From 918bfb32c8d22d1b7a4578772a4f47b62c97ce48 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sun, 13 Sep 2026 09:01:16 +0900
Subject: [PATCH] fix(comfyui): correct port 8188->18188, add TLS ingress at
 comfyui.riotpiao.com

ai-dock image runs ComfyUI on port 18188 (10000+8188), not 8188.
Caddy in the image doesn't proxy 8188->18188, so probes and service
must target 18188 directly. This caused 273 startup probe failures
and constant restarts over 45h.

- deployment: containerPort, probes, env all point to 18188
- service: targetPort 18188
- ingress: TLS via letsencrypt, WebSocket upgrade headers for live preview
- CoreDNS: rewrite comfyui.riotpiao.com to nginx controller
---
 k8s/apps/comfyui/deployment.yaml | 12 +++++++-----
 k8s/apps/comfyui/ingress.yaml    | 12 ++++++++++--
 k8s/apps/comfyui/service.yaml    |  2 +-
 terraform/files/coredns/Corefile |  1 +
 4 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/k8s/apps/comfyui/deployment.yaml b/k8s/apps/comfyui/deployment.yaml
index 164cfba..2e723a0 100644
--- a/k8s/apps/comfyui/deployment.yaml
+++ b/k8s/apps/comfyui/deployment.yaml
@@ -26,13 +26,15 @@ spec:
         - name: comfyui
           image: ghcr.io/ai-dock/comfyui:v2-cuda-12.1.1-base-22.04
           ports:
-            - containerPort: 8188
+            - containerPort: 18188
               protocol: TCP
           env:
             - name: NVIDIA_VISIBLE_DEVICES
               value: "all"
-            - name: COMFYUI_FLAGS
-              value: "--listen 0.0.0.0 --port 8188"
+            # ai-dock adds 10000 to port: ComfyUI listens on 18188 (localhost)
+            # caddy is NOT configured to proxy 8188->18188 in this image
+            - name: COMFYUI_PORT_HOST
+              value: "18188"
           resources:
             requests:
               cpu: "4"
@@ -50,13 +52,13 @@ spec:
           readinessProbe:
             httpGet:
               path: /
-              port: 8188
+              port: 18188
             periodSeconds: 10
             initialDelaySeconds: 30
           startupProbe:
             httpGet:
               path: /
-              port: 8188
+              port: 18188
             failureThreshold: 60
             periodSeconds: 10
       volumes:
diff --git a/k8s/apps/comfyui/ingress.yaml b/k8s/apps/comfyui/ingress.yaml
index 69e5cc5..88577d6 100644
--- a/k8s/apps/comfyui/ingress.yaml
+++ b/k8s/apps/comfyui/ingress.yaml
@@ -4,16 +4,24 @@ metadata:
   name: comfyui
   namespace: comfyui
   annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     # WebSocket support for ComfyUI's live preview
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-    nginx.ingress.kubernetes.io/proxy-set-headers: "Upgrade"
+    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
 spec:
   ingressClassName: nginx
+  tls:
+    - secretName: comfyui-tls
+      hosts:
+        - comfyui.riotpiao.com
   rules:
-    - host: comfy.riotpiao.com
+    - host: comfyui.riotpiao.com
       http:
         paths:
           - path: /
diff --git a/k8s/apps/comfyui/service.yaml b/k8s/apps/comfyui/service.yaml
index 7afee74..4bb9691 100644
--- a/k8s/apps/comfyui/service.yaml
+++ b/k8s/apps/comfyui/service.yaml
@@ -10,5 +10,5 @@ spec:
     app: comfyui
   ports:
     - port: 80
-      targetPort: 8188
+      targetPort: 18188
       protocol: TCP
diff --git a/terraform/files/coredns/Corefile b/terraform/files/coredns/Corefile
index ecbf568..d233dee 100644
--- a/terraform/files/coredns/Corefile
+++ b/terraform/files/coredns/Corefile
@@ -37,6 +37,7 @@
     rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name comfy.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name comfyui.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {