apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: comfyui
  namespace: comfyui
  annotations:
    # No cert-manager annotation and no tls: block. This host is covered by
    # the *.riotpiao.com wildcard, which nginx serves as its
    # default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    # WebSocket support for ComfyUI's live preview
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    # Single sign-on. ComfyUI has no auth of its own, so every request is handed to
    # oauth2-proxy for an allow or deny decision.
    nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
    # No configuration-snippet. The controller rejects that annotation as risky
    # ("annotation group ConfigurationSnippet contains risky annotation"), and a
    # rejected annotation drops the WHOLE ingress from nginx.conf: the host then
    # answers 404 with no entry in the access log. ingress-nginx sets the Upgrade
    # and Connection headers itself for a websocket upgrade.
spec:
  ingressClassName: nginx
  rules:
    - host: comfyui.riotpiao.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: comfyui
                port:
                  number: 80