost - shares network namespace with app container
                      address: 127.0.0.1
                      port_value: 9001  # Application listens here

admin:
  address:
    socket_address:
      address: 127.0.0.1
      port_value: 9902  # Admin interface (sidecar)