scope classification attributes to allowed cameras

Recording fixes (#24072 )
* pin genai review frames to the main stream * retain previews as long as either stream has recordings * watch sub stream recording health separately from main * reject record_sub on the same input as record and document the role * derive recording paths from the cache segment timestamp Recording paths carry one second of resolution, but since sub stream recording start times are resolved to fractional wall clock, anchored to the cache file mtime and chained to the previous segment's end. A stream cutting segments faster than once a second resolves consecutive segments into the same second, so two rows collide on the unique path index and the batch insert fails. The cache segment name is unique per camera stream and second by construction because ffmpeg names segments with strftime, so the recording path is now built from that timestamp while the row keeps the resolved start time. This also restores the path semantics from before sub stream recording, when start times came straight from the cache filename. Nothing derives times from recording paths: playback offsets, stream switching, and export all use the row's start time, which is unchanged, and the recordings sync matches files by exact path string. * keep the rest of a recording batch when one row conflicts * only publish record_sub status when a sub stream is configured * don't shadow camera_cfg when publishing empty cache streams * back off restarts when a recording stream goes stale * give the shared sub stream grace on any capture thread reset * include segment details in recording discard warnings
2026-10-24 15:35:46 +03:00 · 2026-08-25 14:40:13 -05:00 · 2026-08-25 11:51:58 -06:00 · 2026-08-23 14:40:32 -06:00 · 2026-08-23 10:50:03 -06:00 · 2026-08-23 10:31:31 -06:00
141 changed files with 953 additions and 9334 deletions
@@ -59,16 +59,10 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Start container
        run: |
-          mkdir -p /tmp/frigate-config /tmp/frigate-media
+          mkdir -p /tmp/frigate-config
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config/config.yml
          # simulate a root-era install: root-owned 0600 jwt secret pre-exists
          docker run --rm -v /tmp/frigate-config:/config --entrypoint bash \
            ${{ steps.setup.outputs.image-name }}-amd64 \
            -c "python3 -c 'import secrets; open(\"/config/.jwt_secret\",\"w\").write(secrets.token_hex(64))' && chmod 600 /config/.jwt_secret && chown 0:0 /config/.jwt_secret"
          docker run -d --name frigate --shm-size 256m \
            -v /tmp/frigate-config:/config \
            -v /tmp/frigate-media:/media/frigate \
            --mount type=tmpfs,target=/tmp/cache,tmpfs-size=100000000 \
            -p 5000:5000 -p 8971:8971 \
            ${{ steps.setup.outputs.image-name }}-amd64
      - name: Wait for API
@@ -97,181 +91,16 @@ jobs:
            echo "response carries frame-ancestors, which breaks cross-origin iframe embedding"
            exit 1
          fi
-          # -t as root would chown the live cache and temp dirs to the `user`
+          docker exec frigate /usr/local/nginx/sbin/nginx -t
-          # directive user; stdout discarded because -t reopens the config's
+          docker exec frigate stat -c %a /etc/letsencrypt/live/frigate/privkey.pem | grep -qx 600
          # /dev/stdout logs and the docker exec pipe is root-owned
          docker exec frigate /command/s6-setuidgid frigate bash -c '/usr/local/nginx/sbin/nginx -e stderr -t -c /tmp/nginx/conf/nginx.conf >/dev/null'
          docker exec frigate stat -c %a /config/tls/privkey.pem | grep -qx 600
          docker exec frigate stat -c %a /dev/shm/go2rtc.yaml | grep -qx 640
      - name: Assert services run as non-root
        run: |
          ps_out=$(docker exec frigate ps -eo user=,comm=)
          echo "$ps_out"
          assert_nonroot() {
            # the process must exist AND no instance of it may run as root
            echo "$ps_out" | grep -qw "$1" || { echo "$1 is not running"; exit 1; }
            if echo "$ps_out" | grep -w "$1" | grep -q '^root'; then
              echo "$1 is running as root"; exit 1
            fi
          }
          assert_nonroot python3
          assert_nonroot go2rtc
          assert_nonroot nginx
          # root-era jwt secret must have been captured by the sweep and the
          # auth stack must be functional: wrong creds => clean 401, not 500
          docker exec frigate stat -c %u /config/.jwt_secret | grep -qx "$(docker exec frigate id -u frigate)"
          code=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:5000/api/login \
            -H 'content-type: application/json' -d '{"user":"admin","password":"definitely-wrong"}')
          [ "$code" = "401" ] || { echo "login endpoint returned $code"; exit 1; }
          # a root nginx -t above would have chowned the runtime dirs to root
          owners=$(docker exec frigate stat -c %U /tmp/nginx /dev/shm/nginx_cache)
          echo "$owners"
          if echo "$owners" | grep -qvx frigate; then
            echo "nginx runtime dirs are not owned by frigate"; exit 1
          fi
          # runtime user can write recordings storage
          docker exec frigate /command/s6-setuidgid frigate touch /media/frigate/.write-probe
          docker exec frigate rm /media/frigate/.write-probe
          # tmpfs mount per the docs: arrives root-owned, holds the ZMQ IPC sockets
          docker exec frigate /command/s6-setuidgid frigate touch /tmp/cache/.write-probe
          docker exec frigate rm /tmp/cache/.write-probe
          # models are baked in as root and archive members can carry root-only modes
          docker exec frigate /command/s6-setuidgid frigate sh -c '
            for f in /cpu_model.tflite /edgetpu_model.tflite /cpu_audio_model.tflite \
                     /labelmap.txt /audio-labelmap.txt /openvino-model/*; do
              [ -e "$f" ] || continue
              test -r "$f" || { echo "$f is not readable by the runtime user"; exit 1; }
            done'
      - name: Assert device access grants
        run: |
          # a fake accelerator node created after boot, then the oneshot re-run
          docker exec frigate mknod /dev/apex_9 c 120 99
          docker exec frigate /etc/s6-overlay/s6-rc.d/init-devices/run
          acl=$(docker exec frigate getfacl -p /dev/apex_9)
          echo "$acl"
          echo "$acl" | grep -q "user:frigate:rw-"
          echo "$acl" | grep -q "user:go2rtc:rw-"
          # the usb tree gets recursive grants plus a default ACL that
          # newly created nodes inherit (the Coral re-enumeration path)
          docker exec frigate sh -c 'mkdir -p /dev/bus/usb/001 && mknod /dev/bus/usb/001/002 c 189 1'
          docker exec frigate /etc/s6-overlay/s6-rc.d/init-devices/run
          docker exec frigate getfacl -p /dev/bus/usb/001 | grep -q "user:frigate:rwx"
          docker exec frigate sh -c 'mknod /dev/bus/usb/001/099 c 189 98 && chmod 664 /dev/bus/usb/001/099'
          inherited=$(docker exec frigate getfacl -p /dev/bus/usb/001/099)
          echo "$inherited"
          echo "$inherited" | grep -q "user:frigate:rw-"
          # getfacl prints granted perms even when the mask clamps them to
          # nothing, with a trailing "#effective:" comment; a clamped ACL must
          # fail this assertion, not sneak past it. The check is scoped to the
          # runtime users because the inherited group:: entry is always clamped
          # on a non-directory, so an unscoped grep could never pass.
          if echo "$inherited" | grep -E "^user:(frigate|go2rtc):" | grep -q "effective"; then
            echo "inherited ACL is mask-clamped and grants no real access"; exit 1
          fi
          # hardware that is absent must stay silent: the literal table entries
          # are not globs, so nullglob does not drop them and only an existence
          # check keeps them from warning on every boot
          out=$(docker exec frigate /etc/s6-overlay/s6-rc.d/init-devices/run)
          echo "$out"
          if echo "$out" | grep -q "WARN"; then
            echo "grant warned about device nodes that do not exist"; exit 1
          fi
      - name: Assert escape hatch restores root
        run: |
          mkdir -p /tmp/frigate-config-root
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-root/config.yml
          # pre-seed so the absence check proves the rm -f, not a vacuous pass
          echo "2:1000:1000" > /tmp/frigate-config-root/.permissions_version
          docker run -d --name frigate-root --shm-size 256m \
            -e FRIGATE_RUN_AS_ROOT=true \
            -v /tmp/frigate-config-root:/config \
            ${{ steps.setup.outputs.image-name }}-amd64
          up=0
          for i in $(seq 1 60); do
            docker exec frigate-root curl -fs http://127.0.0.1:5000/api/version && up=1 && break
            sleep 5
          done
          if [ "$up" -ne 1 ]; then echo "escape hatch container never healthy"; docker logs frigate-root; exit 1; fi
          ps_out=$(docker exec frigate-root ps -eo user=,comm=)
          echo "$ps_out"
          echo "$ps_out" | grep -w python3 | grep -q '^root'
          echo "$ps_out" | grep -w go2rtc  | grep -q '^root'
          echo "$ps_out" | grep -w nginx   | grep -q '^root'
          # an if, not ! test: bash exempts negated commands from set -e
          if docker exec frigate-root test -f /config/.permissions_version; then
            echo "escape hatch did not delete the sweep sentinel"; exit 1
          fi
          docker rm -f frigate-root
      - name: Assert granular root services
        run: |
          mkdir -p /tmp/frigate-config-granular /tmp/frigate-media-granular
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-granular/config.yml
          docker run -d --name frigate-granular --shm-size 256m \
            -e FRIGATE_ROOT_SERVICES=frigate \
            -v /tmp/frigate-config-granular:/config \
            -v /tmp/frigate-media-granular:/media/frigate \
            ${{ steps.setup.outputs.image-name }}-amd64
          up=0
          for i in $(seq 1 60); do
            docker exec frigate-granular curl -fs http://127.0.0.1:5000/api/version && up=1 && break
            sleep 5
          done
          if [ "$up" -ne 1 ]; then echo "granular container never became healthy"; docker logs frigate-granular; exit 1; fi
          ps_out=$(docker exec frigate-granular ps -eo user=,comm=)
          echo "$ps_out"
          # the listed service runs as root
          echo "$ps_out" | grep -w python3 | grep -q '^root'
          # unlisted services still drop; ifs because set -e exempts negated commands
          if echo "$ps_out" | grep -w go2rtc | grep -q '^root'; then
            echo "go2rtc is unexpectedly running as root"; exit 1
          fi
          if echo "$ps_out" | grep -w nginx | grep -q '^root'; then
            echo "nginx is unexpectedly running as root"; exit 1
          fi
          # the sweep still ran and the sentinel records the mode
          docker exec frigate-granular cat /config/.permissions_version | grep -qx "2:1000:1000:frigate"
          # the root frigate process chowns the db it creates (first-boot immediacy)
          docker exec frigate-granular stat -c %u /config/frigate.db | grep -qx 1000
          # plant a root-owned straggler; the per-boot sweep must reclaim it on restart
          docker exec frigate-granular sh -c 'mkdir -p /media/frigate/clips && touch /media/frigate/clips/straggler.webp'
          docker restart frigate-granular
          up=0
          for i in $(seq 1 60); do
            docker exec frigate-granular curl -fs http://127.0.0.1:5000/api/version && up=1 && break
            sleep 5
          done
          if [ "$up" -ne 1 ]; then echo "granular container never came back after restart"; docker logs frigate-granular; exit 1; fi
          docker exec frigate-granular stat -c %u /media/frigate/clips/straggler.webp | grep -qx 1000
          docker rm -f frigate-granular
      - name: Assert unknown root service fails fast
        run: |
          mkdir -p /tmp/frigate-config-badsvc
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-badsvc/config.yml
          docker run -d --name frigate-badsvc --shm-size 256m \
            -e FRIGATE_ROOT_SERVICES=frigatee \
            -v /tmp/frigate-config-badsvc:/config \
            ${{ steps.setup.outputs.image-name }}-amd64
          found=0
          for i in $(seq 1 12); do
            if docker logs frigate-badsvc 2>&1 | grep -q "unknown service 'frigatee'"; then found=1; break; fi
            sleep 5
          done
          if [ "$found" -ne 1 ]; then
            echo "no fail-fast error for an unknown service name"; docker logs frigate-badsvc; exit 1
          fi
          # the failed oneshot blocks startup through the dependency chain
          if docker exec frigate-badsvc curl -fs http://127.0.0.1:5000/api/version; then
            echo "container came up despite an invalid FRIGATE_ROOT_SERVICES"; exit 1
          fi
          docker rm -f frigate-badsvc
      - name: Assert PUID/PGID remapping
        run: |
-          mkdir -p /tmp/frigate-config-puid /tmp/frigate-media-puid
+          mkdir -p /tmp/frigate-config-puid
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-puid/config.yml
          docker run -d --name frigate-puid --shm-size 256m \
            -e PUID=1500 -e PGID=1500 \
            -v /tmp/frigate-config-puid:/config \
            -v /tmp/frigate-media-puid:/media/frigate \
            ${{ steps.setup.outputs.image-name }}-amd64
          up=0
          for i in $(seq 1 60); do
@@ -281,7 +110,7 @@ jobs:
          if [ "$up" -ne 1 ]; then echo "PUID container never became healthy"; docker logs frigate-puid; exit 1; fi
          docker exec frigate-puid id -u frigate | grep -qx 1500
          docker exec frigate-puid id -g frigate | grep -qx 1500
-          docker exec frigate-puid cat /config/.permissions_version | grep -qx "2:1500:1500"
+          docker exec frigate-puid cat /config/.permissions_version | grep -qx "1:1500:1500"
