* don't let camera names waive the admin check on non-camera routes
The global admin guard skipped the admin check for any request whose first path segment matched a configured camera name, without looking at which route actually handled it. A camera named `faces`, `lpr`, `audio`, or `classification` let viewers reach the face, LPR, audio transcription, and classification endpoints that rely only on the global guard. The exemption now also requires the matched route to be a `/{camera_name}` route, so camera routes behave exactly as before.
* add test
* revert disable save buttons when there are no changes in config editor
* pass migrated config to each step in the config migration chain
* use 150 as the default max when typing a min speed in the search filter
* fix preview export outpoint to be relative to the start of the preview file
* don't crash on invalid trusted proxy entries or non-ip forwarded hops
* translate the camera count badge in the roles table
* run every batch through the lpr recognition model
* log rejected motion and notification mqtt payloads
* log invalid addresses in x-forwarded-for
* add test
* remove unused autotracked_object_region
* remove unreachable autotracker setup call in camera maintenance
* apply onvif retry limit when initialization fails
* fix reindex progress overcounting when there are fewer events than a batch
* match the register device button aria label to its text
* reset the add profile form on cancel
* ignore case when filtering search suggestions
* tweak comment
* fix recordings unavailable endpoint when no params are provided
we already import the datetime class directly, so those attribute lookups raised AttributeError and the request returned 500
* reject JWTs whose role is no longer in the config
`/auth` trusted the role inside the JWT and re-signed it on refresh without checking the config, so a user whose restricted role was deleted kept a session carrying a role that isn't in `auth.roles`. The media, clip, recording, export and go2rtc checks treat a missing role the same as a role with no camera list, so that session could open every camera. `/auth` now returns 401 for a token whose role isn't configured, which sends the user back through login, and login already falls back to `viewer` for a role that's gone.
* delete the deleted camera group's layout, not the open one's
Deleting a camera group removed the layout of the group being viewed, because the dialog's delete was bound to `${activeGroup}-draggable-layout`. It also cleared the saved group, and both ran before the `config/set` request whether or not it succeeded, so deleting one group while viewing another lost the open group's layout and left the deleted group's layout behind. The deleted group's own layout is now removed after a successful save, and the saved group is only cleared when it was the open group.
* don't block API when querying PTZ info
camera_ptz_info is async but waited on the ONVIF controller's future with future.result(), blocking the API event loop for as long as a slow or unreachable ONVIF camera took to answer (including reconnect attempts), so every other async request stalled with it. Await the future with asyncio.wrap_future instead. The coroutine runs on the controller's own loop and thread, so this cannot deadlock.
* for custom exports, only allow admin users to add to existing cases
follows the existing convention where attaching an export to an existing case is admin-only on `POST /export/{camera}/...` and `POST /exports/batch`
* drop pending edits for a camera or profile that no longer exists
* match cached preview frames to their camera exactly
https://github.com/blakeblackshear/frigate/pull/22594 added a trailing `-` to the `preview_{camera}` prefix so `camera` stopped matching `camera2`'s frames, but camera names can contain `-`, so `front` still matched `front-door`'s. After a restart, `front`'s preview recorder deleted this hour's frames of a matching camera that sorted before it and added the timestamps of one that sorted after it, so ffmpeg was asked for files that don't exist and that hour's preview was lost. The offline fallback for `latest.jpg` could also return `front-door`'s frame for `front`, even to a user without access to `front-door`, and a short export could take its fallback thumbnail from the other camera. These now compare the full camera name taken from the file name.
* Verify s6-overlay downloads against pinned checksums
* Verify go2rtc download against pinned checksums
The v1.9.14 release publishes no checksums file, just the bare per-platform binaries, so these digests come from a one-time fetch rather than upstream. That pins the artifact against later substitution, which is the realistic threat for a version we stay on for months, but it does not verify the original download. The stage moves from `ADD --link` to a script because `ADD --checksum` can't express an architecture-dependent URL.
* Verify main image downloads against pinned checksums
Covers everything the main image downloads on the default path: tempio, the hailort runtime tarball and wheel, the six ffmpeg builds, the libedgetpu deb, and the thirteen Intel driver debs. The hailort tarball was streamed straight into `tar`, which can't be verified before extraction, so it downloads to `/tmp` first. The three ffmpeg blocks per arch collapse into one `install_ffmpeg` helper since they only differed by URL and install dir, and the Intel debs go through a `fetch_intel_deb` helper for the same reason.
