feat(comfyui): put ComfyUI behind ZITADEL single sign-on

comfyui.riotpiao.com is served with no authentication at all: anyone who can
resolve the host reaches the UI and its queue. ComfyUI has no OIDC support, so the
front door is oauth2-proxy, and nginx asks it for a decision on every request.

Nothing inside the cluster calls this host, so the whole host is gated rather than
carved into open and closed paths. If a client ever needs direct access, add a skip
rule for its exact paths.

The ZITADEL app is created by the provisioning script, and the client secret,
cookie secret and client id live in a SOPS secret written by ksops.

This commit was merged in pull request #80.

This commit is contained in:

rock

2026-10-27 14:17:21 -07:00

parent afec7e9867

commit 438fcbe9fe

6 changed files with 143 additions and 0 deletions

									
										k8s/apps/comfyui/kustomization.yaml
									
		+1
		
												View File
												
				@@ -4,4 +4,5 @@ kind: Kustomization

				resources:

				  - deployment.yaml

				  - service.yaml

				  - oauth2-proxy.yaml

				  - ingress.yaml