          # second boot must skip the sweep (sentinel hit). Poll rather than
          # sleep: the string can only come from the second boot (the first
          # had no sentinel), so grepping the full log is unambiguous.
@@ -293,129 +122,6 @@ jobs:
          done
          if [ "$ok" -ne 1 ]; then echo "sentinel skip never logged"; docker logs frigate-puid; exit 1; fi
          docker rm -f frigate-puid
      - name: Assert read-only rootfs with --user works
        run: |
          mkdir -p /tmp/frigate-config-ro /tmp/frigate-media-ro
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-ro/config.yml
          sudo chown -R 1000:1000 /tmp/frigate-config-ro /tmp/frigate-media-ro
          # /run must allow exec: S6_READ_ONLY_ROOT has s6 copy its service
          # scripts there and run them, and --tmpfs defaults to noexec
          docker run -d --name frigate-ro --shm-size 256m \
            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
            --user 1000:1000 \
            --security-opt no-new-privileges:true \
            -v /tmp/frigate-config-ro:/config \
            -v /tmp/frigate-media-ro:/media/frigate \
            ${{ steps.setup.outputs.image-name }}-amd64
          up=0
          for i in $(seq 1 60); do
            docker exec frigate-ro curl -fs http://127.0.0.1:5000/api/version && up=1 && break
            sleep 5
          done
          if [ "$up" -ne 1 ]; then echo "read-only container never healthy"; docker logs frigate-ro; exit 1; fi
          # an if, not "! grep": bash exempts a negated command from set -e and
          # the assertion would never fail
          if docker logs frigate-ro 2>&1 | grep -i "read-only file system"; then
            echo "a service tried to write to the read-only rootfs"; exit 1
          fi
          # the self-signed cert has to land in /config, the only writable path
          docker exec frigate-ro test -f /config/tls/privkey.pem
          # and nginx must serve it, which is what proves the templated cert path
          docker exec frigate-ro curl -ksSI https://127.0.0.1:8971/ >/dev/null
          # logging must work via the s6-log fallback (no logutil-service as non-root)
          docker exec frigate-ro test -s /dev/shm/logs/frigate/current
          # runtime user can write recordings storage
          docker exec frigate-ro touch /media/frigate/.write-probe
          docker exec frigate-ro rm /media/frigate/.write-probe
          docker rm -f frigate-ro
      - name: Assert PUID with read-only fails fast with clear error
        run: |
          docker run -d --name frigate-ro-puid --shm-size 256m \
            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
            -e PUID=1500 -e PGID=1500 \
            -v /tmp/frigate-config-ro:/config \
            ${{ steps.setup.outputs.image-name }}-amd64
          found=0
          for i in $(seq 1 12); do
            if docker logs frigate-ro-puid 2>&1 | grep -q "not compatible with read_only"; then found=1; break; fi
            sleep 5
          done
          if [ "$found" -ne 1 ]; then
            echo "no fail-fast error for PUID with a read-only rootfs"; docker logs frigate-ro-puid; exit 1
          fi
          docker rm -f frigate-ro-puid
      - name: Assert EXTRA_GROUPS with read-only fails fast with clear error
        run: |
          docker run -d --name frigate-ro-groups --shm-size 256m \
            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
            -e EXTRA_GROUPS=44 \
            -v /tmp/frigate-config-ro:/config \
            -v /tmp/frigate-media-ro:/media/frigate \
            ${{ steps.setup.outputs.image-name }}-amd64
          found=0
          for i in $(seq 1 12); do
            if docker logs frigate-ro-groups 2>&1 | grep -q "EXTRA_GROUPS needs a writable /etc"; then found=1; break; fi
            sleep 5
          done
          if [ "$found" -ne 1 ]; then
            echo "no fail-fast error for EXTRA_GROUPS with a read-only rootfs"; docker logs frigate-ro-groups; exit 1
          fi
          docker rm -f frigate-ro-groups
      - name: Assert read-only rootfs in the default mode works
        run: |
          mkdir -p /tmp/frigate-config-rod /tmp/frigate-media-rod
          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-rod/config.yml
          docker run -d --name frigate-rod --shm-size 256m \
            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
            --security-opt no-new-privileges:true \
            -v /tmp/frigate-config-rod:/config \
            -v /tmp/frigate-media-rod:/media/frigate \
            ${{ steps.setup.outputs.image-name }}-amd64
          up=0
          for i in $(seq 1 60); do
            docker exec frigate-rod curl -fs http://127.0.0.1:5000/api/version && up=1 && break
            sleep 5
          done
          if [ "$up" -ne 1 ]; then echo "read-only default-mode container never healthy"; docker logs frigate-rod; exit 1; fi
          if docker logs frigate-rod 2>&1 | grep -i "read-only file system"; then
            echo "a service tried to write to the read-only rootfs"; exit 1
          fi
          # the point of this mode over docker's user:: the drop still happens
          # and go2rtc still gets its own separate user
          ps_out=$(docker exec frigate-rod ps -eo user=,comm=)
          echo "$ps_out"
          for svc in python3 nginx; do
            if echo "$ps_out" | grep -w "$svc" | grep -q '^root'; then
              echo "$svc is running as root"; exit 1
            fi
          done
          echo "$ps_out" | grep -w go2rtc | grep -q '^go2rtc'
          # the ownership sweep still ran and recorded itself in /config
          docker exec frigate-rod cat /config/.permissions_version | grep -qx "2:1000:1000"
          # setfacl under a read-only rootfs, which nothing else covers:
          # init-devices exits early under --user, so that path is never reached
          docker exec frigate-rod mknod /dev/apex_9 c 120 99
          docker exec frigate-rod /etc/s6-overlay/s6-rc.d/init-devices/run
          docker exec frigate-rod getfacl -p /dev/apex_9 | grep -q "user:frigate:rw-"
          docker rm -f frigate-rod
      - name: "Assert switching that install to user: still starts"
        run: |
          # the config dir above now holds a go2rtc-owned go2rtc_homekit.yml,
          # which user: keeps readable but not writable (no supplementary groups)
          docker run -d --name frigate-rod-user --shm-size 256m \
            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
            --user 1000:1000 \
            -v /tmp/frigate-config-rod:/config \
            -v /tmp/frigate-media-rod:/media/frigate \
            ${{ steps.setup.outputs.image-name }}-amd64
          up=0
          for i in $(seq 1 60); do
            docker exec frigate-rod-user curl -fs http://127.0.0.1:5000/api/version && up=1 && break
            sleep 5
          done
          if [ "$up" -ne 1 ]; then echo "container did not survive the switch to user:"; docker logs frigate-rod-user; exit 1; fi
          docker logs frigate-rod-user 2>&1 | grep -q "HomeKit pairing changes will not persist"
          docker rm -f frigate-rod-user
      - name: Teardown
        if: always()
        run: docker rm -f frigate || true
@@ -28,7 +28,3 @@ core
 docs/src/components/DockerComposeGenerator/config/devices.ts
 docs/src/components/DockerComposeGenerator/config/hardware.ts
 docs/src/components/DockerComposeGenerator/config/ports.ts
 # GenAI review prompt tester local data (frames from real cameras)
 testing-scripts/genai-review-examples/*
 !testing-scripts/genai-review-examples/README.md
@@ -146,8 +146,6 @@ RUN wget -q https://github.com/openvinotoolkit/open_model_zoo/raw/master/data/da
 RUN wget -qO - https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download | tar xvz && mv 1.tflite cpu_audio_model.tflite
 COPY audio-labelmap.txt .
 RUN chmod -R a+rX /rootfs
 FROM wget AS s6-overlay
 ARG TARGETARCH
@@ -202,6 +200,10 @@ RUN pip3 wheel --wheel-dir=/wheels -r /requirements-wheels.txt && \
        pip3 wheel --wheel-dir=/wheels -r /requirements-dev.txt; \
    fi
 # Install HailoRT & Wheels
 RUN --mount=type=bind,source=docker/main/install_hailort.sh,target=/deps/install_hailort.sh \
    /deps/install_hailort.sh
 # Collect deps in a single layer
 FROM scratch AS deps-rootfs
 COPY --from=nginx /usr/local/nginx/ /usr/local/nginx/
@@ -212,6 +214,7 @@ COPY --from=libusb-build /usr/local/lib /usr/local/lib
 COPY --from=tempio /rootfs/ /
 COPY --from=s6-overlay /rootfs/ /
 COPY --from=models /rootfs/ /
 COPY --from=wheels /rootfs/ /
 COPY docker/main/rootfs/ /
@@ -289,12 +292,16 @@ RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
 RUN --mount=type=bind,from=wheels,source=/wheels,target=/deps/wheels \
    pip3 install -U /deps/wheels/*.whl
-# The Hailo, MemryX, and Axera runtimes are installed at first start by
+# Install Axera Engine
-# frigate/util/runtime_deps.py, only when that detector is configured.
+RUN pip3 install https://github.com/AXERA-TECH/pyaxengine/releases/download/0.1.3-frigate/axengine-0.1.3-py3-none-any.whl
-# Axera's native libraries are bind mounted from the host.
+
 ENV PATH="${PATH}:/usr/bin/axcl"
 ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/usr/lib/axcl"
 # Install MemryX runtime (requires libgomp (OpenMP) in the final docker image)
 RUN --mount=type=bind,source=docker/main/install_memryx.sh,target=/deps/install_memryx.sh \
    bash -c "bash /deps/install_memryx.sh"
 COPY --from=deps-rootfs / /
 RUN ldconfig
@@ -307,9 +314,6 @@ EXPOSE 8555/tcp 8555/udp
 ENV S6_LOGGING_SCRIPT="T 1 n0 s10000000 T"
 # Do not fail on long-running download scripts
 ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
 # Allow running with a read-only root filesystem: s6 copies its scan dir into
 # /run and executes service scripts from there, so /run must allow exec
 ENV S6_READ_ONLY_ROOT=1
 ENTRYPOINT ["/init"]
 CMD []
@@ -381,7 +385,3 @@ FROM deps AS frigate
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
 # Pre-compile bytecode so a read-only rootfs doesn't force re-parsing the
 # source tree on every boot (pip-installed packages are already compiled)
 RUN python3 -m compileall -q -j0 /opt/frigate/frigate
@@ -3,7 +3,7 @@
 set -euxo pipefail
 NGINX_VERSION="1.27.4"
-VOD_MODULE_VERSION="v1.9.1"
+VOD_MODULE_VERSION="1.31"
 SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
@@ -31,24 +31,24 @@ wget -nv https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
 tar -zxf nginx-${NGINX_VERSION}.tar.gz -C /tmp/nginx --strip-components=1
 rm nginx-${NGINX_VERSION}.tar.gz
 mkdir /tmp/nginx-vod-module
-wget -nv https://github.com/dio-az/nginx-vod-module/archive/refs/tags/${VOD_MODULE_VERSION}.tar.gz
+wget -nv https://github.com/kaltura/nginx-vod-module/archive/refs/tags/${VOD_MODULE_VERSION}.tar.gz
 tar -zxf ${VOD_MODULE_VERSION}.tar.gz -C /tmp/nginx-vod-module --strip-components=1
 rm ${VOD_MODULE_VERSION}.tar.gz
    # Patch MAX_CLIPS to allow more clips to be added than the default 128
 sed -i 's/MAX_CLIPS (128)/MAX_CLIPS (1080)/g' /tmp/nginx-vod-module/vod/media_set.h
 patch -d /tmp/nginx-vod-module/ -p1 << 'EOF'
--- a/vod/avc_hevc_parser.c
+--- a/vod/avc_hevc_parser.c       2022-06-27 11:38:10.000000000 +0000
-+++ b/vod/avc_hevc_parser.c
+++ b/vod/avc_hevc_parser.c       2023-01-16 11:25:10.900521298 +0000
-@@ -2,6 +2,9 @@
+@@ -3,6 +3,9 @@
 bool_t
- avc_hevc_parser_rbsp_trailing_bits(bit_reader_state_t* reader) {
+ avc_hevc_parser_rbsp_trailing_bits(bit_reader_state_t* reader)
 {
 +	// https://github.com/blakeblackshear/frigate/issues/4572
 +	return TRUE;
 +
 	uint32_t one_bit;
- 	if (reader->stream.eof_reached) {
+ 	if (reader->stream.eof_reached)
 EOF
@@ -10,7 +10,7 @@ apt-get -qq install --no-install-recommends -y \
    gnupg \
    wget \
    lbzip2 \
-    procps vainfo acl \
+    procps vainfo \
    unzip locales tzdata libxml2 xz-utils \
    python3.11 \
    curl \
@@ -0,0 +1,32 @@
 #!/bin/bash
 set -euxo pipefail
 hailo_version="4.21.0"
 # sha256 digests of the release artifacts; update when bumping hailo_version.
 # The runtime tarball is keyed by TARGETARCH, the wheel by the python arch tag.
 declare -A hailort_checksums=(
    ["amd64"]="0a57ac5f7cc8c2c3668133189d9285b55f498e8cb219797e203f6f5015fec4b3"
    ["arm64"]="dd840548eb5d0d147c99aee2cb013d39d64be09c5bc63061171fcfacf4547b3f"
    ["x86_64"]="8112a973ab48095399b29d883f31987828df5861b8553f614c89f098a67b3fb6"
    ["aarch64"]="658432a43573280d472f6402d7934669effe7f163ba3dffa31c50bbeeaa7c01d"
 )
 if [[ "${TARGETARCH}" == "amd64" ]]; then
    arch="x86_64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
    arch="aarch64"
 fi
 # downloaded rather than streamed into tar because streaming and verifying the
 # digest before extraction are mutually exclusive
 wget -qO /tmp/hailort.tar.gz "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-debian12-${TARGETARCH}.tar.gz"
 echo "${hailort_checksums[${TARGETARCH}]}  /tmp/hailort.tar.gz" | sha256sum -c -
 tar -C / -xzf /tmp/hailort.tar.gz
 rm -f /tmp/hailort.tar.gz
 wheel="/wheels/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"
 mkdir -p /wheels
 wget -qO "${wheel}" "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"
 echo "${hailort_checksums[${arch}]}  ${wheel}" | sha256sum -c -
@@ -0,0 +1,31 @@
 #!/bin/bash
 set -e
 # Download the MxAccl for Frigate github release
 wget https://github.com/memryx/mx_accl_frigate/archive/refs/tags/v2.1.0.zip -O /tmp/mxaccl.zip
 unzip /tmp/mxaccl.zip -d /tmp
 mv /tmp/mx_accl_frigate-2.1.0 /opt/mx_accl_frigate
 rm /tmp/mxaccl.zip
 # Install Python dependencies
 pip3 install -r /opt/mx_accl_frigate/freeze
 # Link the Python package dynamically
 SITE_PACKAGES=$(python3 -c "import site; print(site.getsitepackages()[0])")
 ln -s /opt/mx_accl_frigate/memryx "$SITE_PACKAGES/memryx"
 # Copy architecture-specific shared libraries
 ARCH=$(uname -m)
 if [[ "$ARCH" == "x86_64" ]]; then
    cp /opt/mx_accl_frigate/memryx/x86/libmemx.so* /usr/lib/x86_64-linux-gnu/
    cp /opt/mx_accl_frigate/memryx/x86/libmx_accl.so* /usr/lib/x86_64-linux-gnu/
 elif [[ "$ARCH" == "aarch64" ]]; then
    cp /opt/mx_accl_frigate/memryx/arm/libmemx.so* /usr/lib/aarch64-linux-gnu/
    cp /opt/mx_accl_frigate/memryx/arm/libmx_accl.so* /usr/lib/aarch64-linux-gnu/
 else
    echo "Unsupported architecture: $ARCH"
    exit 1
 fi
 # Refresh linker cache
 ldconfig
@@ -57,12 +57,19 @@ pywebpush == 2.0.*
 pyclipper == 1.3.*
 shapely == 2.0.*
 rapidfuzz==3.12.*
-# HailoRT
+# HailoRT Wheels
 appdirs==1.4.*
 argcomplete==2.0.*
 contextlib2==0.6.*
 distlib==0.3.*
 filelock==3.8.*
 future==0.18.*
 importlib-metadata==5.1.*
 importlib-resources==5.1.*
 netaddr==0.8.*
 netifaces==0.10.*
 verboselogs==1.7.*
 virtualenv==20.17.*
 prometheus-client == 0.21.*
 # TFLite
 tflite_runtime @ https://github.com/frigate-nvr/TFlite-builds/releases/download/v2.17.1/tflite_runtime-2.17.1-cp311-cp311-linux_x86_64.whl; platform_machine == 'x86_64'
@@ -6,35 +6,9 @@ set -o errexit -o nounset -o pipefail
 # Logs should be sent to stdout so that s6 can collect them
 # Not `nginx -s reload`: that has root parse /tmp/nginx/conf, which the
 # unprivileged nginx user can rewrite, and nginx chowns path directives on load.
 function reload_nginx() {
    local pid
    if ! pid=$(cat /tmp/nginx/nginx.pid 2>/dev/null); then
        echo "[ERROR] No nginx pid file found, not reloading"
        return 0
    fi
    if [[ ! "$pid" =~ ^[0-9]+$ ]] || [[ "$(cat "/proc/${pid}/comm" 2>/dev/null)" != "nginx" ]]; then
        echo "[ERROR] nginx pid file does not name a running nginx process, not reloading"
        return 0
    fi
    kill -HUP "$pid"
 }
 echo "[INFO] Starting certsync..."
-# Resolved once, and the condition must stay identical to the nginx run
+lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
 # script's. Testing only fullchain.pem here would pick the mounted cert on a
 # half-populated mount that nginx rejected, and the two fingerprints would then
 # never agree, reloading nginx every cycle forever.
 if [ -f /etc/letsencrypt/live/frigate/privkey.pem ] && [ -f /etc/letsencrypt/live/frigate/fullchain.pem ]; then
    lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
 else
    lefile="/config/tls/fullchain.pem"
 fi
 tls_enabled=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .tls.enabled`
 listen_external_port=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .listen.external_port`
@@ -75,7 +49,7 @@ do
    then
        echo "[INFO] Reloading nginx to refresh TLS certificate"
        echo "$lefile: $leprint"
-        reload_nginx
+        /usr/local/nginx/sbin/nginx -s reload
    fi
    sleep 60
@@ -4,24 +4,6 @@
 set -o errexit -o nounset -o pipefail
 runs_as_root=0
 if [[ "$(id -u)" -eq 0 ]]; then
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root frigate; then
        runs_as_root=1
    fi
 fi
 # /root survives s6-setuidgid and breaks cache writes after the drop; set
 # before opt_in_out so the opt-out marker lands where the service will look
 if [[ "$runs_as_root" -eq 0 ]]; then
    export HOME=/config
 fi
 # detector runtimes installed at first start (pip install --user) live under
 # $HOME/.local; the dynamic loader only reads LD_LIBRARY_PATH at exec time
 export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+${LD_LIBRARY_PATH}:}${HOME}/.local/lib"
 export PATH="${PATH}:${HOME}/.local/bin"
 # opt out of openvino telemetry
 if [ -e /usr/local/bin/opt_in_out ]; then
  /usr/local/bin/opt_in_out --opt_out > /dev/null 2>&1
@@ -48,8 +30,4 @@ cd /opt/frigate || echo "[ERROR] Failed to change working directory to /opt/frig
 # Replace the bash process with the Frigate process, redirecting stderr to stdout
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
+exec python3 -u -m frigate
    exec python3 -u -m frigate
 else
    exec s6-setuidgid frigate python3 -u -m frigate
 fi
@@ -4,20 +4,6 @@
 set -o errexit -o nounset -o pipefail
 runs_as_root=0
 if [[ "$(id -u)" -eq 0 ]]; then
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root go2rtc; then
        runs_as_root=1
    fi
 fi
 # Root via FRIGATE_ROOT_SERVICES only; the escape hatch sweeps nothing and
 # leaves no unprivileged service, so /config/go2rtc stays as safe as pre-drop.
 granular_root=0
 if [[ "$runs_as_root" -eq 1 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
    granular_root=1
 fi
 # Logs should be sent to stdout so that s6 can collect them
 function get_ip_and_port_from_supervisor() {
@@ -64,6 +50,42 @@ function set_libva_version() {
    export LIBAVFORMAT_VERSION_MAJOR
 }
 function setup_homekit_config() {
    local config_path="$1"
    if [[ ! -f "${config_path}" ]]; then
        echo "[INFO] Creating empty config file for HomeKit..."
