dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

caddy: move ComfyUI behind the Anubis + Authentik guard chain

Browse Source 
comfyui.franksdank.cloud was exempt (direct reverse_proxy to comfyui:8188).
The comfyui-proxy proxy provider was created on the embedded outpost first
(internal_host http://caddy:8017, flows copied from hermes-proxy), then the
vhost flips onto the guard chain and authenticated traffic routes back via a
@comfy host match. ComfyUI has no auth of its own; this closes the last
unguarded admin surface on the internal hosts.
This commit is contained in:
Frank
2026-08-30 17:35:49 -07:00
parent 75e7217f4d
commit 5f4377276e
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/Caddyfile
+13 -5
View File
@@ -22,9 +22,11 @@
# CHALLENGE everyone else) → Caddy's internal listener http://:8016 (auth
# decision; Host headers survive every hop) → authenticated traffic is
# forwarded back to http://:8017 and routed straight to the app.
# Apps with their own auth (Grafana, Gitea, OpenWebUI, ComfyUI, Jellyfin,
# *arr, Pi-hole) and the Authentik IdP itself (auth.franksdank.cloud — its
# login flow must never sit behind a challenge) are exempt by construction:
# Apps with their own auth (Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole)
# and the Authentik IdP itself (auth.franksdank.cloud — its login flow must never
# sit behind a challenge) are exempt by construction: their vhosts never route
# through Anubis. ComfyUI left this exempt set on 2026-08-31: it now sits behind
# the guard chain with the comfyui-proxy provider registered on the embedded outpost.
# their vhosts never route through Anubis. The basicauth hash is a
# placeholder; deploy.sh renders the real hash (CADDY_BASICAUTH_HASH from the
# host .env, git-ignored) into /home/dank/Containers/caddy/Caddyfile, which
@@ -102,9 +104,11 @@ search.franksdank.cloud {
}
}
# --- ComfyUI ---
:# --- ComfyUI (guarded: Anubis → Authentik; comfyui-proxy provider, internal_host caddy:8017) ---
comfyui.franksdank.cloud {
reverse_proxy comfyui:8188
reverse_proxy anubis:8923 {
header_up X-Real-Ip {remote_host}
}
}
# --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
@@ -286,6 +290,10 @@ http://:8017 {
handle @hermes {
reverse_proxy 192.168.0.143:9119
}
@comfy host comfyui.franksdank.cloud
handle @comfy {
reverse_proxy comfyui:8188
}
@prometheus host prometheus.franksdank.cloud
handle @prometheus {