TLS and xDS credentials

Static TLS handles use opaque system-credential references and are bound only when selected. SDS names xDS resources rather than embedding secret material.

Runtime lifecycle

Systemd owns restarts, so hot restart is disabled. The administration endpoint remains loopback-only and its access log uses the managed package log directory.

Quick start

Install Envoy, enable envoy.enable, and declare listeners and clusters. Every rendered bootstrap is checked with Envoy validation before the service starts.

{
  aos.apm.desiredPackages = ["envoy"];
  envoy.enable = true;
  envoy.listeners.http.port = 10000;
}