# ComfyUI has no authentication of its own: comfyui.riotpiao.com is open to anyone
# who can resolve the host. It also has no OIDC support, so ZITADEL cannot be a
# login method inside it. oauth2-proxy is the front door instead: nginx asks it for
# a decision on every request and it answers from a ZITADEL session.
#
# No API client calls this host today, so the whole host is gated. If a client ever
# needs direct access, add a skip rule for the exact paths it uses rather than
# opening the whole host.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: comfyui-oauth2-proxy
  namespace: comfyui
  labels:
    app: comfyui-oauth2-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: comfyui-oauth2-proxy
  template:
    metadata:
      labels:
        app: comfyui-oauth2-proxy
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: oauth2-proxy
          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
          args:
            - --provider=oidc
            - --oidc-issuer-url=https://zitadel.riotpiao.com
            - --email-domain=*
            - --upstream=static://202
            - --reverse-proxy=true
            - --set-xauthrequest=true
            - --cookie-secure=true
            - --cookie-expire=12h
            - --cookie-refresh=1h
            - --skip-provider-button=true
            - --redirect-url=https://comfyui.riotpiao.com/oauth2/callback
            - --http-address=0.0.0.0:4180
          env:
            - name: OAUTH2_PROXY_CLIENT_ID
              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-id}}
            - name: OAUTH2_PROXY_CLIENT_SECRET
              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-secret}}
            - name: OAUTH2_PROXY_COOKIE_SECRET
              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: cookie-secret}}
          ports:
            - {name: http, containerPort: 4180}
          readinessProbe:
            httpGet: {path: /ping, port: http}
            initialDelaySeconds: 5
          livenessProbe:
            httpGet: {path: /ping, port: http}
            initialDelaySeconds: 15
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
          resources:
            requests: {cpu: 10m, memory: 32Mi}
            limits: {cpu: 200m, memory: 128Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: comfyui-oauth2-proxy
  namespace: comfyui
  labels:
    app: comfyui-oauth2-proxy
spec:
  type: ClusterIP
  selector:
    app: comfyui-oauth2-proxy
  ports:
    - {name: http, port: 4180, targetPort: http}
---
# The login path must NOT be gated: a request to /oauth2/start that itself demands a
# login redirects to /oauth2/start forever. ingress-nginx applies the annotations of
# an ingress to the locations it defines, so a separate object without auth-url keeps
# this path open. The earlier failure of this shape was not the split — it was the
# configuration-snippet on the app ingress, which made the controller drop the whole
# object and left only this one alive.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: comfyui-oauth2
  namespace: comfyui
spec:
  ingressClassName: nginx
  rules:
    - host: comfyui.riotpiao.com
      http:
        paths:
          - path: /oauth2
            pathType: Prefix
            backend:
              service:
                name: comfyui-oauth2-proxy
                port:
                  number: 4180