ipblock-envoy/envoy.yaml at main · IP-Block-Ltd/ipblock-envoy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# Example Envoy config wiring the ext_authz HTTP filter to the ip-block service.
# Tested against Envoy 1.38.x. Merge the ext_authz filter + cluster into your setup.

static_resources:
  listeners:
    - name: main_listener
      address:
        socket_address: { address: 0.0.0.0, port_value: 8080 }
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                # Trust XFF from your upstream L4/LB so the client IP is correct.
                # Adjust to the number of trusted hops in front of Envoy.
                use_remote_address: true
                xff_num_trusted_hops: 0
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: backend
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/" }
                          route: { cluster: app_service }
                http_filters:
                  # ---- ip-block ext_authz filter ----
                  - name: envoy.filters.http.ext_authz
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                      transport_api_version: V3
                      # If our auth service itself is unreachable, allow the request
                      # (defence-in-depth fail-open; the service also fails open on
                      # ip-block.com API errors internally).
                      failure_mode_allow: true
                      http_service:
                        server_uri:
                          uri: ip_block_authz
                          cluster: ip_block_authz
                          timeout: 1s   # 1 second budget
                        # Forward the headers the checker needs to the auth service.
                        authorization_request:
                          allowed_headers:
                            patterns:
                              - exact: "x-forwarded-for"
                              - exact: "user-agent"
                              - exact: "referer"
                        # (Optional) headers to copy from a denied auth response
                        # back to the client, e.g. Location for redirects.
                        authorization_response:
                          allowed_client_headers:
                            patterns:
                              - exact: "location"
                              - exact: "content-type"
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

  clusters:
    # Your real upstream application.
    - name: app_service
      connect_timeout: 1s
      type: STRICT_DNS
      load_assignment:
        cluster_name: app_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: 127.0.0.1, port_value: 8081 }

    # The ip-block ext_authz HTTP service (this repo's main.go), listening on :9000.
    - name: ip_block_authz
      connect_timeout: 0.25s
      type: STRICT_DNS
      load_assignment:
        cluster_name: ip_block_authz
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: 127.0.0.1, port_value: 9000 }