code: func injectConnectFilters(cfgSnap *proxycfg.ConfigSnapshot, token string, listener *envoy.Listener) error {
  	authFilter, err := makeExtAuthFilter(token)
  	if err != nil {
  		return err
  	}
  	for idx := range listener.FilterChains {
  		// Insert our authz filter before any others
  		listener.FilterChains[idx].Filters =
  			append([]envoylistener.Filter{authFilter}, listener.FilterChains[idx].Filters...)
  
  		// Force our TLS for all filter chains on a public listener
  		listener.FilterChains[idx].TlsContext = &envoyauth.DownstreamTlsContext{
  			CommonTlsContext:         makeCommonTLSContext(cfgSnap),
  			RequireClientCertificate: &types.BoolValue{Value: true},
  		}
  	}
  	return nil
  }
docs: // Ensure that the first filter in each filter chain of a public listener is the
  // authz filter to prevent unauthorized access and that every filter chain uses
  // our TLS certs. We might allow users to work around this later if there is a
  // good use case but this is actually a feature for now as it allows them to
  // specify custom listener params in config but still get our certs delivered
  // dynamically and intentions enforced without coming up with some complicated
  // templating/merging solution.