platform/envoy-gateway/README.md

@@ -131,3 +131,11 @@ iptables/NodePort rather than binding. Test with `curl`, not `ss`.
 Contour source manifests were removed from the clean baseline. Live leftovers may
 still exist and must be inventoried before deletion; do not infer live state from
 the archive cleanup. The legacy Git history retains the retired manifests.
+
+## 后端 TLS 版本
+
+`EnvoyProxy/eg` 显式允许后端 TLS 1.2–1.3，由 `Gateway/eg` 的
+`infrastructure.parametersRef` 引用。Incus 7.5.1 只接受 TLS 1.3；
+仅创建 BackendTLSPolicy 时，现有 Envoy 上游默认最高 TLS 1.2，会返回
+`TLSV1_ALERT_PROTOCOL_VERSION` 并导致入口 503。此设置保留 TLS 1.2 后端兼容性，
+不改变前端 TLS listener、证书和路由；各后端仍需各自的 BackendTLSPolicy。

platform/envoy-gateway/envoyproxy.yaml

@@ -0,0 +1,10 @@
+# Incus 只接受 TLS 1.3；显式允许后端协商 1.2–1.3，保留其他后端兼容性。
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: eg
+  namespace: envoy-gateway-system
+spec:
+  backendTLS:
+    minVersion: '1.2'
+    maxVersion: '1.3'

platform/envoy-gateway/gateway.yaml

@@ -24,6 +24,11 @@ metadata:
   namespace: envoy-gateway-system
 spec:
   gatewayClassName: eg
+  infrastructure:
+    parametersRef:
+      group: gateway.envoyproxy.io
+      kind: EnvoyProxy
+      name: eg
   listeners:
     # Plaintext :80 — ACME http-01 (the bao-acme ClusterIssuer solves through here)
     # and HTTP->HTTPS redirects. Never serve anything sensitive on it.

platform/envoy-gateway/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   - gateway.yaml
+  - envoyproxy.yaml