123 lines
4.4 KiB
YAML
123 lines
4.4 KiB
YAML
static_resources:
|
|
# --8<-- [start:listener]
|
|
listeners:
|
|
- name: listener_0
|
|
address:
|
|
socket_address:
|
|
address: 0.0.0.0
|
|
port_value: 10000
|
|
# --8<-- [end:listener]
|
|
filter_chains:
|
|
- filter_chain_match:
|
|
server_names: ["*.john-stream.com"]
|
|
# --8<-- [start:transport_socket]
|
|
- transport_socket:
|
|
name: envoy.transport_sockets.tls
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
|
|
require_client_certificate: true
|
|
common_tls_context:
|
|
tls_params:
|
|
tls_minimum_protocol_version: TLSv1_3 # (1)!
|
|
validation_context:
|
|
trusted_ca: { filename: /certs/root_ca.crt }
|
|
match_typed_subject_alt_names:
|
|
- san_type: URI
|
|
matcher:
|
|
prefix: spiffe://john-stream.com # (2)!
|
|
tls_certificates:
|
|
- certificate_chain: { filename: /certs/cert.pem }
|
|
private_key: { filename: /certs/key_pkcs8.pem } # (3)!
|
|
# --8<-- [end:transport_socket]
|
|
filters:
|
|
- name: envoy.filters.network.http_connection_manager
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
stat_prefix: ingress_http
|
|
use_remote_address: true
|
|
http2_protocol_options:
|
|
max_concurrent_streams: 100
|
|
# --8<-- [start:access_log]
|
|
access_log:
|
|
- name: envoy.access_loggers.file
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
|
|
path: "/var/log/envoy/access.log"
|
|
# --8<-- [end:access_log]
|
|
# --8<-- [start:cluster_route]
|
|
route_config:
|
|
name: local_route
|
|
virtual_hosts:
|
|
- name: local_service
|
|
domains: ["*"]
|
|
routes:
|
|
- match:
|
|
prefix: "/"
|
|
route:
|
|
cluster: restic
|
|
# --8<-- [end:cluster_route]
|
|
http_filters:
|
|
# --8<-- [start:rbac]
|
|
- name: envoy.filters.http.rbac
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
|
|
rules:
|
|
action: ALLOW
|
|
policies:
|
|
"ubuntu-policy":
|
|
permissions:
|
|
- and_rules:
|
|
rules:
|
|
- header:
|
|
name: ":path"
|
|
string_match:
|
|
prefix: "/john-ubuntu"
|
|
principals:
|
|
- authenticated:
|
|
principal_name:
|
|
exact: "spiffe://john-stream.com/ubuntu"
|
|
"p14-policy":
|
|
permissions:
|
|
- and_rules:
|
|
rules:
|
|
- header:
|
|
name: ":path"
|
|
string_match:
|
|
prefix: "/john-p14s"
|
|
principals:
|
|
- authenticated:
|
|
principal_name:
|
|
exact: "spiffe://john-stream.com/john-p14s"
|
|
"gitea-policy":
|
|
permissions:
|
|
- and_rules:
|
|
rules:
|
|
- header:
|
|
name: ":path"
|
|
string_match:
|
|
prefix: "/gitea"
|
|
principals:
|
|
- authenticated:
|
|
principal_name:
|
|
exact: "spiffe://john-stream.com/gitea"
|
|
# --8<-- [end:rbac]
|
|
- name: envoy.filters.http.router
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
|
|
# --8<-- [start:cluster]
|
|
clusters:
|
|
- name: restic
|
|
connect_timeout: 0.25s
|
|
type: STRICT_DNS
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: restic
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: rest-server
|
|
port_value: 8000
|
|
# --8<-- [end:cluster]
|