rock
2485b5f165
Gating /oauth2 with the app redirects /oauth2/start to itself and the browser loops. ingress-nginx applies an ingress's annotations to the locations that ingress defines, so the login path belongs on its own object without auth-url. This split failed once before, and the split was not the reason: the app ingress carried a configuration-snippet that the controller rejects, which dropped that whole object and left only the login path rendered.
106 lines
3.5 KiB
YAML
106 lines
3.5 KiB
YAML
# ComfyUI has no authentication of its own: comfyui.riotpiao.com is open to anyone
|
|
# who can resolve the host. It also has no OIDC support, so ZITADEL cannot be a
|
|
# login method inside it. oauth2-proxy is the front door instead: nginx asks it for
|
|
# a decision on every request and it answers from a ZITADEL session.
|
|
#
|
|
# No API client calls this host today, so the whole host is gated. If a client ever
|
|
# needs direct access, add a skip rule for the exact paths it uses rather than
|
|
# opening the whole host.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: comfyui-oauth2-proxy
|
|
namespace: comfyui
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: comfyui-oauth2-proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile: {type: RuntimeDefault}
|
|
containers:
|
|
- name: oauth2-proxy
|
|
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
|
|
args:
|
|
- --provider=oidc
|
|
- --oidc-issuer-url=https://zitadel.riotpiao.com
|
|
- --email-domain=*
|
|
- --upstream=static://202
|
|
- --reverse-proxy=true
|
|
- --set-xauthrequest=true
|
|
- --cookie-secure=true
|
|
- --cookie-expire=12h
|
|
- --cookie-refresh=1h
|
|
- --skip-provider-button=true
|
|
- --redirect-url=https://comfyui.riotpiao.com/oauth2/callback
|
|
- --http-address=0.0.0.0:4180
|
|
env:
|
|
- name: OAUTH2_PROXY_CLIENT_ID
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-id}}
|
|
- name: OAUTH2_PROXY_CLIENT_SECRET
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-secret}}
|
|
- name: OAUTH2_PROXY_COOKIE_SECRET
|
|
valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: cookie-secret}}
|
|
ports:
|
|
- {name: http, containerPort: 4180}
|
|
readinessProbe:
|
|
httpGet: {path: /ping, port: http}
|
|
initialDelaySeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /ping, port: http}
|
|
initialDelaySeconds: 15
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {cpu: 200m, memory: 128Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: comfyui-oauth2-proxy
|
|
namespace: comfyui
|
|
labels:
|
|
app: comfyui-oauth2-proxy
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: comfyui-oauth2-proxy
|
|
ports:
|
|
- {name: http, port: 4180, targetPort: http}
|
|
---
|
|
# The login path must NOT be gated: a request to /oauth2/start that itself demands a
|
|
# login redirects to /oauth2/start forever. ingress-nginx applies the annotations of
|
|
# an ingress to the locations it defines, so a separate object without auth-url keeps
|
|
# this path open. The earlier failure of this shape was not the split — it was the
|
|
# configuration-snippet on the app ingress, which made the controller drop the whole
|
|
# object and left only this one alive.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: comfyui-oauth2
|
|
namespace: comfyui
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: comfyui.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /oauth2
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui-oauth2-proxy
|
|
port:
|
|
number: 4180
|