From 5f4377276e13193c67d4e6c0c692282a62f5ad74 Mon Sep 17 00:00:00 2001 From: Frank Date: Sun, 30 Aug 2026 17:35:49 -0700 Subject: [PATCH] caddy: move ComfyUI behind the Anubis + Authentik guard chain comfyui.franksdank.cloud was exempt (direct reverse_proxy to comfyui:8188). The comfyui-proxy proxy provider was created on the embedded outpost first (internal_host http://caddy:8017, flows copied from hermes-proxy), then the vhost flips onto the guard chain and authenticated traffic routes back via a @comfy host match. ComfyUI has no auth of its own; this closes the last unguarded admin surface on the internal hosts. --- dankclaw/Caddyfile | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index 5494d03..5864f58 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -22,9 +22,11 @@ # CHALLENGE everyone else) → Caddy's internal listener http://:8016 (auth # decision; Host headers survive every hop) → authenticated traffic is # forwarded back to http://:8017 and routed straight to the app. -# Apps with their own auth (Grafana, Gitea, OpenWebUI, ComfyUI, Jellyfin, -# *arr, Pi-hole) and the Authentik IdP itself (auth.franksdank.cloud — its -# login flow must never sit behind a challenge) are exempt by construction: +# Apps with their own auth (Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole) +# and the Authentik IdP itself (auth.franksdank.cloud — its login flow must never +# sit behind a challenge) are exempt by construction: their vhosts never route +# through Anubis. ComfyUI left this exempt set on 2026-08-31: it now sits behind +# the guard chain with the comfyui-proxy provider registered on the embedded outpost. # their vhosts never route through Anubis. The basicauth hash is a # placeholder; deploy.sh renders the real hash (CADDY_BASICAUTH_HASH from the # host .env, git-ignored) into /home/dank/Containers/caddy/Caddyfile, which @@ -102,9 +104,11 @@ search.franksdank.cloud { } } -# --- ComfyUI --- +:# --- ComfyUI (guarded: Anubis → Authentik; comfyui-proxy provider, internal_host caddy:8017) --- comfyui.franksdank.cloud { - reverse_proxy comfyui:8188 + reverse_proxy anubis:8923 { + header_up X-Real-Ip {remote_host} + } } # --- OpenWebUI (quadlet on slirp4netns; published 3005) --- @@ -286,6 +290,10 @@ http://:8017 { handle @hermes { reverse_proxy 192.168.0.143:9119 } + @comfy host comfyui.franksdank.cloud + handle @comfy { + reverse_proxy comfyui:8188 + } @prometheus host prometheus.franksdank.cloud handle @prometheus {