        : > "${config_path}"
    fi
    # Convert YAML to JSON for jq processing
    local temp_json="/tmp/cache/homekit_config.json"
    yq eval -o=json "${config_path}" > "${temp_json}" 2>/dev/null || {
        echo "[WARNING] Failed to convert HomeKit config to JSON, skipping cleanup"
        return 0
    }
    # Use jq to extract the homekit section, if it exists
    local homekit_json
    homekit_json=$(jq '
        if has("homekit") then {homekit: .homekit} else null end
    ' "${temp_json}" 2>/dev/null) || homekit_json="null"
    # If no homekit section, write an empty config file
    if [[ "${homekit_json}" == "null" ]]; then
        : > "${config_path}"
    else
        # Convert homekit JSON back to YAML and write to the config file
        echo "${homekit_json}" | yq eval -P - > "${config_path}" 2>/dev/null || {
            echo "[WARNING] Failed to convert cleaned config to YAML, creating minimal config"
            : > "${config_path}"
        }
    fi
    # Clean up temp files
    rm -f "${temp_json}"
 }
 set_libva_version
 if [[ -f "/dev/shm/go2rtc.yaml" ]]; then
@@ -84,23 +106,13 @@ else
    echo "[WARNING] Unable to remove existing go2rtc config. Changes made to your frigate config file may not be recognized. Please remove the /dev/shm/go2rtc.yaml from your docker host manually."
 fi
-# HomeKit persistence. The helper is symlink-safe; hand off to go2rtc only when dropping.
+# HomeKit configuration persistence setup
 readonly homekit_config_path="/config/go2rtc_homekit.yml"
-if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
+setup_homekit_config "${homekit_config_path}"
    python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}" --chown
    chown go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
 else
    python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}"
 fi
 readonly config_path="/config"
-# the sweep hands /config to uid 1000, so a root service must not exec from it
+if [[ -x "${config_path}/go2rtc" ]]; then
 if [[ "$granular_root" -eq 1 && -x "${config_path}/go2rtc" ]]; then
  echo "[WARN] Ignoring '${config_path}/go2rtc' because FRIGATE_ROOT_SERVICES runs this service as root and /config is owned by the runtime user; using the embedded binary"
  echo "[WARN] Use FRIGATE_RUN_AS_ROOT=true instead if you need both a custom go2rtc build and root"
  readonly binary_path="/usr/local/go2rtc/bin/go2rtc"
 elif [[ -x "${config_path}/go2rtc" ]]; then
  readonly binary_path="${config_path}/go2rtc"
  echo "[WARN] Using go2rtc binary from '${binary_path}' instead of the embedded one"
 else
@@ -113,8 +125,4 @@ echo "[INFO] Starting go2rtc..."
 # Use HomeKit config as the primary config so writebacks go there
 # The main config from Frigate will be loaded as a secondary config
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
+exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
    exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
 else
    exec s6-setuidgid go2rtc "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
 fi
@@ -1,104 +0,0 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 # Grant the runtime users access to mapped-in device nodes with POSIX ACLs,
 # so --device works without host-side group or udev setup.
 # No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
 # or FRIGATE_DEVICE_ACLS=false.
 set -o errexit -o nounset -o pipefail
 if [[ "$(id -u)" -ne 0 ]]; then
    exit 0
 fi
 if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
    exit 0
 fi
 if [[ "${FRIGATE_DEVICE_ACLS:-true}" == "false" ]]; then
    echo "[INFO] FRIGATE_DEVICE_ACLS=false: skipping device access grants"
    exit 0
 fi
 shopt -s nullglob
 device_globs=(
    "/dev/dri/*"
    "/dev/accel/*"
    "/dev/apex_*"
    "/dev/hailo*"
    "/dev/video*"
    "/dev/kfd"
    "/dev/rknpu*"
    "/dev/mpp_service"
    "/dev/rga"
    "/dev/dma_heap/*"
    "/dev/nvhost*"
    "/dev/nvmap"
    "/dev/nvidia*"
    "/dev/memx*"
 )
 IFS=',' read -ra extra_globs <<< "${DEVICE_ACL_PATHS:-}"
 for extra in "${extra_globs[@]}"; do
    extra="${extra//[[:space:]]/}"
    if [[ -z "$extra" ]]; then
        continue
    fi
    if [[ "$extra" != /dev/* || "$extra" == *..* ]]; then
        echo "[ERROR] DEVICE_ACL_PATHS entries must be under /dev, got '${extra}'" >&2
        exit 1
    fi
    device_globs+=("$extra")
 done
 granted=0
 failed=0
 grant() {
    local node="$1"
    # nullglob only drops patterns that hold a metacharacter, so a literal
    # table entry for absent hardware arrives here verbatim. Warn only about
    # nodes that exist and could not be granted.
    if [[ ! -e "$node" ]]; then
        return 0
    fi
    local spec="u:frigate:rw,u:go2rtc:rw"
    # directories need traverse or nothing under them is reachable
    if [[ -d "$node" ]]; then
        spec="u:frigate:rwx,u:go2rtc:rwx"
    fi
    if setfacl -m "$spec" "$node" 2>/dev/null; then
        granted=$((granted + 1))
    else
        failed=$((failed + 1))
        echo "[WARN] could not grant device access on ${node}; see EXTRA_GROUPS in the non-root docs for the fallback"
    fi
 }
 for glob in "${device_globs[@]}"; do
    # shellcheck disable=SC2231
    for node in $glob; do
        grant "$node"
    done
 done
 # USB devices re-enumerate (the Coral uploads firmware and reattaches as a new
 # node), so the directories also get a default ACL new nodes inherit. The
 # inherited grant is clamped by the creating mode's group bits, which is rw on
 # udev hosts (0664) and nothing on raw devtmpfs (0600); hardware-verified.
 if [[ -d /dev/bus/usb ]]; then
    while IFS= read -r -d '' node; do
        grant "$node"
    done < <(find /dev/bus/usb -mindepth 1 -print0)
    while IFS= read -r -d '' dir; do
        setfacl -d -m "u:frigate:rw,u:go2rtc:rw" "$dir" 2>/dev/null || \
            echo "[WARN] could not set a default ACL on ${dir}; a re-enumerating USB device may lose access"
    done < <(find /dev/bus/usb -type d -print0)
 fi
 if [[ "$failed" -gt 0 ]]; then
    echo "[INFO] device access: granted ${granted} node(s), ${failed} failed"
 elif [[ "$granted" -gt 0 ]]; then
    echo "[INFO] device access: granted ${granted} node(s) to the runtime users"
 fi
@@ -1 +0,0 @@
 oneshot
@@ -1 +0,0 @@
 /etc/s6-overlay/s6-rc.d/init-devices/run
@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # Remap the frigate user to PUID/PGID and register EXTRA_GROUPS.
 # No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
-# or PUID/PGID already match. FRIGATE_ROOT_SERVICES is validated here too.
+# or PUID/PGID already match.
 set -o errexit -o nounset -o pipefail
@@ -12,31 +12,10 @@ if [[ "$(id -u)" -ne 0 ]]; then
 fi
 if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
    if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
        echo "[INFO] FRIGATE_RUN_AS_ROOT=true: ignoring FRIGATE_ROOT_SERVICES"
    fi
    echo "[INFO] FRIGATE_RUN_AS_ROOT=true: skipping user remapping"
    exit 0
 fi
 # a typo must fail the boot, not silently drop a service to non-root
 if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
    IFS=',' read -ra root_services <<< "${FRIGATE_ROOT_SERVICES}"
    for entry in "${root_services[@]}"; do
        entry="${entry//[[:space:]]/}"
        if [[ -z "$entry" ]]; then
            continue
        fi
        case "$entry" in
            frigate|go2rtc|nginx) ;;
            *)
                echo "[ERROR] FRIGATE_ROOT_SERVICES contains unknown service '${entry}'; valid names are frigate, go2rtc, nginx" >&2
                exit 1
                ;;
        esac
    done
 fi
 puid="${PUID:-1000}"
 pgid="${PGID:-1000}"
@@ -53,15 +32,6 @@ if [[ "$puid" -eq 0 || "$pgid" -eq 0 ]]; then
    exit 1
 fi
 # Colliding with the go2rtc ids would merge the two users and collapse the
 # separation between the main process and the network-facing restreamer.
 go2rtc_uid="$(id -u go2rtc)"
 go2rtc_gid="$(id -g go2rtc)"
 if [[ "$puid" -eq "$go2rtc_uid" || "$pgid" -eq "$go2rtc_gid" ]]; then
    echo "[ERROR] PUID/PGID must not equal the go2rtc service ids (${go2rtc_uid}:${go2rtc_gid})." >&2
    exit 1
 fi
 current_uid="$(id -u frigate)"
 current_gid="$(id -g frigate)"
@@ -79,20 +49,7 @@ fi
 # EXTRA_GROUPS: numeric host GIDs granting device access (e.g. host render/video)
 if [[ -n "${EXTRA_GROUPS:-}" ]]; then
    # groupadd and usermod -aG both write /etc/group. Checked up front so a
    # read-only rootfs reports the real problem instead of dying mid-loop.
    if [[ ! -w /etc/group ]]; then
        echo "[ERROR] EXTRA_GROUPS needs a writable /etc and is not compatible with read_only: true." >&2
        echo "[ERROR] Use docker's group_add: with the same GIDs instead; it needs no writes inside the container." >&2
        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
        exit 1
    fi
    for gid in ${EXTRA_GROUPS//,/ }; do
        if ! [[ "$gid" =~ ^[0-9]+$ ]] || [[ "$gid" -eq 0 ]]; then
            echo "[ERROR] EXTRA_GROUPS must be nonzero numeric GIDs, got '${gid}'" >&2
            exit 1
        fi
        if ! getent group "$gid" >/dev/null; then
            groupadd -o -g "$gid" "frigate-extra-${gid}"
        fi
@@ -2,4 +2,4 @@
 set -e
 # Wait for PID file to exist.
-while ! test -f /tmp/nginx/nginx.pid; do sleep 1; done
+while ! test -f /run/nginx.pid; do sleep 1; done
@@ -4,13 +4,6 @@
 set -o errexit -o nounset -o pipefail
 runs_as_root=0
 if [[ "$(id -u)" -eq 0 ]]; then
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
        runs_as_root=1
    fi
 fi
 # Logs should be sent to stdout so that s6 can collect them
 echo "[INFO] Starting NGINX..."
@@ -66,105 +59,43 @@ function set_worker_processes() {
        cpus=4
    fi
-    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
+    # we need to catch any errors because sed will fail if user has bind mounted a custom nginx file
    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /usr/local/nginx/conf/nginx.conf || true
 }
 # Rebuilt root-owned every start: a symlink planted by the previously
 # unprivileged nginx would redirect the root cp/tempio writes below onto any
 # root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
 rm -rf /tmp/nginx
 mkdir /tmp/nginx
 mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
         /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
 cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
 set_worker_processes
-# TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
+# ensure the directory for ACME challenges exists
-# contract) always win; otherwise fall back to a self-signed cert persisted in
+mkdir -p /etc/letsencrypt/www
-# /config/tls, which stays writable under a read-only root filesystem.
+
 # Create self signed certs if needed
 letsencrypt_path=/etc/letsencrypt/live/frigate
-selfsigned_path=/config/tls
+mkdir -p $letsencrypt_path
-if [ -f "$letsencrypt_path/privkey.pem" ] && [ -f "$letsencrypt_path/fullchain.pem" ]; then
+if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
-    cert_path="$letsencrypt_path"
+    echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
-else
+    openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
-    cert_path="$selfsigned_path"
+        -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
-
+        -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
-    # Root writing into /config follows any symlink planted there, and /config
+    chmod 600 "$letsencrypt_path/privkey.pem"
-    # is owned by whoever the host mount says, not by root. Generate as the
+    chmod 644 "$letsencrypt_path/fullchain.pem"
    # runtime user wherever we are going to drop to it; the escape hatch keeps
    # root all the way through, so that path is refused rather than dropped.
    gen=()
    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
        gen=(s6-setuidgid frigate)
    elif [[ "$(id -u)" -eq 0 ]]; then
        for link in "$cert_path" "$cert_path/privkey.pem" "$cert_path/fullchain.pem"; do
            if [[ -L "$link" ]]; then
                echo "[ERROR] ${link} is a symlink; refusing to write TLS material through it as root" >&2
                exit 1
            fi
        done
    fi
    "${gen[@]}" mkdir -p "$cert_path"
    if [ ! \( -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" \) ]; then
        echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
        "${gen[@]}" openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
            -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
            -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" 2>/dev/null
        "${gen[@]}" chmod 600 "$cert_path/privkey.pem"
        "${gen[@]}" chmod 644 "$cert_path/fullchain.pem"
    fi
 fi
 # ACME challenges are only served from a writable rootfs; skipping the mkdir
 # under read_only leaves the location 404ing, which is the same as unused
 mkdir -p /etc/letsencrypt/www 2>/dev/null || true
 # nginx settings are read once; both templates consume them
 nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)
 # build templates for optional FRIGATE_BASE_PATH environment variable
 echo "$nginx_settings" | \
    tempio -template /usr/local/nginx/templates/base_path.gotmpl \
-           -out /tmp/nginx/conf/base_path.conf
+           -out /usr/local/nginx/conf/base_path.conf
-# build templates for additional network settings; listen.conf is the only
+# build templates for additional network settings
 # template that needs the resolved cert directory
 echo "$nginx_settings" | \
    jq --arg p "$cert_path" '.tls.cert_path = $p' | \
    tempio -template /usr/local/nginx/templates/listen.gotmpl \
-           -out /tmp/nginx/conf/listen.conf
+           -out /usr/local/nginx/conf/listen.conf
 if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
    chown -R frigate:frigate /tmp/nginx
    # heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
    if [ -d /dev/shm/nginx_cache ]; then
        chown -R frigate:frigate /dev/shm/nginx_cache
    fi
    # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
    # root-owned 0600; without this the non-root master exits EACCES
    chown frigate /dev/stdout
    # Only mounted certs need handing over; the self-signed pair is already
    # owned by the runtime user that generated it. Never chown the /config copy:
    # chown follows symlinks, so it would retarget onto any root file the
    # runtime user pointed it at. Tolerant because mounted certs may be :ro.
    if [ "$cert_path" = "$letsencrypt_path" ] && [ -f "$cert_path/privkey.pem" ]; then
        chown frigate:frigate "$cert_path/privkey.pem" "$cert_path/fullchain.pem" 2>/dev/null || true
    fi
 fi
 # Replace the bash process with the NGINX process, redirecting stderr to stdout
 exec 2>&1
-# -e stderr: the compiled-in error log path is not writable by the runtime user
+exec \
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
+    s6-notifyoncheck -t 30000 -n 1 \
-    exec \
+    nginx
        s6-notifyoncheck -t 30000 -n 1 \
        nginx -e stderr -c /tmp/nginx/conf/nginx.conf
 else
    exec \
        s6-notifyoncheck -t 30000 -n 1 \
        s6-setuidgid frigate nginx -e stderr -c /tmp/nginx/conf/nginx.conf
 fi
@@ -153,57 +153,7 @@ if [[ "$(id -u)" -eq 0 ]]; then
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
        rm -f /config/.permissions_version
    else
-        # Only when a mount backs /media/frigate itself: under a parent /media
+        /usr/local/bin/fix-ownership --sentinel /config/.permissions_version \
        # mount, a dedicated volume added later would be shadowed and skipped
        sentinel_args=(--sentinel /config/.permissions_version)
        root_services_mode=""
        if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
            # || true: an all-empty list (",") fails grep -v and errexit would kill the boot
            root_services_mode=$(tr ',' '\n' <<< "${FRIGATE_ROOT_SERVICES//[[:space:]]/}" | grep -v '^$' | sort -u | paste -sd, - || true)
            if [[ -n "$root_services_mode" ]]; then
                sentinel_args+=(--mode "$root_services_mode")
            fi
        fi
        if ! awk '$2 == "/media/frigate" || $2 ~ /^\/media\/frigate\//' /proc/mounts | grep -q .; then
            sentinel_args=()
        fi
        /usr/local/bin/fix-ownership "${sentinel_args[@]}" \
            "${PUID:-1000}" "${PGID:-1000}" /config /media/frigate
        # Root services write clips stragglers and caches mid-run; realign the
        # small trees every boot. Recordings are chowned at create instead.
        if [[ -n "$root_services_mode" ]]; then
            # only sweep what exists; clips and exports appear after the first run
            boot_sweep_paths=(/config)
            for extra in /media/frigate/clips /media/frigate/exports; do
                if [[ -d "$extra" ]]; then
                    boot_sweep_paths+=("$extra")
                fi
            done
            /usr/local/bin/fix-ownership \
                "${PUID:-1000}" "${PGID:-1000}" "${boot_sweep_paths[@]}"
        fi
    fi
 fi
 # Must stay after the sweep, which reads an absent /media/frigate as an
 # unmounted volume rather than a swept one
 if [[ "$(id -u)" -eq 0 && ! -d /media/frigate ]]; then
    # The image does not ship this directory, so on a read-only rootfs it can
    # only come from a mount. Report that rather than failing under errexit.
    if ! mkdir -p /media/frigate 2>/dev/null; then
        echo "[ERROR] /media/frigate does not exist and could not be created, which is what happens with read_only: true and no recordings volume." >&2
        echo "[ERROR] Mount a volume at /media/frigate." >&2
        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
        exit 1
    fi
    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
        chown "${PUID:-1000}:${PGID:-1000}" /media/frigate
    fi
 fi
 # usually a tmpfs mount: root-owned on arrival and outside the swept volumes
 if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
    mkdir -p /tmp/cache
    chown "${PUID:-1000}:${PGID:-1000}" /tmp/cache
 fi
@@ -1,17 +1,15 @@
 #!/bin/bash
 # Single source of truth for aligning volume ownership with the runtime user.
 #
-# Usage: fix-ownership [--dry-run] [--sentinel FILE] [--mode STRING] UID GID PATH [PATH...]
