From 88ff2dd9e8119ac98453d0470d0258a5e12696da Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Sun, 23 Aug 2026 18:26:13 -0500
Subject: [PATCH] tolerate homekit config chown failures in the go2rtc run
 script

---
 docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run | 8 +++++---
 docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run  | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run
index 56ef94e11c..f0fea3661a 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run
@@ -113,9 +113,11 @@ setup_homekit_config "${homekit_config_path}"
 if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
     chown go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
     # go2rtc rewrites this in place (os.WriteFile, no rename), so owning the
-    # file is enough; /config grants frigate-data traverse only
-    chown go2rtc:frigate-data "${homekit_config_path}"
-    chmod 664 "${homekit_config_path}"
+    # file is enough; /config grants frigate-data traverse only. Tolerated so
+    # a chown-refusing mount (NFS root_squash) degrades pairing persistence
+    # instead of crash-looping the service
+    chown go2rtc:frigate-data "${homekit_config_path}" 2>/dev/null && chmod 664 "${homekit_config_path}" 2>/dev/null || \
+        echo "[WARN] Could not hand ${homekit_config_path} to the go2rtc user; HomeKit pairing changes may not persist"
 fi
 
 readonly config_path="/config"
diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
index 74b6f5124f..3ac89f7137 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
@@ -100,7 +100,7 @@ echo "$nginx_settings" | \
 
 if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
     chown -R frigate:frigate /tmp/nginx
-    # only the self-signed key we just generated; user-mounted certs may be :ro
+    # self-signed certs are root-generated; tolerant because mounted certs may be :ro
     if [ -f "$letsencrypt_path/privkey.pem" ]; then
         chown frigate:frigate "$letsencrypt_path/privkey.pem" "$letsencrypt_path/fullchain.pem" 2>/dev/null || true
     fi