loopback.yaml

admin:
  access_log_path: "/dev/stdout"
  address:
    socket_address:
      protocol: TCP
      address: 127.0.0.1
      port_value: 7779

static_resources:
  listeners:
    - name: main_listener
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 80
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                codec_type: auto
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: app
                      domains:
                        - "*"
                      routes:
                        - match:
                            prefix: "/"
                          route:
                            host_rewrite_literal: edition.cnn.com
                            cluster: "loopback_cluster"
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
    - name: api_proxy_listener
      address:
        pipe:
          path: "@/cluster_0"
      filter_chains:
        - filters:
            - name: tcp
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
                stat_prefix: tcp_stats
                cluster: "proxy_cluster"
                tunneling_config:
                  hostname: edition.cnn.com:443
                  headers_to_add:
                    - header:
                        key: Proxy-Authorization
                        value: Basic dXNlcjpwYXNzd29yZA== # replace with your credentials
                      append: false
  clusters:
    - name: proxy_cluster
      connect_timeout: 0.25s
      type: strict_dns
      lb_policy: round_robin
      load_assignment:
        cluster_name: proxy_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: host.docker.internal # simulate a corporate proxy
                      port_value: 8888
    - name: loopback_cluster
      connect_timeout: 5s
      upstream_connection_options:
        tcp_keepalive: {}
      type: STATIC
      load_assignment:
        cluster_name: loopback_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    pipe:
                      path: "@/cluster_0"
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          sni: edition.cnn.com

live example with squid as L2 TLS proxy at https://github.com/scrocquesel/envoy_examples/tree/main/tls_origination_via_tls_l2_proxy

Thanks to envoyproxy/envoy#19612, the sample now allows for dynamic hostname solution. Setting domain matcher to "*" will let envoy proxy any destination to the L2 proxy.