+# Usage: fix-ownership [--dry-run] [--sentinel FILE] UID GID PATH [PATH...]
 #
 #   --dry-run    report what would change, touch nothing
 #   --sentinel   skip entirely when FILE already records "SCHEMA:UID:GID";
 #                write it after a successful run (used by the boot path so
 #                multi-TB volumes are swept once per UID/schema change, not
 #                on every boot)
 #   --mode       append STRING to the sentinel, so changing it re-sweeps once
 #
 # Only files whose uid OR gid differs are touched, so re-runs are cheap.
 # lost+found is skipped: fsck fills it with root-only recovered fragments.
 # Top-level /config additionally grants group frigate-data TRAVERSE ONLY
 # (g+rx) so the separate go2rtc user can reach its pre-created HomeKit file
 # on hosts where /config is mounted 0700. Never g+w: directory write means
@@ -24,11 +22,10 @@ set -o errexit -o nounset -o pipefail
 # Permissions-layout epoch. Bump to force a one-time re-sweep on upgrade
 # (e.g. when the privilege-drop release must capture files created as root
 # since the previous sweep).
-schema=2
+schema=1
 dry_run=0
 sentinel=""
 mode=""
 while [[ "${1:-}" == --* ]]; do
    case "$1" in
@@ -39,18 +36,12 @@ while [[ "${1:-}" == --* ]]; do
                exit 2
            fi
            sentinel="$2"; shift 2 ;;
        --mode)
            if [[ -z "${2:-}" ]]; then
                echo "[ERROR] fix-ownership: --mode requires a value" >&2
                exit 2
            fi
            mode="$2"; shift 2 ;;
        *) echo "[ERROR] fix-ownership: unknown option $1" >&2; exit 2 ;;
    esac
 done
 if [[ $# -lt 3 ]]; then
-    echo "Usage: fix-ownership [--dry-run] [--sentinel FILE] [--mode STRING] UID GID PATH..." >&2
+    echo "Usage: fix-ownership [--dry-run] [--sentinel FILE] UID GID PATH..." >&2
    exit 2
 fi
@@ -63,21 +54,11 @@ if [[ "$(id -u)" -ne 0 ]]; then
    exit 0
 fi
-# The list folds into the sentinel so entering or leaving a granular root mode
+# A dry run always inspects: the sentinel records what a past sweep did, not
-# re-sweeps once, catching whatever the other ownership mechanisms missed.
+# what the volume looks like now, and reporting from it would hide later drift.
-sentinel_content="${schema}:${target_uid}:${target_gid}"
+if [[ "$dry_run" -eq 0 && -n "$sentinel" && -f "$sentinel" && "$(cat "$sentinel")" == "${schema}:${target_uid}:${target_gid}" ]]; then
-if [[ -n "$mode" ]]; then
+    echo "[INFO] fix-ownership: ${target_uid}:${target_gid} (schema ${schema}) already applied, skipping"
-    sentinel_content="${sentinel_content}:${mode}"
+    exit 0
 fi
 # safe-sentinel reports only a root-owned regular file, so a forged or
 # symlinked sentinel in the runtime-user-owned /config can't suppress the sweep
 if [[ "$dry_run" -eq 0 && -n "$sentinel" ]]; then
    if existing=$(/usr/local/bin/safe-sentinel read "$sentinel" 2>/dev/null) && \
        [[ "$existing" == "$sentinel_content" ]]; then
        echo "[INFO] fix-ownership: ${target_uid}:${target_gid} (schema ${schema}) already applied, skipping"
        exit 0
    fi
 fi
 # A sweep that could not chown everything must not be recorded as complete:
@@ -85,26 +66,6 @@ fi
 # unreachable once services run unprivileged.
 swept_clean=1
 # Entries another mechanism deliberately owns. Chowning them undoes that work
 # and leaves the same "mismatch" waiting for the next boot, so /config could
 # never report itself clean: /config is chgrp'd to frigate-data below so go2rtc
 # can traverse it, and the HomeKit file is handed to the go2rtc user by the
 # go2rtc service. Only the GROUP on /config is exempt; a root-owned /config
 # must still be chowned or the runtime user cannot write there at all.
 # Shared by the counting and the chowning walk so the two cannot disagree.
 mismatch_expr=(
    "(" -not -uid "$target_uid"
        -o "(" -not -gid "$target_gid" -a ! -path /config ")"
    ")"
    -a ! -path /config/go2rtc_homekit.yml
 )
 if [[ -n "$sentinel" ]]; then
    # safe-sentinel keeps the sentinel root-owned on purpose and rejects one
    # owned by anybody else, so chowning it here would suppress the skip and
    # make every boot re-sweep. Only the trailing write puts it back today.
    mismatch_expr+=(-a ! -path "$sentinel")
 fi
 for path in "$@"; do
    # An absent root is an incomplete sweep, not a finished one: /media/frigate
    # is not in the image, so a boot before the volume is mounted would
@@ -115,13 +76,11 @@ for path in "$@"; do
        continue
    fi
    echo "[INFO] fix-ownership: scanning ${path} for ownership mismatches; this may take a while on large filesystems"
    # find may fail mid-walk on a live volume (file deleted under it) or on a
    # stale mount. Tolerate it rather than aborting under errexit, but never
    # read a failed scan as "nothing to do": that would record the sweep as
    # complete without having looked.
-    if ! count=$(find "$path" -name lost+found -prune -o "${mismatch_expr[@]}" -printf '.' 2>/dev/null | wc -c); then
+    if ! count=$(find "$path" \( -not -uid "$target_uid" -o -not -gid "$target_gid" \) -printf '.' 2>/dev/null | wc -c); then
        swept_clean=0
        echo "[WARN] fix-ownership: could not scan ${path}; will retry on next boot"
        continue
@@ -139,41 +98,17 @@ for path in "$@"; do
        echo "[WARN] fix-ownership: ${path} contains symlinked directories; ownership behind them is not managed and must be aligned by hand"
    fi
-    echo "[WARN] fix-ownership: adjusting ownership of ${count} entries under ${path}"
+    echo "[WARN] fix-ownership: adjusting ownership of ${count} entries under ${path}; on large recordings volumes this can take a long time"
    if [[ "$dry_run" -eq 1 ]]; then
        echo "[INFO] fix-ownership: dry run, not changing ${path}"
        continue
    fi
-    # -execdir chowns from the entry's own directory, so a parent swapped for a
+    find "$path" \( -not -uid "$target_uid" -o -not -gid "$target_gid" \) \
-    # symlink mid-walk can't redirect the chown out of the volume
+        -exec chown -h "${target_uid}:${target_gid}" {} + || {
    started=$SECONDS
    if find "$path" -name lost+found -prune -o "${mismatch_expr[@]}" \
        -print -execdir chown -h "${target_uid}:${target_gid}" {} + \
        | awk -v total="$count" -v path="$path" '
            BEGIN { next_pct = 5 }
            {
                pct = int(NR * 100 / total)
                if (pct > 100) pct = 100
                if (pct >= next_pct) {
                    printf "[INFO] fix-ownership: %s %d%% (%d/%d entries)\n", path, pct, NR, total
                    # mawk block-buffers to a pipe; without fflush the whole
                    # progress log arrives at once
                    fflush()
                    while (next_pct <= pct) next_pct += 5
                }
            }'; then
        elapsed=$((SECONDS - started))
        if [[ "$elapsed" -ge 60 ]]; then
            elapsed="$((elapsed / 60))m $((elapsed % 60))s"
        else
            elapsed="${elapsed}s"
        fi
        echo "[INFO] fix-ownership: finished ${path} in ${elapsed}"
    else
        swept_clean=0
        echo "[WARN] fix-ownership: some entries under ${path} could not be updated (deleted mid-sweep or chown denied); will retry on next mismatch"
-    fi
+    }
 done
 # go2rtc (separate user) must be able to REACH its HomeKit state in /config.
@@ -189,6 +124,6 @@ if [[ "$dry_run" -eq 0 && -d /config ]]; then
 fi
 if [[ "$dry_run" -eq 0 && -n "$sentinel" && "$swept_clean" -eq 1 ]]; then
-    /usr/local/bin/safe-sentinel write "$sentinel" "$sentinel_content" || \
+    echo "${schema}:${target_uid}:${target_gid}" > "$sentinel" || \
        echo "[WARN] fix-ownership: could not write ${sentinel}; the sweep will run again on next boot"
 fi
@@ -1,74 +0,0 @@
 #!/usr/bin/env python3
 """Read or write the ownership sweep sentinel without following symlinks.
 The sentinel lives in /config, which the unprivileged runtime user owns, so it
 can be swapped for a symlink. read trusts only a root-owned regular file; write
 never follows a symlink or fifo onto another file.
 Usage:
  safe-sentinel read PATH            print content, exit 0 only if root-owned regular file
  safe-sentinel write PATH CONTENT   write CONTENT to a regular file at PATH
 """
 import errno
 import os
 import stat
 import sys
 MODE = 0o644
 def do_read(path: str) -> int:
    try:
        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
    except OSError:
        return 1
    try:
        st = os.fstat(fd)
        if not stat.S_ISREG(st.st_mode) or st.st_uid != 0:
            return 1
        sys.stdout.buffer.write(os.read(fd, 4096))
    finally:
        os.close(fd)
    return 0
 def do_write(path: str, content: str) -> int:
    # O_NONBLOCK so a fifo fails fast (ENXIO) instead of blocking the open.
    flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK
    replace = (errno.ELOOP, errno.ENXIO)
    try:
        fd = os.open(path, flags, MODE)
        if not stat.S_ISREG(os.fstat(fd).st_mode):
            os.close(fd)
            raise OSError(errno.ELOOP, "not a regular file")
    except OSError as err:
        if err.errno not in replace:
            raise
        os.unlink(path)
        fd = os.open(path, flags | os.O_EXCL, MODE)
    try:
        os.ftruncate(fd, 0)
        os.write(fd, content.encode())
        # keep it root-owned so a later sweep that chowned the old sentinel to
        # the runtime user can't make the next read reject and re-sweep
        os.fchown(fd, 0, 0)
    finally:
        os.close(fd)
    return 0
 def main(argv: list[str]) -> int:
    if len(argv) == 3 and argv[1] == "read":
        return do_read(argv[2])
    if len(argv) == 4 and argv[1] == "write":
        try:
            return do_write(argv[2], argv[3])
        except OSError:
            return 1
    print("usage: safe-sentinel read PATH | write PATH CONTENT", file=sys.stderr)
    return 2
 if __name__ == "__main__":
    sys.exit(main(sys.argv))
@@ -1,18 +0,0 @@
 #!/bin/bash
 # Exit 0 when FRIGATE_ROOT_SERVICES names the given service. Membership only:
 # the euid and FRIGATE_RUN_AS_ROOT checks stay in the callers.
 #
 # Usage: service-runs-as-root SERVICE
 set -o nounset
 service="${1:?usage: service-runs-as-root SERVICE}"
 IFS=',' read -ra entries <<< "${FRIGATE_ROOT_SERVICES:-}"
 for entry in "${entries[@]}"; do
    entry="${entry//[[:space:]]/}"
    if [[ "$entry" == "$service" ]]; then
        exit 0
    fi
 done
 exit 1
@@ -1,107 +0,0 @@
 """Normalize the go2rtc HomeKit file and hand it to go2rtc, as root.
 Runs before the drop. The file is in the runtime-user-owned /config, so a
 planted symlink could redirect the root write or chown onto another file;
 every operation goes through an O_NOFOLLOW fd to prevent that.
 Usage: prepare_homekit.py PATH [--chown]
 """
 import errno
 import grp
 import io
 import os
 import pwd
 import stat
 import sys
 from ruamel.yaml import YAML
 RUNTIME_OWNER = "go2rtc"
 SHARED_GROUP = "frigate-data"
 MODE = 0o664
 MAX_BYTES = 10 * 1024 * 1024
 def open_nofollow(path: str) -> int:
    """Return an fd to a regular file at path, never following a symlink."""
    flags = os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW
    try:
        fd = os.open(path, flags, MODE)
    except OSError as err:
        if err.errno != errno.ELOOP:
            raise
        os.unlink(path)
        return os.open(path, flags | os.O_EXCL, MODE)
    # A fifo or other non-regular file would hang or misbehave on read; replace it.
    if not stat.S_ISREG(os.fstat(fd).st_mode):
        os.close(fd)
        os.unlink(path)
        return os.open(path, flags | os.O_EXCL, MODE)
    return fd
 def normalize(content: str) -> str:
    """Keep only the homekit section, matching the previous yq/jq behavior."""
