TLS modes

Passthrough

The edge reads SNI and forwards the raw TLS stream to the origin. The origin holds the cert. The edge never sees keys or plaintext. ACME challenges work through the tunnel.

The only mode, and the default. Per-service form:

{
  "hostname": "app.example.eu",
  "origin": "127.0.0.1:8080",
  "tls_mode": { "mode": "passthrough" }
}

PROXY protocol

In passthrough mode the agent prepends a PROXY protocol v2 header so the origin can recover the real client IP. The origin must accept it or the connection will fail.

Envoy Gateway

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
  name: envoy
spec:
  proxyProtocol:
    optional: true

Raw Envoy

Enable the envoy.filters.listener.proxy_protocol listener filter.

Disable per-service

{ "hostname": "app.example.eu",
  "origin": "127.0.0.1:8443",
  "proxy_protocol": "none" }