k8s/apps/comfyui/ingress.yaml

@@ -27,6 +27,18 @@ spec:
     - host: comfyui.riotpiao.com
       http:
         paths:
+          # The login path lives on the SAME ingress as the app. Two Ingresses on
+          # one host do not merge their annotations: nginx applies the annotations
+          # of a single ingress per host, so a separate /oauth2 object silently
+          # dropped the auth_request above and every request fell through to the
+          # backend, which answered 404.
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: comfyui-oauth2-proxy
+                port:
+                  number: 4180
           - path: /
             pathType: Prefix
             backend:

k8s/apps/comfyui/oauth2-proxy.yaml

@@ -78,24 +78,3 @@ spec:
     app: comfyui-oauth2-proxy
   ports:
     - {name: http, port: 4180, targetPort: http}
----
-# The proxy needs its own path. The auth_request annotation on the main ingress would
-# otherwise also guard /oauth2/start, and the login entry point would demand a login.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: comfyui-oauth2
-  namespace: comfyui
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: comfyui.riotpiao.com
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: comfyui-oauth2-proxy
-                port:
-                  number: 4180