rock
438fcbe9fe
comfyui.riotpiao.com is served with no authentication at all: anyone who can resolve the host reaches the UI and its queue. ComfyUI has no OIDC support, so the front door is oauth2-proxy, and nginx asks it for a decision on every request. Nothing inside the cluster calls this host, so the whole host is gated rather than carved into open and closed paths. If a client ever needs direct access, add a skip rule for its exact paths. The ZITADEL app is created by the provisioning script, and the client secret, cookie secret and client id live in a SOPS secret written by ksops.
37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: comfyui
|
|
namespace: comfyui
|
|
annotations:
|
|
# No cert-manager annotation and no tls: block. This host is covered by
|
|
# the *.riotpiao.com wildcard, which nginx serves as its
|
|
# default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
# WebSocket support for ComfyUI's live preview
|
|
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
|
|
nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
|
|
# Single sign-on. ComfyUI has no auth of its own, so every request is handed to
|
|
# oauth2-proxy for an allow or deny decision.
|
|
nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
|
|
nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
|
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: comfyui.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui
|
|
port:
|
|
number: 80
|