    yaml = YAML(typ="safe")
    try:
        data = yaml.load(content)
    except Exception:
        return ""
    if not isinstance(data, dict) or "homekit" not in data:
        return ""
    buf = io.StringIO()
    yaml.dump({"homekit": data["homekit"]}, buf)
    return buf.getvalue()
 def main() -> int:
    if len(sys.argv) < 2:
        print("[ERROR] prepare_homekit: PATH is required", file=sys.stderr)
        return 2
    path = sys.argv[1]
    do_chown = "--chown" in sys.argv[2:]
    try:
        fd = open_nofollow(path)
    except PermissionError:
        print(
            f"[WARN] {path} is not writable by uid {os.geteuid()}, so HomeKit "
            "pairing changes will not persist. It is owned by the go2rtc user "
            "from an earlier run in the default mode. To fix, on the host run: "
            f"chown {os.geteuid()}:{os.getegid()} <your config dir>/{os.path.basename(path)}"
        )
        return 0
    try:
        content = os.read(fd, MAX_BYTES).decode("utf-8", "replace")
        normalized = normalize(content)
        os.ftruncate(fd, 0)
        os.lseek(fd, 0, os.SEEK_SET)
        os.write(fd, normalized.encode("utf-8"))
        if do_chown:
            # tolerate a chown-refusing mount (NFS root_squash): pairing
            # persistence degrades, the service does not
            try:
                uid = pwd.getpwnam(RUNTIME_OWNER).pw_uid
                gid = grp.getgrnam(SHARED_GROUP).gr_gid
                os.fchown(fd, uid, gid)
                os.fchmod(fd, MODE)
            except (KeyError, OSError):
                print(
                    f"[WARN] Could not hand {path} to the go2rtc user; "
                    "HomeKit pairing changes may not persist"
                )
    finally:
        os.close(fd)
    return 0
 if __name__ == "__main__":
    sys.exit(main())
@@ -1,13 +1,9 @@
 # Loaded with -c from the /tmp/nginx/conf copy: relative includes follow the -c
 # file, all other path directives follow --prefix and must stay absolute.
 daemon off;
 # ignored by a non-root master; keeps workers root under FRIGATE_RUN_AS_ROOT
 user root;
 worker_processes auto;
 error_log /dev/stdout warn;
-pid /tmp/nginx/nginx.pid;
+pid /var/run/nginx.pid;
 events {
    worker_connections 1024;
@@ -17,12 +13,6 @@ http {
    map_hash_bucket_size 256;
    server_tokens off;
    client_body_temp_path /tmp/nginx/client_body;
    proxy_temp_path /tmp/nginx/proxy;
    fastcgi_temp_path /tmp/nginx/fastcgi;
    uwsgi_temp_path /tmp/nginx/uwsgi;
    scgi_temp_path /tmp/nginx/scgi;
    include mime.types;
    default_type application/octet-stream;
@@ -132,10 +122,6 @@ http {
            # Smaller segments, faster generation, better browser compatibility
            vod_hls_container_format fmp4;
            # fMP4 playlists use EXT-X-MAP, which requires HLS protocol
            # version 6 (RFC 8216 section 7); the module default is 4
            vod_hls_version 6;
            secure_token $args;
            secure_token_types application/vnd.apple.mpegurl;
@@ -144,6 +130,14 @@ http {
            expires off;
            keepalive_disable safari;
            # vod module returns 502 for non-existent media
            # https://github.com/kaltura/nginx-vod-module/issues/468
            error_page 502 =404 /vod-not-found;
        }
        location = /vod-not-found {
            return 404;
        }
        location /stream/ {
@@ -8,8 +8,8 @@ listen {{ .listen.internal }};
    listen {{ .listen.external }} ssl;
    {{ if .ipv6.enabled }}listen [::]:{{ .listen.external_port }} ssl;{{ end }}
-    ssl_certificate {{ .tls.cert_path }}/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
-    ssl_certificate_key {{ .tls.cert_path }}/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;
    # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
    # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
@@ -36,16 +36,6 @@ if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
 fi
 echo "[INFO] Using image ${IMAGE} (override with FRIGATE_IMAGE=...)"
 if ! docker image inspect "${IMAGE}" >/dev/null 2>&1; then
    echo "[INFO] ${IMAGE} is not present locally and has to be pulled first; this may take a while"
 fi
 if [[ -n "$dry_run_flag" ]]; then
    echo "[INFO] Dry run: reporting what would change under ${config_dir} and ${media_dir}, changing nothing"
 else
    echo "[INFO] Aligning ${config_dir} and ${media_dir} to ${puid}:${pgid}; this may take a while on large filesystems"
 fi
 # shellcheck disable=SC2086
 docker run --rm \
    -v "${config_dir}:/config" \
@@ -13,16 +13,6 @@ TRT_VER=${TRT_VER:-$(cat /etc/TENSORRT_VER)}
 OUTPUT_FOLDER="${MODEL_CACHE_DIR}/${TRT_VER}"
 YOLO_MODELS=${YOLO_MODELS:-""}
 # This runs as root after prepare's sentinel-guarded sweep, so the dirs and
 # engines it creates below are the runtime user's to fix up, on every exit path
 function hand_off_ownership() {
    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
        /usr/local/bin/fix-ownership "${PUID:-1000}" "${PGID:-1000}" \
            /config/model_cache "${MODEL_CACHE_DIR}"
    fi
 }
 trap hand_off_ownership EXIT
 # Create output folder
 mkdir -p ${OUTPUT_FOLDER}
@@ -496,11 +496,6 @@ review:
      - Animals in the garden
    # Optional: Preferred response language (default: English)
    preferred_language: English
    # Optional: Writing style preset for generated descriptions (default: shown below)
    # Options: "default", "natural", "concise", "detailed"
    # Presets adjust the tone and level of detail of the user-facing title,
    # summary, and scene description; "default" leaves the built-in prompt unchanged.
    response_style: default
    # Optional: Save thumbnails sent to the GenAI provider for review/debugging purposes (default: shown below)
    debug_save_thumbnails: False
@@ -397,10 +397,6 @@ To do this:
 2. Update the `ffmpeg.path` in your Frigate config to `/config/custom-ffmpeg`.
 3. Restart Frigate and the custom version will be used if the steps above were done correctly.
 Both binaries have to be executable by Frigate's unprivileged runtime user, so `chmod 755` them after extracting. The startup ownership sweep runs only once, so anything you add to `/config` later keeps whatever ownership and mode you gave it.
 There is one exception, and it only affects [`FRIGATE_ROOT_SERVICES`](/configuration/non_root#keeping-individual-services-root) listing `frigate`. That mode runs Frigate as root while still handing `/config` to the unprivileged runtime user, so anything running as that user could swap the binary and gain root. A build inside any of Frigate's writable volumes (`/config`, `/media/frigate`, the cache and shm dirs) is ignored there and the bundled one is used, with a warning in the log. Keep the build somewhere root-owned (any absolute `ffmpeg.path` works, so a read-only bind mount such as `/opt/custom-ffmpeg` is enough) if you need both. The default mode and `FRIGATE_RUN_AS_ROOT=true` are unaffected and behave exactly as they always have.
 ### Custom go2rtc version
 Frigate currently includes go2rtc v1.9.14, there may be certain cases where you want to run a different version of go2rtc.
@@ -409,11 +405,9 @@ To do this:
 1. Download the go2rtc build to the `/config` folder.
 2. Rename the build to `go2rtc`.
-3. Give `go2rtc` execute permission for all users (`chmod 755`). It runs as its own `go2rtc` user, which doesn't own the file, so owner-only execute permission isn't enough.
+3. Give `go2rtc` execute permission.
 4. Restart Frigate and the custom version will be used, you can verify by checking go2rtc logs.
 The same exception applies, and again only to [`FRIGATE_ROOT_SERVICES`](/configuration/non_root#keeping-individual-services-root) listing `go2rtc`: the binary is ignored there and the embedded one is used, with a warning in the log. Unlike `ffmpeg.path`, the go2rtc binary location is not configurable, so there is no outside-`/config` alternative. Use `FRIGATE_RUN_AS_ROOT=true` instead if you need both a custom go2rtc build and root. The default mode and the escape hatch both honor `/config/go2rtc` exactly as they always have.
 ## Validating your config.yml file updates
 When frigate starts up, it checks whether your config file is valid, and if it is not, the process exits. To minimize interruptions when updating your config, you have three options -- you can edit the config via the WebUI which has built in validation, use the config API, or you can validate on the command line using the frigate docker container.
@@ -22,9 +22,7 @@ The following ports are available to access the Frigate web UI.
 ## Onboarding
-On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time.
+On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time under Settings > Users.
 On a new install the [setup wizard](../guides/getting_started.md#configuring-frigate) offers this as its first step, along with creating accounts for anyone else who needs access. You can also do both at any time under <NavPath path="Settings > Users" />.
 ## Resetting admin password
@@ -216,9 +214,9 @@ A default role can be provided. Any value in the mapped `role` header will overr
 Navigate to <NavPath path="Settings > System > Proxy" /> and set the default role.
-| Field            | Description                                                                                          |
+| Field            | Description                                                   |
-| ---------------- | ---------------------------------------------------------------------------------------------------- |
+| ---------------- | ------------------------------------------------------------- |
-| **Default role** | Fallback role when no role header is present (e.g., `viewer`), or `None (deny access)` to reject unmapped users |
+| **Default role** | Fallback role when no role header is present (e.g., `viewer`) |
 </TabItem>
 <TabItem value="yaml">
@@ -232,14 +230,6 @@ proxy:
 </TabItem>
 </ConfigTabs>
 Setting `default_role` to `none` denies access instead of falling back to a role. Any proxy-authenticated user whose headers do not match an explicit `role_map` entry receives a 403 response. This is useful when the upstream proxy authenticates a broader set of users than should reach Frigate, so that only mapped groups are allowed in.
 ```yaml
 proxy:
  ...
  default_role: none
 ```
 ## Role mapping
 In some environments, upstream identity providers (OIDC, SAML, LDAP, etc.) do not pass a Frigate-compatible role directly, but instead pass one or more group claims. To handle this, Frigate supports a `role_map` that translates upstream group names into Frigate's internal roles (`admin`, `viewer`, or custom). This is configurable via YAML in the configuration file:
@@ -265,7 +255,7 @@ In this example:
 - If the proxy passes a role header containing `sysadmins` or `access-level-security`, the user is assigned the `admin` role.
 - If the proxy passes a role header containing `camera-viewer`, the user is assigned the `viewer` role.
 - If the proxy passes a role header containing `operators`, the user is assigned the `operator` custom role.
- If no mapping matches, Frigate falls back to `default_role` if configured, or denies access if `default_role` is `none`.
+- If no mapping matches, Frigate falls back to `default_role` if configured.
 - If `role_map` is not defined, Frigate assumes the role header directly contains `admin`, `viewer`, or a custom role name.
 **Note on matching semantics:**
@@ -339,7 +329,7 @@ Frigate supports user roles to control access to certain features in the UI and
 - **admin**: Full access to all features, including user management and configuration.
 - **viewer**: Read-only access to the UI and API, including viewing cameras, review items, and historical footage. Configuration editor and settings in the UI are inaccessible.
- **Custom Roles**: Arbitrary role names (alphanumeric, dots/underscores) with specific camera permissions. These extend the system for granular access (e.g., "operator" for select cameras). The names `admin`, `viewer`, and `none` are reserved and cannot be used.
+- **Custom Roles**: Arbitrary role names (alphanumeric, dots/underscores) with specific camera permissions. These extend the system for granular access (e.g., "operator" for select cameras).
 ### Custom Roles and Camera Access
@@ -9,7 +9,7 @@ import NavPath from "@site/src/components/NavPath";
 ## Adding a camera with the Add Camera Wizard
-The Add Camera Wizard is the recommended way to add a camera. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />, or use it from the [setup wizard](../guides/getting_started.md#configuring-frigate) on a new install. The wizard connects to your camera, tests each stream, and writes the camera's configuration for you, including the [go2rtc](go2rtc.md) restream and the live view stream mapping, so a standard setup needs no hand-written YAML.
+The Add Camera Wizard is the recommended way to add a camera. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />. The wizard connects to your camera, tests each stream, and writes the camera's configuration for you, including the [go2rtc](go2rtc.md) restream and the live view stream mapping, so a standard setup needs no hand-written YAML.
 ### Step 1: Name and connection
@@ -192,39 +192,6 @@ review:
 </TabItem>
 </ConfigTabs>
 ### Response Style
 Different models respond to the built-in prompt with very different writing styles: some produce natural narration while others sound short and mechanical. The `response_style` option selects a writing style preset that rewords the prompt's instructions for the user-facing fields (the title, short summary, and scene description). Presets replace those instructions rather than adding extra ones, so the model never receives competing style directions.
 Available presets:
 - `default`: The built-in prompt, unchanged. This already reads like a neutral security report.
 - `natural`: Plain, everyday narration with flowing sentences and sentence-style headline titles. Useful when a model's output sounds robotic.
 - `concise`: As brief as possible while still covering each significant action, with terse two-to-four word titles.
 - `detailed`: Thorough descriptions and titles that include the most identifying specifics, like colors, clothing, and carried items.
 Style presets only adjust how the user-facing text reads; the model's step-by-step observations and threat level scoring guidance are unaffected. Results vary by model, so it is worth comparing presets against saved debug output using `testing-scripts/genai_review_tester.py` in the Frigate repository.
 <ConfigTabs>
 <TabItem value="ui">
 Navigate to <NavPath path="Settings > Global configuration > Review" />.
 - Set **GenAI config > Response style** to the desired preset (e.g., `natural`)
 </TabItem>
 <TabItem value="yaml">
 ```yaml {4}
 review:
  genai:
    enabled: true
    response_style: natural
 ```
 </TabItem>
 </ConfigTabs>
 ## Review Reports
 Along with individual review item summaries, Generative AI can also produce a single report of review items from all cameras marked "suspicious" over a specified time period (for example, a daily summary of suspicious activity while you're on vacation).
@@ -8,7 +8,7 @@ import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
 import FaqItem from "@site/src/components/FaqItem";
-Frigate can recognize license plates on vehicles and automatically add the detected characters to the `recognized_license_plate` field or a [known](#matching) name as a `sub_label` to tracked objects of type `car`, `motorcycle`, `bus`, `truck`, `school_bus`, or `garbage_truck`, depending on which of those labels your model detects. A common use case may be to read the license plates of cars pulling into a driveway or cars passing by on a street.
+Frigate can recognize license plates on vehicles and automatically add the detected characters to the `recognized_license_plate` field or a [known](#matching) name as a `sub_label` to tracked objects of type `car` or `motorcycle`. A common use case may be to read the license plates of cars pulling into a driveway or cars passing by on a street.
 LPR works best when the license plate is clearly visible to the camera. For moving vehicles, Frigate continuously refines the recognition process, keeping the most confident result. When a vehicle becomes stationary, LPR continues to run for a short time after to attempt recognition.
@@ -24,7 +24,7 @@ When a plate is recognized, the details are:
 - Viewable in the Details pane in Review/History.
 - Viewable in the Tracked Object Details pane in Explore (sub labels and recognized license plates).
 - Filterable through the More Filters menu in Explore.
- Published via the `frigate/events` MQTT topic as a `sub_label` ([known](#matching)) or `recognized_license_plate` (unknown) for the vehicle tracked object.
+- Published via the `frigate/events` MQTT topic as a `sub_label` ([known](#matching)) or `recognized_license_plate` (unknown) for the `car` or `motorcycle` tracked object.
 - Published via the `frigate/tracked_object_update` MQTT topic with `name` (if [known](#matching)) and `plate`.
 ## Model Requirements
@@ -35,7 +35,7 @@ Users without a model that detects license plates can still run LPR. Frigate use
 :::note
-In the default mode, Frigate's LPR needs to first detect a vehicle before it can recognize a license plate. If you're using a dedicated LPR camera and have a zoomed-in view where a vehicle will not be detected, you can still run LPR, but the configuration parameters will differ from the default mode. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section below.
+In the default mode, Frigate's LPR needs to first detect a `car` or `motorcycle` before it can recognize a license plate. If you're using a dedicated LPR camera and have a zoomed-in view where a `car` or `motorcycle` will not be detected, you can still run LPR, but the configuration parameters will differ from the default mode. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section below.
 :::
@@ -86,7 +86,7 @@ cameras:
 </TabItem>
 </ConfigTabs>
-For non-dedicated LPR cameras, ensure that your camera is configured to detect vehicle objects, and that a vehicle is actually being detected by Frigate. Otherwise, LPR will not run. The object types that can carry a plate are defined by your model's `attributes_map`, so if your model detects other vehicle labels, you can add them there.
+For non-dedicated LPR cameras, ensure that your camera is configured to detect objects of type `car` or `motorcycle`, and that a car or motorcycle is actually being detected by Frigate. Otherwise, LPR will not run.
 Like the other real-time processors in Frigate, license plate recognition runs on the camera stream defined by the `detect` role in your config. To ensure optimal performance, select a suitable resolution for this stream in your camera's firmware that fits your specific scene and requirements.
@@ -158,7 +158,7 @@ lpr:
 Navigate to <NavPath path="Settings > Enrichments > License plate recognition" />.
- **Known plates**: Assign custom `sub_label` values to vehicle objects when a recognized plate matches a known value. These labels appear in the UI, filters, and notifications. Unknown plates are still saved but are added to the `recognized_license_plate` field rather than the `sub_label`.
+- **Known plates**: Assign custom `sub_label` values to `car` and `motorcycle` objects when a recognized plate matches a known value. These labels appear in the UI, filters, and notifications. Unknown plates are still saved but are added to the `recognized_license_plate` field rather than the `sub_label`.
 - **Match distance**: Allows for minor variations (missing/incorrect characters) when matching a detected plate to a known plate. For example, setting to `1` allows a plate `ABCDE` to match `ABCBE` or `ABCD`. This parameter will _not_ operate on known plates that are defined as regular expressions.
