loopback.yaml

admin:
  access_log_path: "/dev/stdout"
  address:
    socket_address:
      protocol: TCP
      address: 127.0.0.1
      port_value: 7779

static_resources:
  listeners:

  - name: main_listener
    address:
      socket_address:
        protocol: TCP
        address: 0.0.0.0
        port_value: 7777
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains:
                - "*"

              routes:
                - match:
                    prefix: "/my-api/"
                  route:
                    host_rewrite_literal: myapi.com
                    prefix_rewrite: "/"
                    cluster: "loopback_cluster"
           
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router          

  - name: api_proxy_listener
    address:
      socket_address:
        protocol: TCP
        address: 127.0.0.1
        port_value: 10000
    filter_chains:
    - filters:
      - name: tcp
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
          stat_prefix: tcp_stats
          cluster: "proxy_cluster"
          tunneling_config:
            hostname: myapi.com:443

  clusters:
    - name: proxy_cluster
      type: STRICT_DNS
      connect_timeout: 20s
      load_assignment:
        cluster_name: proxy_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: myproxy.com
                      port_value: 80

    - name: loopback_cluster
      type: STRICT_DNS
      connect_timeout: 5s
      load_assignment:
        cluster_name: loopback_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: 127.0.0.1
                      port_value: 10000
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          sni: myapi.com

As an optimization, that you may need or not :-) you could consider using UDS to chain the two stages as in the example here: envoyproxy/envoy#11569 (comment)

Cool, I will have a look at that, thx! Do you know what the perf improvement is?

the benefit should come from bypassing the TCP stack, but I suggest you benchmark if you want to have an idea of the gain ;-)