The Intel debs are the ones that mattered most here. They're installed as root with `dpkg` on the default amd64 path and had no verification at all. compute-runtime publishes a `ww<week>.sum` asset with every release and npu-driver published `checksum.sha256` on v1.19.0, so those eight digests came from upstream rather than from us. intel-graphics-compiler and level-zero publish none, so those five and everything else here come from a one-time fetch, which pins the artifact against later substitution but doesn't verify the original download. The comment above the map says which is which and how to refresh them, since npu-driver has stopped publishing sums since v1.19.0 and that provenance won't survive the next bump.
Still unpinned: `get-pip.py`, which is a rolling URL where a digest would just break the build on pypa's next edit, and the per-variant artifacts for Axera, Synaptics, and Jetson. apt repositories are out of scope since apt already verifies signatures.
* Restrict generated TLS key permissions
OpenSSL 3.x already writes the key at 600 on its own, so this pins the guarantee rather than fixing an observed leak: the mode no longer depends on the openssl version or the umask the service happens to start with. Only the generated pair is touched. User-mounted certs take the other branch and are never chmod'd, which matters when they're mounted read-only.
* Add security headers and server_tokens off
Adds `X-Content-Type-Options: nosniff` and `Referrer-Policy: strict-origin-when-cross-origin`, and turns off nginx version disclosure.
No `X-Frame-Options` and no CSP `frame-ancestors`. HA's Webpage card and iframe panels frame Frigate's own address cross-origin, and either header would break them silently with nothing in Frigate's logs to explain it. Ingress is same-origin and would survive `SAMEORIGIN`, but Frigate can't tell the two apart from inside the container. `security_headers.conf` is a plain file in the image rather than a generated one, so anyone who does want framing restrictions can bind-mount it.
`add_header` doesn't inherit into a block that declares its own, so the include goes in per block, all nine of them, including the four nested static-asset locations that serve the JS bundles. Those are the ones nosniff actually matters for.
The run script now reads `get_nginx_settings.py` once into a variable instead of shelling out per template. That script imports the frigate config machinery, which is noticeable on an SBC.
Not fixed here: `listen.conf` is included at server level and carries `Strict-Transport-Security`, so those same nine blocks already drop HSTS under TLS today. Folding it into this file would change existing TLS behavior on nine paths, so it needs its own PR.
* Restrict go2rtc config file permissions
* Log failed login attempts with source address
Failed logins returned a bare 401 and left nothing behind, so credential stuffing was invisible unless you were already watching nginx access logs. Both failure branches now log a warning with the attempted username and the client address.
The address comes from `get_remote_addr()`, the same helper the login rate limiter keys on, so the two agree on who the client is and the trusted-proxy handling is consistent. Logging a raw `x-forwarded-for` instead would let an attacker forge the source address in the very log line meant to catch them.
The response is unchanged and identical either way. Which factor failed is only visible in the log, never to the client, and the password is never logged.
* Recommend least-privilege container options in install docs
The compose generator pushed `privileged: true` into every file it produced, no matter what hardware you picked, and it's the default tab on the install page so it's what most people copy. It now emits `security_opt: no-new-privileges:true` instead, and only adds `privileged: true` for hardware that actually needs it, with the reason inline. MemryX is the only one today, since it needs to reach the max-manager. Rockchip and Synaptics only want privileged during initial setup and their documented end state is device mappings, so neither gets it.
`no-new-privileges` merges into the same `security_opt` block as any device-specific entries, so Rockchip still gets its `apparmor=unconfined` and `systempaths=unconfined` without a duplicate key.
The static example now has `privileged` commented out, and there's a short section on the options worth adding, with a note that `cap_drop: ALL` breaks `telemetry.stats.network_bandwidth` since nethogs needs NET_ADMIN/NET_RAW.
* Add amd64 container smoke test to CI
Boots the built amd64 image against a minimal config and asserts the two security headers, that the Server header no longer carries a version, that no frame-ancestors is present, that nginx accepts its own config, and the two file modes. This is also the harness the rest of the hardening work extends.
The two negative assertions are written as `if grep; then exit 1; fi` rather than `! grep`. Bash exempts a negated command from `set -e`, so the `!` form would have passed even with the version and frame-ancestors both present, which is the opposite of what a regression net is for.