 </TabItem>
@@ -316,7 +316,7 @@ lpr:
 :::note
-If a camera is configured to detect vehicles but you don't want Frigate to run LPR for that camera, disable LPR at the camera level:
+If a camera is configured to detect `car` or `motorcycle` but you don't want Frigate to run LPR for that camera, disable LPR at the camera level:
 <ConfigTabs>
 <TabItem value="ui">
@@ -456,7 +456,7 @@ With this setup:
 - Snapshots will have license plate bounding boxes on them.
 - The `frigate/events` MQTT topic will publish tracked object updates.
 - Debug view will display `license_plate` bounding boxes.
- If you are using a Frigate+ model and want to submit images from your dedicated LPR camera for model training and fine-tuning, annotate both the vehicle and the `license_plate` in the snapshots on the Frigate+ website, even if the vehicle is barely visible.
+- If you are using a Frigate+ model and want to submit images from your dedicated LPR camera for model training and fine-tuning, annotate both the `car` / `motorcycle` and the `license_plate` in the snapshots on the Frigate+ website, even if the car is barely visible.
 ### Using the Secondary LPR Pipeline (Without Frigate+)
@@ -611,9 +611,9 @@ If you are still having issues detecting plates, start with a basic configuratio
 </FaqItem>
-<FaqItem id="can-i-run-lpr-without-detecting-car-or-motorcycle-objects" question={<>Can I run LPR without detecting vehicle objects?</>}>
+<FaqItem id="can-i-run-lpr-without-detecting-car-or-motorcycle-objects" question={<>Can I run LPR without detecting <code>car</code> or <code>motorcycle</code> objects?</>}>
-In normal LPR mode, Frigate requires a vehicle to be detected first before recognizing a license plate. If you have a dedicated LPR camera, you can change the camera `type` to `"lpr"` to use the Dedicated LPR Camera algorithm. This comes with important caveats, though. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section above.
+In normal LPR mode, Frigate requires a `car` or `motorcycle` to be detected first before recognizing a license plate. If you have a dedicated LPR camera, you can change the camera `type` to `"lpr"` to use the Dedicated LPR Camera algorithm. This comes with important caveats, though. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section above.
 </FaqItem>
@@ -699,7 +699,7 @@ lpr:
 4. Ensure the characters on detected plates are being _recognized_.
   - Check the **Plate recognition** inference time in Enrichment metrics (<NavPath path="System metrics > Enrichments" />). High inference times (> 100ms) could lead to poor recognition results, especially for dedicated LPR cameras where the plate crosses the frame quickly.
   - Enable `debug_save_plates` to save images of detected text on plates to the clips directory (`/media/frigate/clips/lpr`). Ensure these images are readable and the text is clear.
-   - Watch the debug view to see plates recognized in real-time. For non-dedicated LPR cameras, the vehicle's label will change to the recognized plate when LPR is enabled and working.
+   - Watch the debug view to see plates recognized in real-time. For non-dedicated LPR cameras, the `car` or `motorcycle` label will change to the recognized plate when LPR is enabled and working.
   - Adjust `recognition_threshold` settings per the suggestions [above](#advanced-configuration).
 </FaqItem>
@@ -714,13 +714,13 @@ LPR's performance impact depends on your hardware. Ensure you have at least 4GB
 The YOLOv9 license plate detector model will run (and the metric will appear) if you've enabled LPR but haven't defined `license_plate` as an object to track, either at the global or camera level.
-If you are detecting vehicles on cameras where you don't want to run LPR, make sure you disable LPR it at the camera level. And if you do want to run LPR on those cameras, make sure you define `license_plate` as an object to track.
+If you are detecting `car` or `motorcycle` on cameras where you don't want to run LPR, make sure you disable LPR it at the camera level. And if you do want to run LPR on those cameras, make sure you define `license_plate` as an object to track.
 </FaqItem>
 <FaqItem id="it-looks-like-frigate-picked-up-my-cameras-timestamp-or-overlay-text-as-the-license-plate-how-can-i-prevent-this" question="It looks like Frigate picked up my camera's timestamp or overlay text as the license plate. How can I prevent this?">
-This could happen if vehicles travel close to your camera's timestamp or overlay text. You could either move the text through your camera's firmware, or apply a mask to it in Frigate.
+This could happen if cars or motorcycles travel close to your camera's timestamp or overlay text. You could either move the text through your camera's firmware, or apply a mask to it in Frigate.
 If you are using a model that natively detects `license_plate`, add an _object mask_ of type `license_plate` and a _motion mask_ over your text.
@@ -1,387 +0,0 @@
 ---
 id: non_root
 title: Running as a non-root user
 ---
 # Running as a non-root user
 Frigate's services run as an unprivileged user inside the container. The main Frigate process and nginx run as `frigate`, and go2rtc runs as its own more restricted `go2rtc` user. Only the s6 init system and the certsync helper stay root.
 The runtime user is uid/gid `1000:1000` by default. You can change it with `PUID`/`PGID`, or bypass Frigate's user handling entirely with Docker's own `user:`.
 Most upgrades need nothing. Frigate aligns your volume ownership on the first boot and grants access to your hardware at startup. The sections below cover the cases that need attention: large storage volumes, network storage, and hardware the automatic grant can't reach.
 ## Run modes
 | Mode                | How to enable                   | Ownership of `/config` and `/media/frigate`            | `read_only: true` |
 | ------------------- | ------------------------------- | ------------------------------------------------------ | ----------------- |
 | Default             | nothing, this is the default    | Aligned to `1000:1000` on first boot                   | Supported         |
 | `PUID`/`PGID`       | `PUID=1001`, `PGID=1001`        | Aligned to the values you set, on first boot           | Not supported     |
 | Docker-native user  | `user: "1001:1001"`             | You own it, Frigate never changes ownership            | Supported         |
 | Root (escape hatch) | `FRIGATE_RUN_AS_ROOT=true`      | Never touched                                          | Not supported     |
 | Granular root       | `FRIGATE_ROOT_SERVICES=frigate` | Aligned at boot; recordings and exports also at create | Not supported     |
 `PUID`/`PGID` remapping runs `usermod` at startup, which writes to `/etc/passwd`, so it can't work with a read-only root filesystem. That combination stops at startup with a message pointing here. `EXTRA_GROUPS` writes to `/etc/group` and stops the same way; use Docker's `group_add:` instead, which needs no writes inside the container. The default mode and Docker's `user:` mode both work with `read_only: true`; see [Hardened deployment](#hardened-deployment).
 `FRIGATE_RUN_AS_ROOT` is matched against the exact lowercase string `true`. `True`, `TRUE`, and `1` are all ignored. `FRIGATE_DEVICE_ACLS` works the same way: only the lowercase string `false` turns off the automatic device grants.
 ### Keeping individual services root
 `FRIGATE_ROOT_SERVICES` takes a comma separated list of `frigate`, `go2rtc`, and `nginx`. A listed service keeps running as root, and everything else about non-root operation still applies: `PUID`/`PGID` remapping, the ownership sweep, and ownership of the files those services create.
 There are two reasons to use it:
 - Your detector hardware won't work as an unprivileged user, even after reading [Hardware device access](#hardware-device-access). `FRIGATE_ROOT_SERVICES=frigate` keeps the main process and its detectors as root while nginx and go2rtc stay unprivileged.
 - You want everything to run as root but still want your files owned by `PUID`/`PGID` instead of root. `FRIGATE_ROOT_SERVICES=frigate,go2rtc,nginx` does that.
 Try the device grants and `EXTRA_GROUPS` first. The `frigate` service runs the API and every ffmpeg process that decodes your camera streams, so listing it puts those back on root as well, not just your detectors.
 A listed service also stops honoring a [custom ffmpeg or go2rtc build](/configuration/advanced/system#custom-dependencies) kept in `/config`, since that directory stays owned by the unprivileged user and a binary there would run as root. `FRIGATE_RUN_AS_ROOT=true` has no such restriction.
 Recordings and exports are owned by `PUID`/`PGID` as soon as they're written, even by a root service. Snapshots, thumbnails, and other files under `clips/` are corrected on each restart, so they can show as root-owned from the host until then. A listed service also keeps root's home directory, so library caches go to the container layer instead of `/config`. The same applies to the [detector runtimes](/frigate/network_requirements#detector-runtimes) Frigate installs at first start (Hailo, MemryX, AXEngine): a root `frigate` service installs them into `/root/.local`, which is lost when the container is recreated, and never loads a copy left behind in `/config/.local`.
 Listing all three services is not the same as `FRIGATE_RUN_AS_ROOT=true`. The escape hatch never touches ownership; the list keeps the ownership handling active. A few more details:
 - An unknown name in the list stops the container at startup, rather than silently leaving a service unprivileged.
 - Changing the list runs the full ownership sweep once on the next boot.
 - If both are set, `FRIGATE_RUN_AS_ROOT=true` wins and the list is ignored.
 - With Docker's `user:`, the list does nothing, since the container never has root to keep.
 ## Migrating an existing install
 Volumes from earlier versions of Frigate are owned by root, so ownership has to be aligned with the runtime user once. This happens automatically on the first boot after upgrading.
 On large recordings volumes, do it from the host beforehand instead. The boot sweep runs before any service starts, so a multi-terabyte `/media/frigate` can hold the container in startup long enough for Docker's healthcheck to mark it unhealthy, and orchestrators that watch health will restart it mid-sweep. If you'd rather not run the script, raise the healthcheck start period instead (`--start-period=1800s`, or `start_period: 1800s` under `healthcheck:` in compose).
 Grab [`fix-permissions.sh`](https://github.com/blakeblackshear/frigate/blob/dev/docker/migration/fix-permissions.sh) from the Frigate repo and dry run it first:
 ```bash
 ./fix-permissions.sh --dry-run /path/to/your/config /path/to/your/storage
 ```
 That reports how many entries would change and touches nothing. When it looks right, run it without `--dry-run`:
 ```bash
 ./fix-permissions.sh /path/to/your/config /path/to/your/storage
 ```
 Pass `PUID` and `PGID` as the third and fourth arguments if you're not using the default `1000:1000`. The script wraps the same helper the container uses, so the result is identical either way. Override the image it pulls with `FRIGATE_IMAGE=...` if you're not on `stable`.
 Both the script and the boot sweep report progress, so you can tell a slow sweep from a stuck one:
 ```
 [INFO] fix-ownership: scanning /media/frigate for ownership mismatches; this may take a while on large filesystems
 [WARN] fix-ownership: adjusting ownership of 4823941 entries under /media/frigate
 [INFO] fix-ownership: /media/frigate 5% (241197/4823941 entries)
 [INFO] fix-ownership: /media/frigate 10% (482394/4823941 entries)
 [INFO] fix-ownership: finished /media/frigate in 12m 4s
 ```
 The scan has no percentage because the total isn't known until it finishes. Watch the boot sweep with `docker logs -f frigate`.
 Once the volumes are aligned, start Frigate normally. A file at `/config/.permissions_version` records what was done, so later boots skip the sweep unless you change `PUID`/`PGID`.
 If something under your volumes can't be chowned, a read-only btrfs snapshot directory for example, the sweep warns and names the path and doesn't record the migration as finished. It retries on the next boot instead. Either move those paths outside `/media/frigate` or expect the scan to repeat.
 ### Network storage
 Recordings on a NAS behave differently, so check what you have before migrating:
 ```bash
 findmnt -T /path/to/your/storage -o TARGET,FSTYPE,OPTIONS
 ```
 **SMB and CIFS** don't store per-file ownership at all. It's synthesized from the mount options, so a per-file `chown` fails and isn't needed. Mount the share as the uid and gid Frigate runs as, and every file already looks correct to the sweep:
 ```
 //nas/frigate /media/frigate cifs credentials=/root/.smb,uid=1000,gid=1000,file_mode=0664,dir_mode=0775 0 0
 ```
 **NFS** exports default to `root_squash` on most servers, which maps the container's root to `nobody`. The chown then fails, you get `[WARN] fix-ownership: some entries under /media/frigate could not be updated`, and since the sweep didn't finish it doesn't record the migration, so it retries on every boot.
 The best fix is to not chown over NFS at all. Do it on the server, where there's no squash and no network round trip per file:
 ```bash
 # on the NAS itself, against the exported directory
 chown -R 1000:1000 /export/frigate
 ```
 Frigate's sweep then finds nothing to change and records the migration normally. If you can't get a shell on the server, you can export temporarily with `no_root_squash`, migrate, and put it back, or leave ownership alone and set `PUID`/`PGID` to whichever uid already owns the files.
 Either way the uid has to mean the same thing on both machines. NFS sends numeric uids, so container uid 1000 is uid 1000 on the server no matter what the usernames are.
 Expect the first boot to be slow even when nothing needs changing, because checking ownership costs a round trip per file. That's a one-time cost. **If the sweep runs on every boot rather than once, ownership isn't actually being applied**, and the warning above will say so.
 Keep `/config` on local storage either way. Frigate's database is SQLite and network shares handle its locking poorly. That's a long-standing recommendation, not something running non-root introduces.
 ## Rolling back
 Set `FRIGATE_RUN_AS_ROOT=true` and restart. Everything runs as root again, exactly as it did before. This is the fastest way to get a broken install running while you sort out a device permission problem.
 The escape hatch never changes ownership, and it clears the record of the last sweep on startup, so switching back to non-root later corrects whatever root created in the meantime. Toggling in either direction is safe.
 ## Hardware device access
 Frigate grants the runtime user access to your devices at startup. Pass your hardware with `--device` (or `devices:` in compose) and detection and hardware acceleration work with no group or udev setup on the host.
 The grant covers the common accelerator and camera nodes: GPU render nodes, Intel/AMD NPUs (`/dev/accel`), Coral, Hailo, Rockchip, Jetson, `/dev/video*`, and the USB bus. For hardware it misses, add your own paths with `DEVICE_ACL_PATHS`, a comma separated list of globs:
 ```yaml
 environment:
  DEVICE_ACL_PATHS: "/dev/mydev*"
 ```
 Set `FRIGATE_DEVICE_ACLS=false` if you manage device permissions yourself and want Frigate to leave them alone.
 Frigate grants access by adding an ACL entry for the runtime users. The device's owner and mode are unchanged, and nothing is made world accessible. One thing to know: `--device` nodes belong to the container, but a bind mounted `/dev/bus/usb` (the usual Coral USB setup) shares the host's device nodes, so the entry is visible on the host until udev recreates the node.
 ### Manual setup
 You only need this for hardware the automatic grant can't reach, or for Docker's `user:` mode, where there's no root startup to do the granting.
 Your accelerator most likely worked in older versions because Frigate ran as root. Device nodes are usually owned by `root:root`, and root either matches the group or skips the check entirely. The runtime user does neither, so a device that worked before can become unreadable with no change to your Frigate config.
 #### Read what your device requires
 Find the node and look at its owner, group, and mode:
 ```bash
 ls -ln /dev/dri/renderD128
 crw-rw---- 1 0 105 226, 128 Jul  5 10:12 /dev/dri/renderD128
 #          ^ ^  ^
 #          | |  group GID 105
 #          | owner UID 0 (root)
 #          mode: owner rw, group rw, other none
 ```
 Then work out which of the three permission sets applies to the runtime user. It isn't the owner, since that's root, so it gets the group bits if it belongs to that GID and otherwise falls through to "other". In the example above "other" is empty, so without membership in group 105 the runtime user can't open the node.
 Watch for a node that looks permissive but isn't. A USB Coral defaults to this:
 ```bash
 ls -ln /dev/bus/usb/004/003
 crw-rw-r-- 1 0 0 189, 386 Jul  5 10:12 /dev/bus/usb/004/003
 ```
 The group is `0`, so "other" applies to the runtime user, and "other" here is read only. `libedgetpu` needs to write to the node, so detection fails with `No EdgeTPU was detected` as though no Coral were attached. Read access alone isn't enough for most accelerators.
 #### Grant access
 Give the runtime user the GID with `EXTRA_GROUPS`, a comma separated list of numeric host GIDs. They're added to both the `frigate` and `go2rtc` users, which matters because go2rtc needs its own render and video access for hardware accelerated restreams.
 ```yaml
 environment:
  EXTRA_GROUPS: "105,44" # host render and video GIDs
 ```
 Use numeric GIDs from the host, not names. Group names don't have to match between the host and the container, and the kernel only checks the number. If the GID doesn't exist in the image, Frigate creates a placeholder group for it.
