rock
a1bb64dd98
Two Ingresses on one host do not merge annotations. nginx applies the annotations of a single ingress per host, so the separate /oauth2 object silently dropped the auth_request on the app ingress: every request fell through to the backend and ComfyUI answered 404 for the site root. Move /oauth2 and / into the same ingress, so the auth annotations and both paths belong to one object.
81 lines
2.7 KiB
YAML
81 lines
2.7 KiB
YAML
# ComfyUI has no authentication of its own: comfyui.riotpiao.com is open to anyone
|
|
# who can resolve the host. It also has no OIDC support, so ZITADEL cannot be a
|
|
# login method inside it. oauth2-proxy is the front door instead: nginx asks it for
|
|
# a decision on every request and it answers from a ZITADEL session.
|
|
#
|
|
# No API client calls this host today, so the whole host is gated. If a client ever
|
|
# needs direct access, add a skip rule for the exact paths it uses rather than
|
|
# opening the whole host.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: comfyui-oauth2-proxy
|
|
namespace: comfyui
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: comfyui-oauth2-proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile: {type: RuntimeDefault}
|
|
containers:
|
|
- name: oauth2-proxy
|
|
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
|
|
args:
|
|
- --provider=oidc
|
|
- --oidc-issuer-url=https://zitadel.riotpiao.com
|
|
- --email-domain=*
|
|
- --upstream=static://202
|
|
- --reverse-proxy=true
|
|
- --set-xauthrequest=true
|
|
- --cookie-secure=true
|
|
- --cookie-expire=12h
|
|
- --cookie-refresh=1h
|
|
- --skip-provider-button=true
|
|
- --redirect-url=https://comfyui.riotpiao.com/oauth2/callback
|
|
- --http-address=0.0.0.0:4180
|
|
env:
|
|
- name: OAUTH2_PROXY_CLIENT_ID
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-id}}
|
|
- name: OAUTH2_PROXY_CLIENT_SECRET
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-secret}}
|
|
- name: OAUTH2_PROXY_COOKIE_SECRET
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: cookie-secret}}
|
|
ports:
|
|
- {name: http, containerPort: 4180}
|
|
readinessProbe:
|
|
httpGet: {path: /ping, port: http}
|
|
initialDelaySeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /ping, port: http}
|
|
initialDelaySeconds: 15
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {cpu: 200m, memory: 128Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: comfyui-oauth2-proxy
|
|
namespace: comfyui
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: comfyui-oauth2-proxy
|
|
ports:
|
|
- {name: http, port: 4180, targetPort: http}
|