* Make review user read status consistent with other APIs
* Validate URLs for web push endpoint
* Validate the role for a custom viewer, rate limit password changing
* Cleanup
/auth grants anonymous admin to any request whose X-Server-Port matches networking.listen.internal, but it read that port off the live config while nginx binds its listeners once at container start and never reloads them, so any path that swaps the running config could move the trusted port without nginx moving with it. Saving networking.listen.internal equal to the external port applied immediately despite the restart-required warning, which handed unauthenticated admin to everything reaching the external port. Snapshot the port at app creation and compare against that instead, and reject a config whose two listeners share a port number, which nginx would refuse to start with anyway.
* Add logout endpoint to Nginx configuration to prevent logout from silently generating a new frigate_token cookie
* Change JWT cookie expiration to use max_age and have the appropriate expiration time based on JWT_SESSION_LENGTH
* ruff formatting
* Pin ruff
* Add python upgrade fixes
This enables python upgrade checks in ruff to look for deprecated types and patterns. This namely fixes:
- usage of deprecated `Typing` which is now built in
- some specific exceptions which are caught and have new aliases
Some specific UP checks were also ignored as they are stylistic / unimportant and likely to cause bugs
* Remove async blocking calls
Use asyncio.to_thread on two remaining blocking calls to fix hanging event thread loop. Enable this specific rule to block it in the future.
* Use proper logging mechanism
* Correctly format logs
* Raise with context
When raising an exception include the from context to improve debugging
* Cleanup
* display zone names consistently using friendly_name or raw id without transformation
* enforce camera-level access on go2rtc live stream websocket endpoints
* backend
* frontend + i18n
* tests + api spec
* tweak backend to use Job infrastructure for exports
* frontend tweaks and Job infrastructure
* tests
* tweaks
- add ability to remove from case
- change location of counts in case card
* add stale export reaper on startup
* fix toaster close button color
* improve add dialog
* formatting
* hide max_concurrent from camera config export settings
* remove border
* refactor batch endpoint for multiple review items
* frontend
* tests and fastapi spec
* fix deletion of in-progress exports in a case
* tweaks
- hide cases when filtering cameras that have no exports from those cameras
- remove description from case card
- use textarea instead of input for case description in add new case dialog
* add auth exceptions for exports
* add e2e test for deleting cases with exports
* refactor delete and case endpoints
allow bulk deleting and reassigning
* frontend
- bulk selection like Review
- gate admin-only actions
- consolidate dialogs
- spacing/padding tweaks
* i18n and tests
* update openapi spec
* tweaks
- add None to case selection list
- allow new case creation from single cam export dialog
* fix codeql
* fix i18n
* remove unused
* fix frontend tests
* fix video playback stutter when GenAI dialog is open in detail stream
Inline `onOpen` callback in DetailStream.tsx:522 creates a new function identity every render. GenAISummaryChip.tsx:98's useEffect depends on [open, onOpen], so it re-fires on every parent re-render while the dialog is open. Each fire calls onSeek -> setCurrentTime -> seekToTimestamp, creating a continuous re-render + seek loop
* add /profiles to EXEMPT_PATHS for non-admin users
* skip debug_replay/status poll for non-admin users
* use subquery for timeline lookup to avoid SQLite variable limit
* Update version
* Create scaffolding for case management (#21293)
* implement case management for export apis (#21295)
* refactor vainfo to search for first GPU (#21296)
use existing LibvaGpuSelector to pick appropritate libva device
* Case management UI (#21299)
* Refactor export cards to match existing cards in other UI pages
* Show cases separately from exports
* Add proper filtering and display of cases
* Add ability to edit and select cases for exports
* Cleanup typing
* Hide if no unassigned
* Cleanup hiding logic
* fix scrolling
* Improve layout
* Camera connection quality indicator (#21297)
* add camera connection quality metrics and indicator
* formatting
* move stall calcs to watchdog
* clean up
* change watchdog to 1s and separately track time for ffmpeg retry_interval
* implement status caching to reduce message volume
* Export filter UI (#21322)
* Get started on export filters
* implement basic filter
* Implement filtering and adjust api
* Improve filter handling
* Improve navigation
* Cleanup
* handle scrolling
* Refactor temperature reporting for detectors and implement Hailo temp reading (#21395)
* Add Hailo temperature retrieval
* Refactor `get_hailo_temps()` to use ctxmanager
* Show Hailo temps in system UI
* Move hailo_platform import to get_hailo_temps
