From a1bb64dd98bb698e6da6c24150caca519429af71 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Tue, 27 Oct 2026 14:19:22 -0700
Subject: [PATCH] fix(comfyui): one ingress for the app and the login path

Two Ingresses on one host do not merge annotations. nginx applies the annotations
of a single ingress per host, so the separate /oauth2 object silently dropped the
auth_request on the app ingress: every request fell through to the backend and
ComfyUI answered 404 for the site root.

Move /oauth2 and / into the same ingress, so the auth annotations and both paths
belong to one object.
---
 k8s/apps/comfyui/ingress.yaml      | 12 ++++++++++++
 k8s/apps/comfyui/oauth2-proxy.yaml | 21 ---------------------
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/k8s/apps/comfyui/ingress.yaml b/k8s/apps/comfyui/ingress.yaml
index 73b7939..3e18e9c 100644
--- a/k8s/apps/comfyui/ingress.yaml
+++ b/k8s/apps/comfyui/ingress.yaml
@@ -27,6 +27,18 @@ spec:
     - host: comfyui.riotpiao.com
       http:
         paths:
+          # The login path lives on the SAME ingress as the app. Two Ingresses on
+          # one host do not merge their annotations: nginx applies the annotations
+          # of a single ingress per host, so a separate /oauth2 object silently
+          # dropped the auth_request above and every request fell through to the
+          # backend, which answered 404.
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: comfyui-oauth2-proxy
+                port:
+                  number: 4180
           - path: /
             pathType: Prefix
             backend:
diff --git a/k8s/apps/comfyui/oauth2-proxy.yaml b/k8s/apps/comfyui/oauth2-proxy.yaml
index 02c8e79..e67ed8c 100644
--- a/k8s/apps/comfyui/oauth2-proxy.yaml
+++ b/k8s/apps/comfyui/oauth2-proxy.yaml
@@ -78,24 +78,3 @@ spec:
     app: comfyui-oauth2-proxy
   ports:
     - {name: http, port: 4180, targetPort: http}
----
-# The proxy needs its own path. The auth_request annotation on the main ingress would
-# otherwise also guard /oauth2/start, and the login entry point would demand a login.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: comfyui-oauth2
-  namespace: comfyui
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: comfyui.riotpiao.com
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: comfyui-oauth2-proxy
-                port:
-                  number: 4180