Run frigate & nginx inside of container as user 'frigate' and allow a way to set the uid and gid of this user to better facilitate network storage mounts.

docker/rootfs/etc/cont-init.d/01-envfile

@@ -0,0 +1,16 @@
+#! /bin/bash
+
+if [[ "$(ls /var/run/s6/container_environment/ | xargs)" == *"FILE__"* ]]; then
+  for FILENAME in /var/run/s6/container_environment/*; do
+    if [[ "${FILENAME##*/}" == "FILE__"* ]]; then
+      SECRETFILE=$(cat ${FILENAME})
+      if [[ -f ${SECRETFILE} ]]; then
+        FILESTRIP=${FILENAME//FILE__/}
+        cat ${SECRETFILE} > ${FILESTRIP}
+        echo "[env-init] ${FILESTRIP##*/} set from ${FILENAME##*/}"
+      else
+        echo "[env-init] cannot find secret in ${FILENAME##*/}"
+      fi
+    fi
+  done
+fi

docker/rootfs/etc/cont-init.d/10-adduser

@@ -0,0 +1,12 @@
+#!/usr/bin/with-contenv bash
+
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
+
+groupmod -o -g "$PGID" frigate
+usermod -o -u "$PUID" frigate
+
+chown -R frigate:frigate /opt/frigate/frigate
+chown -R frigate:frigate /opt/frigate/migrations
+chown -R frigate:frigate /opt/frigate/web
+chown -R frigate:frigate /usr/local/nginx

docker/rootfs/usr/bin/with-contenv

@@ -0,0 +1,7 @@
+#! /bin/bash
+if [[ -f /var/run/s6/container_environment/UMASK ]] && [[ "$(pwdx $$)" =~ "/run/s6/services/" ]]; then
+  umask $(cat /var/run/s6/container_environment/UMASK)
+  exec /usr/bin/with-contenvb "$@"
+else
+  exec /usr/bin/with-contenvb "$@"
+fi

docker/rootfs/usr/local/nginx/conf/nginx.conf

@@ -1,8 +1,8 @@
 daemon off;
 worker_processes  1;
-
+user frigate;
 error_log  /usr/local/nginx/logs/error.log warn;
-pid        /var/run/nginx.pid;
+pid        /usr/local/nginx/nginx.pid;
 
 events {
     worker_connections  1024;
@@ -71,9 +71,6 @@ http {
         location /vod/ {
             vod hls;
 
-            secure_token $args;
-			secure_token_types application/vnd.apple.mpegurl;
-
             add_header Access-Control-Allow-Headers '*';
             add_header Access-Control-Expose-Headers 'Server,range,Content-Length,Content-Range';
             add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS';
@@ -125,11 +122,6 @@ http {
             root /media/frigate;
         }
 
-        location /cache/ {
-                internal; # This tells nginx it's not accessible from the outside
-                alias /tmp/cache/;
-        }
-
         location /recordings/ {
             add_header 'Access-Control-Allow-Origin' "$http_origin" always;
             add_header 'Access-Control-Allow-Credentials' 'true';