* Refactor temperatures calculations to use within detector block
* Adjust webUI to handle new location
---------
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
* Camera-specific hwaccel settings for timelapse exports (correct base) (#21386)
* added hwaccel_args to camera.record.export config struct
* populate camera.record.export.hwaccel_args with a cascade up to camera then global if 'auto'
* use new hwaccel args in export
* added documentation for camera-specific hwaccel export
* fix c/p error
* missed an import
* fleshed out the docs and comments a bit
* ruff lint
* separated out the tips in the doc
* fix documentation
* fix and simplify reference config doc
* Add support for GPU and NPU temperatures (#21495)
* Add rockchip temps
* Add support for GPU and NPU temperatures in the frontend
* Add support for Nvidia temperature
* Improve separation
* Adjust graph scaling
* Exports Improvements (#21521)
* Add images to case folder view
* Add ability to select case in export dialog
* Add to mobile review too
* Add API to handle deleting recordings (#21520)
* Add recording delete API
* Re-organize recordings apis
* Fix import
* Consolidate query types
* Add media sync API endpoint (#21526)
* add media cleanup functions
* add endpoint
* remove scheduled sync recordings from cleanup
* move to utils dir
* tweak import
* remove sync_recordings and add config migrator
* remove sync_recordings
* docs
* remove key
* clean up docs
* docs fix
* docs tweak
* Media sync API refactor and UI (#21542)
* generic job infrastructure
* types and dispatcher changes for jobs
* save data in memory only for completed jobs
* implement media sync job and endpoints
* change logs to debug
* websocket hook and types
* frontend
* i18n
* docs tweaks
* endpoint descriptions
* tweak docs
* use same logging pattern in sync_recordings as the other sync functions (#21625)
* Fix incorrect counting in sync_recordings (#21626)
* Update go2rtc to v1.9.13 (#21648)
Co-authored-by: Eugeny Tulupov <eugeny.tulupov@spirent.com>
* Refactor Time-Lapse Export (#21668)
* refactor time lapse creation to be a separate API call with ability to pass arbitrary ffmpeg args
* Add CPU fallback
* Optimize empty directory cleanup for recordings (#21695)
The previous empty directory cleanup did a full recursive directory
walk, which can be extremely slow. This new implementation only removes
directories which have a chance of being empty due to a recent file
deletion.
* Implement llama.cpp GenAI Provider (#21690)
* Implement llama.cpp GenAI Provider
* Add docs
* Update links
* Fix broken mqtt links
* Fix more broken anchors
* Remove parents in remove_empty_directories (#21726)
The original implementation did a full directory tree walk to find and remove
empty directories, so this implementation should remove the parents as well,
like the original did.
* Implement LLM Chat API with tool calling support (#21731)
* Implement initial tools definiton APIs
* Add initial chat completion API with tool support
* Implement other providers
* Cleanup
* Offline preview image (#21752)
* use latest preview frame for latest image when camera is offline
* remove frame extraction logic
* tests
* frontend
* add description to api endpoint
* Update to ROCm 7.2.0 (#21753)
* Update to ROCm 7.2.0
* ROCm now works properly with JinaV1
* Arcface has compilation error
* Add live context tool to LLM (#21754)
* Add live context tool
* Improve handling of images in request
* Improve prompt caching
* Add networking options for configuring listening ports (#21779)
* feat: add X-Frame-Time when returning snapshot (#21932)
Co-authored-by: Florent MORICONI <170678386+fmcloudconsulting@users.noreply.github.com>
* Improve jsmpeg player websocket handling (#21943)
* improve jsmpeg player websocket handling
prevent websocket console messages from appearing when player is destroyed
* reformat files after ruff upgrade
* Allow API Events to be Detections or Alerts, depending on the Event Label (#21923)
* - API created events will be alerts OR detections, depending on the event label, defaulting to alerts
- Indefinite API events will extend the recording segment until those events are ended
- API event start time is the actual start time, instead of having a pre-buffer of record.event_pre_capture
* Instead of checking for indefinite events on a camera before deciding if we should end the segment, only update last_detection_time and last_alert_time if frame_time is greater, which should have the same effect
* Add the ability to set a pre_capture number of seconds when creating a manual event via the API. Default behavior unchanged
* Remove unnecessary _publish_segment_start() call
* Formatting
* handle last_alert_time or last_detection_time being None when checking them against the frame_time
* comment manual_info["label"].split(": ")[0] for clarity
* ffmpeg Preview Segment Optimization for "high" and "very_high" (#21996)
* Introduce qmax parameter for ffmpeg preview encoding
Added PREVIEW_QMAX_PARAM to control ffmpeg encoding quality.
