# Envoy recipe: the protected API is reached only with a valid TrustPin
# attestation token. jwt_authn verifies the signature (ES256, JWKS from the
# verifier), iss, aud and exp; the Lua filter checks typ, the project
# (tp.prj), the debug environment and the session binding. Replace the
# issuer, audience and the two cluster addresses with your own, and set
# PROJECT and REQUIRE_BIND in trustpin_attest.lua.
static_resources:
  listeners:
    - name: api
      address: { socket_address: { address: 0.0.0.0, port_value: 8080 } }
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: api
                route_config:
                  virtual_hosts:
                    - name: api
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/" }
                          route: { cluster: api }
                http_filters:
                  - name: envoy.filters.http.jwt_authn
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
                      providers:
                        trustpin:
                          issuer: https://attest.example.com
                          audiences: ["tprn::project::org_example::prj_example"]
                          from_headers: [{ name: TrustPin-Attestation }]
                          forward: true
                          clock_skew_seconds: 60
                          payload_in_metadata: payload
                          header_in_metadata: header
                          remote_jwks:
                            http_uri:
                              uri: http://issuer:18300/.well-known/jwks.json
                              cluster: trustpin_verifier
                              timeout: 5s
                            cache_duration: 300s
                            # Fetch in the background (at start and when the
                            # cache expires), never on a request; a failed
                            # fetch is retried after 30 s.
                            async_fetch: { failed_refetch_duration: 30s }
                      rules:
                        - match: { prefix: "/" }
                          requires: { provider_name: trustpin }
                  - name: envoy.filters.http.lua
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                      default_source_code: { filename: /etc/envoy/trustpin_attest.lua }
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
    - name: api                      # your API
      type: STRICT_DNS
      load_assignment:
        cluster_name: api
        endpoints: [{ lb_endpoints: [{ endpoint: { address: { socket_address: { address: issuer, port_value: 18300 } } } }] }]
    - name: trustpin_verifier        # your verifier (its public listener)
      type: STRICT_DNS
      load_assignment:
        cluster_name: trustpin_verifier
        endpoints: [{ lb_endpoints: [{ endpoint: { address: { socket_address: { address: issuer, port_value: 18300 } } } }] }]