homelab/k8s/apps/comfyui/ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: comfyui
  namespace: comfyui
  annotations:
    # No cert-manager annotation and no tls: block. This host is covered by
    # the *.riotpiao.com wildcard, which nginx serves as its
    # default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    # WebSocket support for ComfyUI's live preview
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    # Single sign-on. ComfyUI has no auth of its own, so every request is handed to
    # oauth2-proxy for an allow or deny decision.
    nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
spec:
  ingressClassName: nginx
  rules:
    - host: comfyui.riotpiao.com
      http:
        paths:
          # The login path lives on the SAME ingress as the app. Two Ingresses on
          # one host do not merge their annotations: nginx applies the annotations
          # of a single ingress per host, so a separate /oauth2 object silently
          # dropped the auth_request above and every request fell through to the
          # backend, which answered 404.
          - path: /oauth2
            pathType: Prefix
            backend:
              service:
                name: comfyui-oauth2-proxy
                port:
                  number: 4180
          - path: /
            pathType: Prefix
            backend:
              service:
                name: comfyui
                port:
                  number: 80