package main

import (
  "fmt"
  "net"
  "google.golang.org/grpc"
)

func main() {
  endPoint := fmt.Sprintf("localhost:%d", 3001)
  listen, err := net.Listen("tcp", endPoint)

  grpcServer := grpc.NewServer()
  grpcServer.Serve(listen)
}

package main

import (
  "fmt"
  "net"

   auth_pb "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
  "google.golang.org/grpc"
)

func main() {
  // struct with check method
  type AuthServer struct {}

  func (server *AuthServer) Check(
    ctx context.Context, 
    request *auth_pb.CheckRequest,
  ) (*auth_pb.CheckResponse, error) {
    fmt.println("All request goes through me")

    // block if path is /private
    path = request.Attributes.Request.Http.Path[1:]
    if path == 'private' {
      return nil, fmt.Errorf('private request not allowed')
    }

    // allow all other requests
    return &auth_pb.CheckResponse{}, nil
  }


  endPoint := fmt.Sprintf("localhost:%d", 3001)
  listen, err := net.Listen("tcp", endPoint)

  grpcServer := grpc.NewServer()

  // register envoy proto server
  server := &AuthServer{}
  auth_pb.RegisterAuthorizationServer(grpcServer, server)

  grpcServer.Serve(listen)
}

static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address: { address: 0.0.0.0, port_value: 80 }
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                codec_type: auto
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                   ...
                http_filters:
                  - name: envoy.filters.http.ext_authz
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                      transport_api_version: v3
                      grpc_service:
                        envoy_grpc:
                          cluster_name: go_grpc_cluster
                      include_peer_certificate: true
                        ...
  clusters:
    - name: go_grpc_cluster
      connect_timeout: 0.25s
      type: LOGICAL_DNS
      typed_extension_protocol_options:
        envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
          "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
          explicit_http_config:
            http2_protocol_options: {}
      load_assignment:
        cluster_name: go_grpc_cluster
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: 127.0.0.1
                  port_value: 3001