feat(comfyui): put ComfyUI behind ZITADEL single sign-on #80

2026-10-27T21:17:29Z

poimen commented

2026-10-27 21:17:29 +00:00

ComfyUI has no auth and no OIDC. oauth2-proxy front door, whole host gated. ZITADEL app + SOPS secret included.

poimen added 1 commit 2026-10-27 21:17:31 +00:00

feat(comfyui): put ComfyUI behind ZITADEL single sign-on 438fcbe9fe

comfyui.riotpiao.com is served with no authentication at all: anyone who can
resolve the host reaches the UI and its queue. ComfyUI has no OIDC support, so the
front door is oauth2-proxy, and nginx asks it for a decision on every request.

Nothing inside the cluster calls this host, so the whole host is gated rather than
carved into open and closed paths. If a client ever needs direct access, add a skip
rule for its exact paths.

The ZITADEL app is created by the provisioning script, and the client secret,
cookie secret and client id live in a SOPS secret written by ksops.

rock merged commit 438fcbe9fe into main

2026-10-27 21:17:46 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#80