fix(comfyui): correct port 8188->18188, add TLS ingress at comfyui.riotpiao.com

ai-dock image runs ComfyUI on port 18188 (10000+8188), not 8188.
Caddy in the image doesn't proxy 8188->18188, so probes and service
must target 18188 directly. This caused 273 startup probe failures
and constant restarts over 45h.

- deployment: containerPort, probes, env all point to 18188
- service: targetPort 18188
- ingress: TLS via letsencrypt, WebSocket upgrade headers for live preview
- CoreDNS: rewrite comfyui.riotpiao.com to nginx controller

k8s/apps/comfyui/deployment.yaml

@@ -26,13 +26,15 @@ spec:
         - name: comfyui
           image: ghcr.io/ai-dock/comfyui:v2-cuda-12.1.1-base-22.04
           ports:
-            - containerPort: 8188
+            - containerPort: 18188
               protocol: TCP
           env:
             - name: NVIDIA_VISIBLE_DEVICES
               value: "all"
-            - name: COMFYUI_FLAGS
-              value: "--listen 0.0.0.0 --port 8188"
+            # ai-dock adds 10000 to port: ComfyUI listens on 18188 (localhost)
+            # caddy is NOT configured to proxy 8188->18188 in this image
+            - name: COMFYUI_PORT_HOST
+              value: "18188"
           resources:
             requests:
               cpu: "4"
@@ -50,13 +52,13 @@ spec:
           readinessProbe:
             httpGet:
               path: /
-              port: 8188
+              port: 18188
             periodSeconds: 10
             initialDelaySeconds: 30
           startupProbe:
             httpGet:
               path: /
-              port: 8188
+              port: 18188
             failureThreshold: 60
             periodSeconds: 10
       volumes:

k8s/apps/comfyui/ingress.yaml

@@ -4,16 +4,24 @@ metadata:
   name: comfyui
   namespace: comfyui
   annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     # WebSocket support for ComfyUI's live preview
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-    nginx.ingress.kubernetes.io/proxy-set-headers: "Upgrade"
+    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
 spec:
   ingressClassName: nginx
+  tls:
+    - secretName: comfyui-tls
+      hosts:
+        - comfyui.riotpiao.com
   rules:
-    - host: comfy.riotpiao.com
+    - host: comfyui.riotpiao.com
       http:
         paths:
           - path: /

k8s/apps/comfyui/service.yaml

@@ -10,5 +10,5 @@ spec:
     app: comfyui
   ports:
     - port: 80
-      targetPort: 8188
+      targetPort: 18188
       protocol: TCP

terraform/files/coredns/Corefile

@@ -37,6 +37,7 @@
     rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name comfy.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name comfyui.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {