First-Party Reverse Proxying als Enterprise-Standard

# Envoy Route Configuration für First-Party Endpoint
routes:
  - match:
      prefix: "/api/sec"
    route:
      cluster: "sovereign_engine_cluster"
      prefix_rewrite: "/v1"
      timeout: 0.5s
    request_headers_to_add:
      - header:
          key: "X-Ingress-Gateway"
          value: "enterprise-core-ingress"
    response_headers_to_remove:
      - "x-envoy-upstream-service-time"
      - "server"

# Upstream mTLS Cluster Definition
clusters:
  - name: "sovereign_engine_cluster"
    connect_timeout: 0.25s
    type: LOGICAL_DNS
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        common_tls_context:
          tls_certificates:
            - certificate_chain: { filename: "/etc/ssl/client.crt" }
              private_key: { filename: "/etc/ssl/client.key" }
          validation_context:
            trusted_ca: { filename: "/etc/ssl/engine-ca.crt" }

// Edge Middleware für First-Party Sub-Request Proxying
export default {
  async fetch(request, env) {
    const url = new URL(request.url);

    // Nur First-Party Pfade abfangen
    if (url.pathname.startsWith('/api/sec/')) {
      const backendUrl = 'https://upstream-internal-cluster:8443' + url.pathname.replace('/api/sec', '');
      
      // Neuer Request mit bereinigten Headern
      const proxyReq = new Request(backendUrl, {
        method: request.method,
        headers: request.headers,
        body: request.body
      });
      proxyReq.headers.set('X-Forwarded-Host', url.hostname);
      proxyReq.headers.delete('cf-ray');

      const response = await fetch(proxyReq);
      const cleanRes = new Response(response.body, response);
      cleanRes.headers.delete('server');
      cleanRes.headers.delete('x-powered-by');
      return cleanRes;
    }

    return fetch(request);
  }
};

# First-Party Endpoint unter der eigenen Domain
checkout.ihre-bank.at {
    handle_path /api/sec/* {
        reverse_proxy https://upstream-internal-cluster:8443 {
            transport http {
                tls
                tls_client_auth /etc/ssl/client.crt /etc/ssl/client.key
                tls_trusted_ca_certs /etc/ssl/engine-ca.crt
            }
            header_up Host {host}
            header_up X-Real-IP {remote_host}
            header_down -Server
        }
    }
}