 Two things that look like they should work but don't:
 - Docker's `group_add` has no effect in the default or `PUID` modes. Frigate rebuilds the supplementary group list from `/etc/group` when it drops privileges, which discards what Docker passed in. It is the right tool with Docker's `user:`, where no privilege drop happens and `EXTRA_GROUPS` does nothing.
 - `privileged: true` doesn't help. It grants capabilities to root, and the runtime user isn't root, so the file permissions on the node still apply.
 If the node's group is `root` or the mode denies the group, no `EXTRA_GROUPS` value will help. You need a udev rule first.
 #### Verify access
 Check the group landed, then check the runtime user can open the node. Test for write, not just read:
 ```bash
 docker exec frigate id frigate
 docker exec frigate /command/s6-setuidgid frigate sh -c 'test -w /dev/dri/renderD128 && echo ok'
 docker exec frigate /command/s6-setuidgid go2rtc  sh -c 'test -w /dev/dri/renderD128 && echo ok'
 ```
 A permission check is only a proxy for the driver working. These exercise the real libraries as the runtime user:
 ```bash
 docker exec frigate /command/s6-setuidgid frigate vainfo
 docker exec frigate /command/s6-setuidgid frigate python3 -c "import openvino as ov; print(ov.Core().available_devices)"
 ```
 `vainfo` should reach `va_openDriver() returns 0` and list profiles. Complaints about `XDG_RUNTIME_DIR` or an X server above that are normal. OpenVINO should list `GPU`; if it returns only `CPU`, detection has fallen back and inference will be much slower without an error in the log.
 To tell a permissions problem from anything else, start the container once with `FRIGATE_RUN_AS_ROOT=true`. If the device works as root and not otherwise, it's node permissions and a udev rule is the fix. If it's missing either way, the problem is your device mapping or the host, and isn't related to running non-root.
 #### udev rules by device
 Rules go in `/etc/udev/rules.d/` on the host and take effect after:
 ```bash
 sudo udevadm control --reload-rules && sudo udevadm trigger
 ```
 A device that's already connected sometimes keeps its original ownership through a trigger. If `ls -ln` doesn't show the new group, replug it, or reboot for a built-in device.
 **Coral USB** needs two rules, because the device re-enumerates after loading firmware. It appears as Global Unichip `1a6e` before and Google `18d1` after, with a different node each time. A rule covering only `1a6e` gives you a Coral that starts up once and then disappears mid-run.
 ```
 SUBSYSTEM=="usb", ATTRS{idVendor}=="1a6e", GROUP="plugdev", MODE="0664"
 SUBSYSTEM=="usb", ATTRS{idVendor}=="18d1", GROUP="plugdev", MODE="0664"
 ```
 Map the whole `/dev/bus/usb` rather than a single node, for the same reason. Most hosts put `plugdev` at GID 46 and the image agrees, so a USB Coral often needs no `EXTRA_GROUPS` entry. Confirm with `getent group plugdev` and add the number if your host differs.
 **Coral PCIe** is often `crw------- root root`, which only root can open:
 ```
 SUBSYSTEM=="apex", MODE="0660", GROUP="apex"
 ```
 Create the group with `sudo groupadd -f apex`, then add its GID to `EXTRA_GROUPS`.
 **Hailo** works the same way. Grant `/dev/hailo0` a group and add that GID:
 ```
 SUBSYSTEM=="hailo_chardev", MODE="0660", GROUP="hailo"
 ```
 **Intel and AMD GPUs** usually need nothing beyond `EXTRA_GROUPS`, since most distributions ship a `render` group that owns `/dev/dri/renderD128`. The GID often differs between the host and the image, so pass the host's number rather than assuming the name resolves. Debian based images have no `render` group at all.
 #### Quick reference
 What each device needs when you're setting it up by hand. The automatic grant covers most of these already, so start here only if it didn't.
 | Hardware                  | Device(s)                                                   | What non-root needs                                                                                              |
 | ------------------------- | ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
 | Intel/AMD GPU (VAAPI/QSV) | `/dev/dri/renderD128`                                       | Host render GID in `EXTRA_GROUPS`, from `getent group render`                                                    |
 | Intel/AMD NPU             | `/dev/accel`                                                | udev rule granting a group, then that GID in `EXTRA_GROUPS`                                                      |
 | Coral USB                 | `/dev/bus/usb`                                              | udev rules for both `1a6e` and `18d1`; usually already covered by `plugdev` 46                                   |
 | Coral PCIe                | `/dev/apex_0`                                               | udev rule granting a group, then that GID in `EXTRA_GROUPS`                                                      |
 | Hailo                     | `/dev/hailo0`                                               | udev rule granting a group, then that GID in `EXTRA_GROUPS`                                                      |
 | NVIDIA                    | nvidia runtime                                              | Nothing, works with the nvidia-container-toolkit defaults                                                        |
 | AMD ROCm                  | `/dev/kfd`, `/dev/dri`                                      | Host `video` and `render` GIDs in `EXTRA_GROUPS`                                                                 |
 | Raspberry Pi              | `/dev/video11`                                              | Host `video` GID in `EXTRA_GROUPS`                                                                               |
 | Rockchip                  | `/dev/dri`, `/dev/dma_heap`, `/dev/rga`, `/dev/mpp_service` | Commonly `root:root` `0600`, so all four need udev rules. If you can't grant all four, use `FRIGATE_RUN_AS_ROOT` |
 | Axera (AXCL)              | `/dev/ax_*` per the AXCL driver docs                        | Unverified. Check node ownership on your hardware before assuming this works                                     |
 | Synaptics SL1680          | per the Synaptics docs                                      | Unverified                                                                                                       |
 | MemryX                    | per the MemryX docs                                         | Still requires `privileged: true`, which means root. Out of scope for non-root operation                         |
 | Nvidia Jetson             | nvidia runtime plus Jetson nodes                            | Unverified. The nvidia runtime handles mapping, but check `/dev/nvhost-*` ownership on your board                |
 | VeriSilicon NPU (Teflon)  | per the driver, commonly `/dev/galcore`                     | Unverified. Check node ownership on your hardware before assuming this works                                     |
 | CPU detector              | none                                                        | Nothing, no device is opened                                                                                     |
 | ZMQ detector              | none                                                        | Nothing, inference happens over a socket                                                                         |
 | Apple Silicon             | none                                                        | Nothing, the NPU client runs on the host and Frigate reaches it over the network                                 |
 ## Hardened deployment
 A read-only root filesystem means the container can't modify itself, only the volumes you give it. It works in the default mode and under Docker's `user:`, but not with `PUID`/`PGID` or `EXTRA_GROUPS`, which both need to write to `/etc`.
 Start with the default mode. It keeps go2rtc on its own restricted user and still grants your hardware automatically, at the cost of a short root startup that finishes before any service runs.
 ```yaml
 services:
  frigate:
    container_name: frigate
    image: ghcr.io/blakeblackshear/frigate:stable
    restart: unless-stopped
    stop_grace_period: 30s
    read_only: true
    security_opt:
      - no-new-privileges:true
    shm_size: "512mb" # size for your cameras, see the shm-size calculation
    devices:
      - /dev/dri/renderD128:/dev/dri/renderD128 # your hardware, granted at startup
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /path/to/your/config:/config
      - /path/to/your/storage:/media/frigate
    tmpfs:
      - /tmp:size=256m
      - /tmp/cache:size=1000000000 # recording segments, sized as before
      - /run:exec,nosuid,nodev,mode=0755,size=16m
    ports:
      - "8971:8971"
      - "8554:8554" # RTSP feeds
      - "8555:8555/tcp" # WebRTC over tcp
      - "8555:8555/udp" # WebRTC over udp
 ```
 `/run` has to allow `exec`. With a read-only root filesystem s6 copies its service scripts into `/run` and runs them from there, and tmpfs mounts default to `noexec`. The equivalent for `docker run` is `--tmpfs /run:exec,nosuid,nodev,mode=0755`. Spelling out `nosuid` and `nodev` matters: passing any tmpfs options replaces Docker's defaults instead of adjusting them, so asking for `exec` alone would drop those two as well.
 Size `/tmp` deliberately. It now carries nginx's config copy and its five proxy temp directories as well as the recording cache. Keeping `/tmp/cache` as its own nested tmpfs, as above, leaves your existing [cache sizing](/frigate/installation#storage) untouched and adds a small allowance for nginx. If you'd rather use one tmpfs over all of `/tmp`, size it as your cache budget plus roughly 50MB, or recordings begin failing once the cache fills.
 The self signed certificate is written to `/config/tls`, which stays writable. Certificates you mount at `/etc/letsencrypt/live/frigate` work unchanged and still take precedence.
 [Detector runtimes](/frigate/network_requirements#detector-runtimes) that Frigate installs at first start (Hailo, MemryX, AXEngine) are staged in `/tmp` and installed into `/config/.local`, so they work with a read-only root filesystem in the default mode and under `user:`. A root `frigate` service installs into `/root/.local` instead, which a read-only root filesystem prevents; either leave `frigate` out of `FRIGATE_ROOT_SERVICES` or drop `read_only`.
 Soak a hardened deployment for 24 hours against real cameras before relying on it. A read-only root filesystem turns an occasional write into a failure that startup won't reveal.
 ### Never starting as root
 To remove root from the container entirely, add Docker's `user:`:
 ```yaml
    user: "1000:1000" # NOT compatible with PUID/PGID, see the run modes table
 ```
 Two things change, and the first one will break a working install if you skip it. The startup device grants can't run, because there is no root left to run them, so every device you pass stops working until you grant that uid access yourself with `group_add:` or a udev rule; see [Manual setup](#manual-setup). Expect this to surface as a driver error rather than a permission error, like `No VA display found` from VAAPI. And every service then runs as that one uid, so go2rtc no longer gets its own restricted user. `/config` and `/media/frigate` have to be owned by that uid already, since Frigate never adjusts ownership in this mode. Switching an existing install over also leaves `/config/go2rtc_homekit.yml` owned by the go2rtc user, which this mode can't write; `chown` it to your uid or HomeKit pairing changes stop persisting. Frigate warns and starts either way.
 This mode can also take `cap_drop: [ALL]`, which the default mode cannot: starting as root needs `CAP_CHOWN` for the ownership sweep, `CAP_SETUID` and `CAP_SETGID` to drop to the runtime user, and `CAP_FOWNER` for the device grants.
 ### Per-variant exceptions
 - **Rockchip** needs `- /sys/:/sys/:ro` alongside its device nodes, in addition to everything above.
 - **MemryX** and **QNAP Container Station** still require `privileged: true` per their own documentation, which gives back most of what this layout removes. MemryX also downloads its models to `/memryx_models` on the root filesystem, so it can't run read-only regardless. Its SDK is installed into `/config/.local` like the other detector runtimes.
 ## Network isolation
 Everything above limits what a compromised container can do to the host. It doesn't limit what your cameras can do to your network. Camera firmware is closed source, rarely patched, and not something you can audit, and none of it needs internet access for Frigate to work.
 Put the cameras on their own VLAN or subnet, give the Frigate host a route into it, and deny that VLAN any route out. Frigate reaches in to pull streams, the cameras reach nothing. A second NIC on the Frigate host is the simplest version of this, and a tagged VLAN on the NIC you already have works just as well.
 Here's the deny as nftables on the router, with cameras on `vlan20` and the Frigate host at `192.168.10.5`:
 ```
 table inet cameras {
  chain forward {
    type filter hook forward priority filter; policy accept;
    ct state established,related accept
    iifname "vlan20" ip daddr 192.168.10.5 accept
    iifname "vlan20" drop
  }
 }
 ```
 It's in its own table so it can sit alongside an existing ruleset without touching it. Streams keep working because Frigate opens those connections and the return traffic is `established`. Cameras can still reach each other on their own VLAN, since that traffic never reaches the router, so use client isolation on the switch if that matters to you.
 Two things break when you do this. The manufacturer's phone app stops working, which is the point, and camera clocks drift, because most of them set their time over NTP and are bad at it. Point them at an NTP server on your own network rather than opening the VLAN back up, or their timestamps and Frigate's will disagree.
 Frigate itself needs some outbound access, though nearly all of it is optional. The startup version check is the only piece that's on by default, and `telemetry.version_check: false` turns it off. Everything else (model downloads for the enrichment features, push notifications, Frigate+, and cloud GenAI providers) only reaches out once you enable that feature. See [Network Requirements](/frigate/network_requirements) for the full list and how to run fully offline.
 For containers that only talk to each other, an internal compose network gets you the same isolation without involving the router:
 ```yaml
 services:
  frigate:
    networks: [default, iot]
    # the rest of your frigate service
  mosquitto:
    image: eclipse-mosquitto
    networks: [iot]
 networks:
  iot:
    internal: true
 ```
 `internal: true` gives that network no route off the host, so the broker isn't reachable from anywhere else on your LAN. Frigate sits on both networks and keeps its normal outbound path.
 One Docker specific trap: published ports are inserted ahead of the host firewall, so `ufw deny 8971` doesn't do what it looks like it does. Bind the port to the interface you want instead, like `127.0.0.1:8971:8971` for a reverse proxy on the same host, or your LAN address for everything else.
 ## Known limitations
 `telemetry.stats.network_bandwidth` uses nethogs, which needs `CAP_NET_ADMIN` and `CAP_NET_RAW` and therefore root. The stat is turned off automatically when Frigate isn't running as root, with one warning in the log. Use `FRIGATE_ROOT_SERVICES=frigate` (or `FRIGATE_RUN_AS_ROOT=true`) if you need it.
 go2rtc's ffmpeg processes no longer appear in Intel GPU stats. Frigate reads per-process GPU usage from `/proc/<pid>/fdinfo`, which the kernel won't let one user read for another user's processes, so anything go2rtc spawns is invisible to it. Overall GPU utilization is unaffected.
 If you mount your own TLS certificate at `/etc/letsencrypt/live/frigate`, the private key has to be readable by the runtime user, which runs nginx. Frigate hands the key to that user at startup if the mount is writable; on a read-only mount, make the key readable by uid 1000 (or your `PUID`) yourself.
 If you're debugging nginx, run the config check as the runtime user with stdout discarded:
 ```bash
 docker exec frigate /command/s6-setuidgid frigate bash -c 'nginx -t -c /tmp/nginx/conf/nginx.conf >/dev/null'
 ```
 Running `nginx -t` as root hands nginx's runtime directories to root as a side effect, which breaks the running workers until the service restarts, and the config's `/dev/stdout` logs can't be reopened through a root-owned `docker exec` pipe. The results print on stderr either way.
@@ -297,12 +297,6 @@ If no custom model is provided, the Hailo detector downloads a default model fro
 :::
 :::info
 The HailoRT runtime is not part of the Frigate image. It is downloaded and installed into `/config/.local` the first time a Hailo detector is configured, verified against pinned checksums, and updated automatically when a Frigate release pins a new version. If the container has no internet access, see [Detector runtimes](/frigate/network_requirements#detector-runtimes) for how to provide the files yourself.
 :::
 ### Configuration {#configuration-hailo}
 When configuring the Hailo detector, you have two options to specify the model: a local **path** or a **URL**.
@@ -344,8 +338,6 @@ models:
 ### Intel NPU host requirements {#intel-npu-requirements}
 The NPU device must be passed into the container by adding `/dev/accel:/dev/accel` to the `devices` section of your compose file. Frigate grants the runtime user access to the device automatically; see [hardware device access](/configuration/non_root#hardware-device-access) if you manage device permissions yourself.
 The NPU firmware is loaded by the host kernel and is not part of the Frigate image. Everything else the NPU needs is bundled in the container, so host NPU libraries should never be mounted in.
 Frigate bundles a specific version of Intel's [linux-npu-driver](https://github.com/intel/linux-npu-driver/releases), and the host firmware must come from that release or a newer one. Firmware older than the bundled driver may fail with `MAPPED_INFERENCE_VERSION is NOT compatible with the ELF`, where `Expected` is the version the firmware supports and `received` is the version the bundled compiler produced. Distributions often package older firmware than the driver Frigate ships, so check the build date on the host with `sudo dmesg | grep -i vpu` and update it there if needed.
@@ -574,12 +566,6 @@ See the [installation docs](../frigate/installation.md#memryx-mx3) for informati
 To configure a MemryX detector, simply set the `type` attribute to `memryx` and follow the configuration guide below.
