administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-04-27 09:07:41 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Enable IPv6 Flaf For Port 5000 and 8971

Browse Source
This commit is contained in:
scyto 2025-08-15 15:34:11 -07:00
parent e1baaefc9f
commit 3455cc580f
4 changed files with 59 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
docker/main/rootfs/usr/local/nginx/get_tls_settings.py
View File

@ -26,6 +26,12 @@ try:
except FileNotFoundError: except FileNotFoundError:
config: dict[str, Any] = {} config: dict[str, Any] = {}
tls_config: dict[str, Any] = config.get("tls", {"enabled": True}) tls_config: dict[str, any] = config.get("tls", {"enabled": True})
ipv6_config: dict[str, any] = config.get("ipv6", {"enabled": False})
print(json.dumps(tls_config)) output = {
"tls": tls_config,
"ipv6": ipv6_config
}
print(json.dumps(output))

58
docker/main/rootfs/usr/local/nginx/templates/listen.gotmpl
View File

@ -1,37 +1,45 @@
# intended for internal traffic, not protected by auth
# Internal (IPv4 always; IPv6 optional)
listen 5000; listen 5000;
listen [::]:5000; {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:5000;{{ end }}{{ end }}
{{ if not .enabled }}
# intended for external traffic, protected by auth # intended for external traffic, protected by auth
listen 8971; {{ if .tls }}
listen [::]:8971; {{ if .tls.enabled }}
# external HTTPS (IPv4 always; IPv6 optional)
listen 8971 ssl;
{{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971 ssl;{{ end }}{{ end }}
{{ else }} ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
# intended for external traffic, protected by auth ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;
listen 8971 ssl;
listen [::]:8971 ssl;
ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem; # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem; # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
# generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP # modern configuration
# https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7 ssl_protocols TLSv1.3;
ssl_session_timeout 1d; ssl_prefer_server_ciphers off;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
# modern configuration # HSTS (ngx_http_headers_module is required) (63072000 seconds)
ssl_protocols TLSv1.3; add_header Strict-Transport-Security "max-age=63072000" always;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds) # ACME challenge location
add_header Strict-Transport-Security "max-age=63072000" always; location /.well-known/acme-challenge/ {
# ACME challenge location
location /.well-known/acme-challenge/ {
default_type "text/plain"; default_type "text/plain";
root /etc/letsencrypt/www; root /etc/letsencrypt/www;
} }
{{ else }}
# external HTTP (IPv4 always; IPv6 optional)
listen 8971;
{{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
{{ end }}
{{ else }}
# (No tls section) default to HTTP (IPv4 always; IPv6 optional)
listen 8971;
{{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
{{ end }} {{ end }}

4
frigate/config/config.py
View File

@ -61,6 +61,7 @@ from .classification import (
) )
from .database import DatabaseConfig from .database import DatabaseConfig
from .env import EnvVars from .env import EnvVars
from .ipv6 import IPv6Config
from .logger import LoggerConfig from .logger import LoggerConfig
from .mqtt import MqttConfig from .mqtt import MqttConfig
from .proxy import ProxyConfig from .proxy import ProxyConfig
@ -353,6 +354,9 @@ class FrigateConfig(FrigateBaseModel):
go2rtc: RestreamConfig = Field( go2rtc: RestreamConfig = Field(
default_factory=RestreamConfig, title="Global restream configuration." default_factory=RestreamConfig, title="Global restream configuration."
) )
ipv6: IPv6Config = Field(
default_factory=IPv6Config, title="IPv6 configuration."
)
mqtt: MqttConfig = Field(title="MQTT configuration.") mqtt: MqttConfig = Field(title="MQTT configuration.")
notifications: NotificationConfig = Field( notifications: NotificationConfig = Field(
default_factory=NotificationConfig, title="Global notification configuration." default_factory=NotificationConfig, title="Global notification configuration."

9
frigate/config/ipv6.py Normal file
View File

@ -0,0 +1,9 @@
from pydantic import Field
from .base import FrigateBaseModel
__all__ = ["IPv6Config"]
class IPv6Config(FrigateBaseModel):
enabled: bool = Field(default=False, title="Enable IPv6 for port 5000 and /or 8971")