# HTTP proxy gated by a blacklist admission rule: clients whose source address
# is 127.0.0.1 are denied; everything else is admitted. A loopback client (curl
# inside the gost container) is denied; an external client (a different
# container) is admitted and reaches the echo server.
services:
  - name: proxy
    addr: ":8080"
    admission: admission-0
    handler:
      type: http
    listener:
      type: tcp

admissions:
  - name: admission-0
    matchers:
      - 127.0.0.1