{"slug": "envoy", "name": "Envoy", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 1, "commenters": 5, "warners": 1, "score": 0.657, "rising": -0.33, "first": "2026-01-09", "latest": "2026-10-27", "why": "I route requests for an upstream host (like stripe) through Envoy as a mitm proxy", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 3, "compare": 0, "warn": 1}, "spark": [0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "I route requests for an upstream host (like stripe) through Envoy as a mitm proxy", "icon": false, "domain": "envoyproxy.io", "github_repo": null, "official_url": "https://envoyproxy.io", "pricing": "", "aliases": ["Envoy"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 745010817, "item_id": 46563176, "url": "https://news.ycombinator.com/item?id=46563176", "by": "dtkav", "date": "2026-01-09", "stance": "recommend", "quote": "I route requests for an upstream host (like stripe) through Envoy as a mitm proxy", "excerpt": "fly.io is doing really good work. I've super enjoyed building our product on their platform. I love fly-replay combined with super fast start-up. I've been thinking a lot about how to run agents (and skills) securely while giving them a lot of powerful capabilities. I recently used their macaroons library to turn arbitrary API keys (e.g. for stripe's API) into macaroons. I route requests for an upstream host (like st", "context": "", "use_case": "credential-injecting proxy", "switched_from": "", "story": "Code and Let Live"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 804188849, "item_id": 50261803, "url": "https://news.ycombinator.com/item?id=50261803", "by": "jon128", "date": "2026-10-27", "stance": "warn", "quote": "Envoy being written in C++ has always given me a gut feeling to avoid Envoy.", "excerpt": "Yeah, I'm with you 92% that the majority shouldn't try to implement a reverse-proxy themselves. The other 8% is, some people should do such a thing because learning for them and sometimes for all of us results from stories of failure, and surprising stories of success too. The reverse-proxies implemented in Rust (aided by Rocq of Rust) in my larger circles were written in-house for their respective platforms. These c", "context": "", "use_case": "reverse proxy", "switched_from": "", "story": "Native Prometheus Integration with Nginx"}]}], "who": [], "tags": [], "use_cases": ["reverse proxy", "jwt validation at proxy", "encrypted channel for preview apps", "credential-injecting proxy"], "compared": [{"slug": "nginx", "name": "nginx", "co": 2, "switched_from": 0, "switched_to": 1}], "makers": [{"id": 752223489, "item_id": 47013968, "url": "https://news.ycombinator.com/item?id=47013968", "by": "ahachete", "date": "2026-02-14", "stance": "neutral", "quote": "we developed the Postgres plugin for Envoy", "excerpt": "IMO transparent proxies for observability are not the best pattern. And I speak from experience, we developed the Postgres plugin for Envoy [1], [2] and we use it in StackGres [3], among others, for this very same reason, observability. There's two main problems with said proxies: * Latency. Yes, yes, yes, they add \"microseconds\" vs \"milliseconds for queries\", and that's true, but just part of the story. There's an e", "context": "", "use_case": "Postgres observability proxy", "switched_from": "", "story": "Show HN: SQL-tap \u2013 Real-time SQL traffic viewer for PostgreSQL and MySQL"}], "threads": [{"url": "https://news.ycombinator.com/item?id=50213502", "title": "Native Prometheus Integration with Nginx", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50049498", "title": "HashiCorp archives the Boundary open source repo", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48558147", "title": "Stop Using JWTs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47011567", "title": "Show HN: SQL-tap \u2013 Real-time SQL traffic viewer for PostgreSQL and MySQL", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46846055", "title": "Ask HN: How do you handle auth when AI dev agents spin up short-lived apps?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46557825", "title": "Code and Let Live", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {"neutral": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"neutral": 1, "warn": 1}}, "quotes": [{"id": 804188849, "item_id": 50261803, "url": "https://news.ycombinator.com/item?id=50261803", "by": "jon128", "date": "2026-10-27", "stance": "warn", "quote": "Envoy being written in C++ has always given me a gut feeling to avoid Envoy.", "excerpt": "Yeah, I'm with you 92% that the majority shouldn't try to implement a reverse-proxy themselves. The other 8% is, some people should do such a thing because learning for them and sometimes for all of us results from stories of failure, and surprising stories of success too. The reverse-proxies implemented in Rust (aided by Rocq of Rust) in my larger circles were written in-house for their respective platforms. These c", "context": "", "use_case": "reverse proxy", "switched_from": "", "story": "Native Prometheus Integration with Nginx"}, {"id": 800817697, "item_id": 50051106, "url": "https://news.ycombinator.com/item?id=50051106", "by": "yegle", "date": "2026-10-12", "stance": "neutral", "quote": "It builds around https://envoyproxy.io.", "excerpt": "I used https://pomerium.com in the past for homelab. It builds around https://envoyproxy.io.", "context": "", "use_case": "", "switched_from": "", "story": "HashiCorp archives the Boundary open source repo"}, {"id": 776970272, "item_id": 48560642, "url": "https://news.ycombinator.com/item?id=48560642", "by": "miiiiiike", "date": "2026-06-16", "stance": "neutral", "quote": "Envoy bounces it without passing the request through to the backend.", "excerpt": "Security doesn't start or end with JWTs. A user wants to access a read-only resource with an invalid JWT? Envoy bounces it without passing the request through to the backend. Valid JWT? Let the request through without having to look up any session information. No DB, no cache, no session server hit. Fast. A user wants to change a password, email address, or add an authenticator? First, require a password, second, req", "context": "", "use_case": "JWT validation at proxy", "switched_from": "", "story": "Stop Using JWTs"}, {"id": 749696544, "item_id": 46856034, "url": "https://news.ycombinator.com/item?id=46856034", "by": "mcnamtm1", "date": "2026-02-02", "stance": "neutral", "quote": "behind a customized Envoy proxy doing application-layer encryption without PKI/TLS", "excerpt": "We have a real setup that treats this challenge as a network isolation problem instead of an auth problem. Have you considered that approach? Meaning: instead of trying to authenticate to the preview app, make the preview app only reachable via an encrypted application-layer channel. The \"authentication\" becomes having the encryption key to that channel. For AI agents, this could simplify things: Agent generates an e", "context": "", "use_case": "encrypted channel for preview apps", "switched_from": "", "story": "Ask HN: How do you handle auth when AI dev agents spin up short-lived apps?"}, {"id": 745010817, "item_id": 46563176, "url": "https://news.ycombinator.com/item?id=46563176", "by": "dtkav", "date": "2026-01-09", "stance": "recommend", "quote": "I route requests for an upstream host (like stripe) through Envoy as a mitm proxy", "excerpt": "fly.io is doing really good work. I've super enjoyed building our product on their platform. I love fly-replay combined with super fast start-up. I've been thinking a lot about how to run agents (and skills) securely while giving them a lot of powerful capabilities. I recently used their macaroons library to turn arbitrary API keys (e.g. for stripe's API) into macaroons. I route requests for an upstream host (like st", "context": "", "use_case": "credential-injecting proxy", "switched_from": "", "story": "Code and Let Live"}]}