Example of envoy with HTTPS connection to grpc backend

I cannot for the life of me figure out how to use Envoy to proxy grpc-web requests to a grpc backend over HTTPs.

My use case is that I'd like to use grpc-web with a service on GCP Run. GCP Run deployments are individual Docker containers, so to accomplish this, I have two options:
1. Put my grpc server and envoy into the same container. This is generally considered bad practice: containers should be single-purpose. I hit all sorts of sharp edges, and the general response is, "stop running multiple services in a single container."
2. Separate my grpc server from my envoy server. This is a tad heavyweight, but clearly the way Docker and GCP Run "want" me to do it.

The "problem" is that service-to-service communication between GCP Run deployments is over HTTPS. That's not a problem per se, but I simply can't make it work. I'd include the config I'm using, but I've tried so many things and I can't include them all. I've essentially been trying to combine the `envoy.yaml` in the Hello World example with this: https://farcaller.medium.com/how-to-configure-https-backends-in-envoy-b446727b2eb3.

The symptoms I'm seeing are:
- When I use TLS, envoy generally doesn't send a response back to the client. The client just hangs forever.
- Depending on the exact details of the configuration I'm using, I see either "503" or "404" in the envoy debug logs, and no further information besides the status code.

Establishing a secure connection to a grpc backend seems like it should be a supported configuration, so can we get an example of it in the docs?