rock
438fcbe9fe
comfyui.riotpiao.com is served with no authentication at all: anyone who can resolve the host reaches the UI and its queue. ComfyUI has no OIDC support, so the front door is oauth2-proxy, and nginx asks it for a decision on every request. Nothing inside the cluster calls this host, so the whole host is gated rather than carved into open and closed paths. If a client ever needs direct access, add a skip rule for its exact paths. The ZITADEL app is created by the provisioning script, and the client secret, cookie secret and client id live in a SOPS secret written by ksops.
102 lines
3.2 KiB
YAML
102 lines
3.2 KiB
YAML
# ComfyUI has no authentication of its own: comfyui.riotpiao.com is open to anyone
|
|
# who can resolve the host. It also has no OIDC support, so ZITADEL cannot be a
|
|
# login method inside it. oauth2-proxy is the front door instead: nginx asks it for
|
|
# a decision on every request and it answers from a ZITADEL session.
|
|
#
|
|
# No API client calls this host today, so the whole host is gated. If a client ever
|
|
# needs direct access, add a skip rule for the exact paths it uses rather than
|
|
# opening the whole host.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: comfyui-oauth2-proxy
|
|
namespace: comfyui
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: comfyui-oauth2-proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile: {type: RuntimeDefault}
|
|
containers:
|
|
- name: oauth2-proxy
|
|
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
|
|
args:
|
|
- --provider=oidc
|
|
- --oidc-issuer-url=https://zitadel.riotpiao.com
|
|
- --email-domain=*
|
|
- --upstream=static://202
|
|
- --reverse-proxy=true
|
|
- --set-xauthrequest=true
|
|
- --cookie-secure=true
|
|
- --cookie-expire=12h
|
|
- --cookie-refresh=1h
|
|
- --skip-provider-button=true
|
|
- --redirect-url=https://comfyui.riotpiao.com/oauth2/callback
|
|
- --http-address=0.0.0.0:4180
|
|
env:
|
|
- name: OAUTH2_PROXY_CLIENT_ID
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-id}}
|
|
- name: OAUTH2_PROXY_CLIENT_SECRET
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-secret}}
|
|
- name: OAUTH2_PROXY_COOKIE_SECRET
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: cookie-secret}}
|
|
ports:
|
|
- {name: http, containerPort: 4180}
|
|
readinessProbe:
|
|
httpGet: {path: /ping, port: http}
|
|
initialDelaySeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /ping, port: http}
|
|
initialDelaySeconds: 15
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {cpu: 200m, memory: 128Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: comfyui-oauth2-proxy
|
|
namespace: comfyui
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: comfyui-oauth2-proxy
|
|
ports:
|
|
- {name: http, port: 4180, targetPort: http}
|
|
---
|
|
# The proxy needs its own path. The auth_request annotation on the main ingress would
|
|
# otherwise also guard /oauth2/start, and the login entry point would demand a login.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: comfyui-oauth2
|
|
namespace: comfyui
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: comfyui.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /oauth2
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui-oauth2-proxy
|
|
port:
|
|
number: 4180
|