* formatting
* Fix spacing in qmax parameters for preview quality
* Adapt to new Gemini format
* Fix frame time access
* Remove exceptions
* Cleanup
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
Co-authored-by: Andrew Roberts <adroberts@gmail.com>
Co-authored-by: Eugeny Tulupov <zhekka3@gmail.com>
Co-authored-by: Eugeny Tulupov <eugeny.tulupov@spirent.com>
Co-authored-by: John Shaw <1753078+johnshaw@users.noreply.github.com>
Co-authored-by: Eric Work <work.eric@gmail.com>
Co-authored-by: FL42 <46161216+fl42@users.noreply.github.com>
Co-authored-by: Florent MORICONI <170678386+fmcloudconsulting@users.noreply.github.com>
Co-authored-by: nulledy <254504350+nulledy@users.noreply.github.com>
* improve chip tooltip display
- use formatList to use i18n separators instead of commas
- ensure the correct event type is used so sublabels are not run through normalization
- remove smart-capitalization classes as translated labels use i18n (which includes capitalization)
- give icons an optional key so that the console doesn't complain about duplication when rendering
* Add grace period for recording segment checks to prevent spurious ffmpeg restarts
* add admin precedence to proxy role_map resolution to prevent downgrade
* clean up
* formatting
* work around radix pointer events issue when dialog is opened from drawer
fixes https://github.com/blakeblackshear/frigate/discussions/21940
* prevent console warnings about missing titles and descriptions
make these invisible with sr-only
* remove duplicate language
* Adjust handling for device sizes
* Cleanup
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Adjust title prompt to have less rigidity
* Improve motion boxes handling for features that don't require motion
* Improve handling of classes starting with digits
* Improve vehicle nuance
* tweak lpr docs
* Improve grammar
* Don't allow # in face name
* add password requirements to new user dialog
* change password requirements
* Clenaup
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* Fix genai callbacks in MQTT
* Cleanup cursor pointer for classification cards
* Cleanup
* Handle unknown SOCs for RKNN converter by only using known SOCs
* don't allow "none" as a classification class name
* change internal port user to admin and default unspecified username to viewer
* keep 5000 as anonymous user
* suppress tensorflow logging during classification training
* Always apply base log level suppressions for noisy third-party libraries even if no specific logConfig is provided
* remove decorator and specifically suppress TFLite delegate creation messages
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* Wait for config to load before evaluating route access
Fix race condition where custom role users are temporarily denied access after login while config is still loading. Defer route rendering in DefaultAppView until config is available so the complete role list is known before ProtectedRoute evaluates permissions
* Use batching for state classification generation
* Ignore incorrect scoring images if they make it through the deletion
* Delete unclassified images
* mitigate tensorflow atexit crash by pre-importing tflite/tensorflow on main thread
Pre-import Interpreter in embeddings maintainer and add defensive lazy imports in classification processors to avoid worker-thread tensorflow imports causing "can't register atexit after shutdown"
* don't require old password for users with admin role when changing passwords
* don't render actions menu if no options are available
* Remove hwaccel arg as it is not used for encoding
* change password button text
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Fix Safari popover issue in classification wizard
* use name for key instead of title
prevents duplicate key warnings when users mix vaapi and qsv
* update auth api endpoint descriptions and docs
* tweak headings
* fix note
* clarify classification docs
* Fix cuda birdseye
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* jwt permissions
* add old password to body req
* add model and migration
need to track the datetime that passwords were changed for the jwt
* auth api backend changes
- use os.open to create jwt secret with restrictive permissions (0o600: read/write for owner only)
- add backend validation for password strength
- add iat claim to jwt so the server can determine when a token was issued and reject any jwts issued before a user's password_changed_at timestamp, ensuring old tokens are invalidated after a password change
- set logout route to public to avoid 401 when logging out
- issue new jwt for users who change their own password so they stay logged in
* improve set password dialog
- add field to verify old password
- add password strength requirements
* frontend tweaks for password dialog
* i18n
* use verify endpoint for existing password verification
avoid /login side effects (creating a new session)
* public logout
* only check if password has changed on jwt refresh
* fix tests
Fix migration 030 by using raw sql to select usernames (avoid ORM selecting nonexistent columns)
* add multi device warning to password dialog
* remove password verification endpoint
Just send old_password + new password in one request, let the backend handle verification in a single operation
* Don't add to history when opening search dialog
* Update caniuse
* Revamp the history handling for dialog components
* clarify audio transcription docs
* Use titlecase helper
* Allow running object clasasification on stationary objects
* small spacing tweaks for tablets
* require admin role to delete users
* explicitly prevent deletion of admin user
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* update config for roles and add validator
* ensure admin and viewer are never overridden
* add class method to user to retrieve all allowed cameras
* enforce config roles in auth api endpoints
* add camera access api dependency functions
* protect review endpoints
* protect preview endpoints
* rename param name for better fastapi injection matching
* remove unneeded
* protect export endpoints
* protect event endpoints
* protect media endpoints
* update auth hook for allowed cameras
* update default app view
* ensure anonymous user always returns all cameras
* limit cameras in explore
* cameras is already a list
* limit cameras in review/history
* limit cameras in live view
* limit cameras in camera groups
* only show face library and classification in sidebar for admin
* remove check in delete reviews
since admin role is required, no need to check camera access. fixes failing test
* pass request with camera access for tests
* more async
* camera access tests
* fix proxy auth tests
* allowed cameras for review tests
* combine event tests and refactor for camera access
* fix post validation for roles
* don't limit roles in create user dialog
* fix triggers endpoints
no need to run require camera access dep since the required role is admin
* fix type
* create and edit role dialogs
* delete role dialog
* fix role change dialog
* update settings view for roles
* i18n changes
* minor spacing tweaks
* docs
* use badges and camera name label component
* clarify docs
* display all cameras badge for admin and viewer
* i18n fix
* use validator to prevent reserved and empty roles from being assigned
* split users and roles into separate tabs in settings
* tweak docs
* clarify docs
* change icon
* don't memoize roles
always recalculate on component render
When an IPv6 address that doesn't map to an IPv4 address was checked
against an IPv4 trusted proxy, we'd hit an exception because
ip.ipv4_mapped was None. Fix this by verifying ipv4_mapped is not None
Co-authored-by: me <me@me>
* Fix showing review items that span over multiple days
* Simplify
* Fix tests
* Fix unchanged value
* Allow admin as default role and viewer as passed header for proxy auth
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* face library i18n fixes
* face library i18n fixes
* add ability to use ctrl/cmd S to save in the config editor
* Use datetime as ID
* Update metrics inference speed to start with 0 ms
* fix android formatted thumbnail
* ensure role is comma separated and stripped correctly
* improve face library deletion
- add a confirmation dialog
- add ability to select all / delete faces in collections
* Implement lazy loading for video previews
* Force GPU for large embedding model
* GPU is required
* settings i18n fixes
* Don't delete train tab
* webpush debugging logs
* Fix incorrectly copying zones
* copy path data
* Ensure that cache dir exists for Frigate+
* face docs update
* Add description to upload image step to clarify the image
* Clean up
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* frigate+ pane i18n fix
* catch more exceptions
* explore search result tooltip i18n fix
* i18n fix
* remove comments about deprecated strftime_fmt
* Catch producers exists but is None
* Formatting
* fix live camera view i18n
* Add default role config for proxy users
This allows users to specify a default role for users when using a proxy for auth. This can be useful for users who can't/don't want to define a header mapping for the remote-role header.
* update reference config and auth docs
* clarify face rec camera level config
* clarify auth docs
* Fix onnx not working with openvino
* Update openvino to fix failed npu plugin check
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Move database and config from homeassistant /config to addon /config
* Re-implement config migration for the add-on
* Align some terms
* Improve function name
* Use local variables
* Add model.path migration
* Fix homeassistant config path
* Ensure migration scripts run before go2rtc and frigate
* Migrate all files I know
* Add ffmpeg.path migration
* Update docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* Improve some variable names and organization
* Update docs to reflect addon config dir
* Update live.md with /addon_configs
* Move addon config section to configuration doc
* Align several terminologies and improve text
* Fix webrtc example config title
* Capitalize Add-on in more places
* Improve specific add-on config dir docs
* Align bash and python scripts to prefer config.yml over config.yaml
* Support config.json in migration shell scripts
* Change docs to reflect config.yml is preferred over config.yaml
* If previous config was yaml, migrate to yaml
* Fix typo in edgetpu.md
* Fix formatting of Python files
* Remove HailoRT Beta add-on variant from docs
* Add migration for labelmap and certs
* Fix variable name
* Fix new_config_file var unset
* Fix addon config directories table
* Improve db migration to avoid migrating files like .db.bak
* Fix echo location
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Blake Blackshear