 :::info
 The MemryX SDK is not part of the Frigate image. It is downloaded and installed into `/config/.local` the first time a MemryX detector is configured, verified against pinned checksums, and updated automatically when a Frigate release pins a new version. If the container has no internet access, see [Detector runtimes](/frigate/network_requirements#detector-runtimes) for how to provide the files yourself.
 :::
 ### Configuration {#configuration-memryx}
 <ModelConfigDropdown detectorTitle="MemryX" models={objectDetectorsModels.memryx.models} />
@@ -840,12 +826,6 @@ The AXEngine detector downloads its default model from HuggingFace on first star
 :::
 :::info
 The AXEngine python package is not part of the Frigate image. It is downloaded and installed into `/config/.local` the first time an AXEngine detector is configured, verified against a pinned checksum, and updated automatically when a Frigate release pins a new version. If the container has no internet access, see [Detector runtimes](/frigate/network_requirements#detector-runtimes) for how to provide the file yourself.
 :::
 ### Configuration {#configuration-axengine}
 When configuring the AXEngine detector, you have to specify the model name.
@@ -9,7 +9,7 @@ import NavPath from "@site/src/components/NavPath";
 Recordings can be enabled and are stored at `/media/frigate/recordings`. The folder structure for the recordings is `YYYY-MM-DD/HH/<camera_name>/MM.SS.mp4` in **UTC time**. These recordings are written directly from your camera stream without re-encoding. Each camera supports a configurable retention policy. Frigate chooses the largest matching retention value between the recording retention and the tracked object retention when determining if a recording should be removed.
-New recording segments are written from the camera stream to cache, they are only moved to disk if they pass a validation check and match the setup recording retention policy.
+New recording segments are written from the camera stream to cache, they are only moved to disk if they match the setup recording retention policy.
 :::tip
@@ -9,7 +9,7 @@ import NavPath from "@site/src/components/NavPath";
 # TLS
-Frigate's integrated NGINX server supports TLS certificates. By default Frigate will generate a self signed certificate that will be used for port 8971, stored in `/config/tls` so it survives container recreation. Frigate is designed to make it easy to use whatever tool you prefer to manage certificates.
+Frigate's integrated NGINX server supports TLS certificates. By default Frigate will generate a self signed certificate that will be used for port 8971. Frigate is designed to make it easy to use whatever tool you prefer to manage certificates.
 Frigate is often running behind a reverse proxy that manages TLS certificates for multiple services. You will likely need to set your reverse proxy to allow self signed certificates or you can disable TLS in Frigate's config. However, if you are running on a dedicated device that's separate from your proxy or if you expose Frigate directly to the internet, you may want to configure TLS with valid certificates.
@@ -45,9 +45,7 @@ frigate:
  ...
 ```
-Within the folder, the private key is expected to be named `privkey.pem` and the certificate is expected to be named `fullchain.pem`. Mounted certificates take precedence over the self signed pair in `/config/tls`.
+Within the folder, the private key is expected to be named `privkey.pem` and the certificate is expected to be named `fullchain.pem`.
 `privkey.pem` must be readable by the runtime user that runs NGINX. Frigate hands it over at startup when the mount is writable; on a `:ro` mount, make it readable by uid 1000 (or your `PUID`) yourself. See [Running as a non-root user](/configuration/non_root).
 Note that certbot uses symlinks, and those can't be followed by the container unless it has access to the targets as well, so if using certbot you'll also have to mount the `archive` folder for your domain, e.g.:
@@ -61,7 +59,7 @@ frigate:
 ```
-Frigate automatically compares the fingerprint of the certificate it loaded, from either location, against the fingerprint of the TLS cert in NGINX every minute. If these differ, the NGINX config is reloaded to pick up the updated certificate.
+Frigate automatically compares the fingerprint of the certificate at `/etc/letsencrypt/live/frigate/fullchain.pem` against the fingerprint of the TLS cert in NGINX every minute. If these differ, the NGINX config is reloaded to pick up the updated certificate.
 If you issue Frigate valid certificates you will likely want to configure it to run on port 443 so you can access it without a port number like `https://your-frigate-domain.com` by mapping 8971 to 443.
@@ -75,4 +73,4 @@ frigate:
 ## ACME Challenge
-Frigate also supports hosting the acme challenge files for the HTTP challenge method if needed. The challenge files should be mounted at `/etc/letsencrypt/www`. With a read-only root filesystem this has to be a mounted volume, since Frigate cannot create the directory itself.
+Frigate also supports hosting the acme challenge files for the HTTP challenge method if needed. The challenge files should be mounted at `/etc/letsencrypt/www`.
@@ -124,8 +124,6 @@ Additionally, the USB Coral draws a considerable amount of power. If using any o
 The Hailo-8 and Hailo-8L AI accelerators are available in both M.2 and HAT form factors for the Raspberry Pi. The M.2 version typically connects to a carrier board for PCIe, which then interfaces with the Raspberry Pi 5 as part of the AI Kit. The HAT version can be mounted directly onto compatible Raspberry Pi models. Both form factors have been successfully tested on x86 platforms as well, making them versatile options for various computing environments.
 The HailoRT runtime is not part of the Frigate image; Frigate downloads and installs it at first start once a Hailo detector is configured. Containers without internet access can provide the files themselves, see [Detector runtimes](/frigate/network_requirements#detector-runtimes).
 #### Installation
 :::warning
@@ -317,8 +315,6 @@ The MemryX MX3 Accelerator is available in the M.2 2280 form factor (like an NVM
 To get started with MX3 hardware setup for your system, refer to the [Hardware Setup Guide](https://developer.memryx.com/2p1/get_started/install_hardware.html).
 The MemryX SDK used inside the container is not part of the Frigate image; Frigate downloads and installs it at first start once a MemryX detector is configured. Containers without internet access can provide the file themselves, see [Detector runtimes](/frigate/network_requirements#detector-runtimes). The host side driver still has to be installed as described below.
 Then follow these steps for installing the correct driver/runtime configuration:
 1. Copy or download [this script](https://github.com/blakeblackshear/frigate/blob/dev/docker/memryx/user_installation.sh).
@@ -483,8 +479,6 @@ Follow these steps for installation:
 To set up Frigate, follow the default installation instructions, for example: `ghcr.io/blakeblackshear/frigate:stable`
 The AXEngine python package is not part of the Frigate image; Frigate downloads and installs it at first start once an AXEngine detector is configured. Containers without internet access can provide the file themselves, see [Detector runtimes](/frigate/network_requirements#detector-runtimes).
 Next, grant Docker permissions to access your hardware by adding the following lines to your `docker-compose.yml` file:
 ```yaml
@@ -554,7 +548,9 @@ services:
 ### Recommended security options
-Frigate does not need elevated container privileges for most setups. The following hardens the container; add the `devices`/`group_add` entries your hardware requires (see the hardware acceleration docs):
+Frigate does not need elevated container privileges for most setups. The
 following hardens the container; add the `devices`/`group_add` entries your
 hardware requires (see the hardware acceleration docs):
 ```yaml
 services:
@@ -568,14 +564,15 @@ services:
 :::note
-`telemetry.stats.network_bandwidth` uses nethogs, which requires root with NET_ADMIN/NET_RAW capabilities. If you enable that stat, omit `cap_drop: [ALL]` or add `cap_add: [NET_ADMIN, NET_RAW]`.
+`telemetry.stats.network_bandwidth` uses nethogs, which requires root with
 NET_ADMIN/NET_RAW capabilities. If you enable that stat, omit `cap_drop: [ALL]`
 or add `cap_add: [NET_ADMIN, NET_RAW]`.
-Platforms that genuinely require `privileged: true` (MemryX, some QNAP setups) are called out in their own sections and are unaffected by this guidance.
+Platforms that genuinely require `privileged: true` (MemryX, some QNAP setups)
 are called out in their own sections and are unaffected by this guidance.
 :::
 Frigate's services run as an unprivileged user inside the container. See [Running as a non-root user](../configuration/non_root.md) for the run modes, the one time volume ownership migration, what each accelerator needs on the host, and the [hardened deployment](../configuration/non_root.md#hardened-deployment) layout with a read-only root filesystem.
 **Docker CLI**
 If you can't use Docker Compose, you can run the container with something similar to this:
@@ -56,24 +56,6 @@ The default CPU, EdgeTPU, and OpenVINO object detection models are bundled into
 :::
 ### Detector Runtimes
 The SDKs for a few hardware detectors are not shipped in the Frigate image. They are downloaded the first time that detector is configured, verified against checksums pinned in the Frigate release, and installed into the Frigate user's home directory (`/config/.local` by default). Once installed they are not downloaded again until a Frigate release pins a new version.
 | Detector                                                       | Version | Files                                                                                                                                                                                                 | Source                                                                                     |
 | -------------------------------------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
 | [Hailo 8 / 8L](/configuration/object_detectors#hailo-8)        | 4.21.0  | `hailort-debian12-amd64.tar.gz` and `hailort-4.21.0-cp311-cp311-linux_x86_64.whl` on x86, `hailort-debian12-arm64.tar.gz` and `hailort-4.21.0-cp311-cp311-linux_aarch64.whl` on arm64 | [GitHub release](https://github.com/frigate-nvr/hailort/releases/tag/v4.21.0)              |
 | [MemryX MX3](/configuration/object_detectors#memryx-mx3)       | 2.1.0   | `mx_accl_frigate-2.1.0.zip` (the release source archive, renamed)                                                                                                                                     | [GitHub archive](https://github.com/memryx/mx_accl_frigate/archive/refs/tags/v2.1.0.zip)   |
 | [AXERA AXEngine](/configuration/object_detectors#axera)        | 0.1.3   | `axengine-0.1.3-py3-none-any.whl`                                                                                                                                                                     | [GitHub release](https://github.com/AXERA-TECH/pyaxengine/releases/tag/0.1.3-frigate)      |
 If the container cannot reach GitHub, provide the files yourself:
 1. Download the files for your architecture on a machine with internet access.
 2. Place them, with exactly the file names listed above, in `/config/model_cache/runtimes/<detector>/`, where `<detector>` is the detector `type` from your config (`hailo8l`, `memryx`, or `axengine`).
 3. Start Frigate. Files whose checksum matches are installed without any download; a file with the wrong checksum is discarded and downloaded again, so a failed startup log names the file to replace.
 The `GITHUB_ENDPOINT` mirror variable below applies to these downloads as well.
 ### Preventing Model Downloads
 If you have already downloaded all required models and want to prevent Frigate from attempting any outbound connections to HuggingFace or the Transformers library, set the following environment variables on your Frigate container:
@@ -97,7 +79,7 @@ If your Frigate instance has restricted internet access, you can point model dow
 | Environment Variable                | Default                             | Used By                                       |
 | ----------------------------------- | ----------------------------------- | --------------------------------------------- |
 | `HF_ENDPOINT`                       | `https://huggingface.co`            | Semantic search, Sherpa-ONNX, AXEngine models |
-| `GITHUB_ENDPOINT`                   | `https://github.com`                | Face recognition, LPR, RKNN models, detector runtimes |
+| `GITHUB_ENDPOINT`                   | `https://github.com`                | Face recognition, LPR, RKNN models            |
 | `GITHUB_RAW_ENDPOINT`               | `https://raw.githubusercontent.com` | Bird classification                           |
 | `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` | Unset (Keras uses its own default)  | Custom classification training                |
@@ -4,7 +4,6 @@ title: Getting started
 ---
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import Tabs from "@theme/Tabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
@@ -133,68 +132,21 @@ services:
      - "8554:8554" # RTSP feeds
 ```
-Now you should be able to start Frigate by running `docker compose up -d` from within the folder containing `docker-compose.yml`. On startup, an admin user and password will be created and outputted in the logs. You can see this by running `docker logs frigate`. Frigate should now be accessible at `https://server_ip:8971` where you can login with the `admin` user. With no cameras configured yet, the setup wizard runs on first login and walks you through the rest.
+Now you should be able to start Frigate by running `docker compose up -d` from within the folder containing `docker-compose.yml`. On startup, an admin user and password will be created and outputted in the logs. You can see this by running `docker logs frigate`. Frigate should now be accessible at `https://server_ip:8971` where you can login with the `admin` user and finish configuration using the Settings UI.
 ## Configuring Frigate
 This section assumes that you already have an environment setup as described in [Installation](../frigate/installation.md). You should also configure your cameras according to the [camera setup guide](/frigate/camera_setup). Pay particular attention to the section on choosing a detect resolution.
-<Tabs
+### Step 1: Start Frigate
 groupId="setup-method"
 defaultValue="wizard"
 values={[
 { label: "Setup wizard", value: "wizard" },
 { label: "Manual", value: "manual" },
 ]}
 > <TabItem value="wizard">
 The first time you open Frigate with no cameras configured, the setup wizard walks you through the basics. Every step can be skipped, everything it sets can be changed later in Settings, and once you finish or dismiss it, it doesn't come back.
 :::note
 Frigate only sees hardware that has been passed into the container. If you plan to use a GPU, a Coral, or another accelerator, add the device to your `docker-compose.yml` and restart before running the wizard, otherwise it won't appear in the detection or hardware acceleration steps. The Manual tab shows the device entries for an Intel or AMD GPU and for a Coral, and the [hardware acceleration](../configuration/hardware_acceleration_video.md) and [object detectors](../configuration/object_detectors.md) docs cover the rest.
 :::
 **Account**
 Set a password for the `admin` account to replace the generated one from the logs, and add accounts for anyone else who needs access. This step is hidden if you have turned authentication off.
 **Add a camera**
 Opens the [Add Camera Wizard](../configuration/cameras.md#adding-a-camera-with-the-add-camera-wizard), which connects to the camera, tests each stream, and writes its configuration for you. You can add more than one before moving on.
 **Object detection**
 Lists the detection hardware Frigate found on your system, such as a Coral, an Intel GPU or NPU, or a discrete GPU, and configures the one you pick. NVIDIA and AMD GPUs need a model before detection can start, so the wizard offers your Frigate+ models if you have them, or lets you finish setup and add one later under <NavPath path="Settings > System > Detection models" />.
 **Hardware acceleration**
 Offers only the decoding methods your hardware supports. Auto picks one based on that hardware and the codec your camera sends, so a mixed h264 and h265 setup gets the right preset per camera.
 **Recording**
 Choose whether to record only when something is detected or around the clock, and how long to keep it.
 The last screen summarizes what was set up. If a step changed something that needs a restart, the button restarts Frigate and returns you to the Live view once it is back.
 The wizard configures the essentials only. Motion masks are not included and should be set up afterward, once you can identify the areas of the frame that trigger unwanted motion. See the [masks documentation](../configuration/masks.md). Zones, tracked object types, notifications, and MQTT are also configured in Settings.
 </TabItem>
 <TabItem value="manual">
 On a new install the setup wizard opens first. Click **Skip setup and configure manually** on its welcome screen to dismiss it, and the steps below apply. The wizard won't come back once dismissed.
 **Step 1: Start Frigate**
 At this point you should be able to start Frigate and a basic config will be created automatically.
-**Step 2: Add a camera**
+### Step 2: Add a camera
 Click the **Add Camera** button in <NavPath path="Settings > Global configuration > Camera management" /> to use the camera setup wizard to get your first camera added into Frigate. See [Adding a camera with the Add Camera Wizard](../configuration/cameras.md#adding-a-camera-with-the-add-camera-wizard) for a walkthrough of each step.
-**Step 3: Configure hardware acceleration (recommended)**
+### Step 3: Configure hardware acceleration (recommended)
 Now that you have a working camera configuration, set up hardware acceleration to minimize the CPU required to decode your video streams. See the [hardware acceleration](../configuration/hardware_acceleration_video.md) docs for examples applicable to your hardware.
@@ -238,7 +190,7 @@ cameras:
 </TabItem>
 </ConfigTabs>
-**Step 4: Configure detectors**
+### Step 4: Configure detectors
 By default, Frigate will use a single OpenVINO detector running on the CPU.
@@ -347,7 +299,7 @@ More details on available detectors can be found [here](../configuration/object_
 Restart Frigate and you should start seeing detections for `person`. If you want to track other objects, they can be configured in <NavPath path="Settings > Global configuration > Objects" /> or via the [configuration file reference](../configuration/advanced/reference.md).
-**Step 5: Setup motion masks**
+### Step 5: Setup motion masks
 Now that you have optimized your configuration for decoding the video stream, you will want to check to see where to implement motion masks. Click on the camera from the main dashboard, then select the gear icon in the top right, enable the [Debug view](/usage/live#the-single-camera-view), and finally enable the switch for Motion Boxes. Watch for areas that continuously trigger unwanted motion to be detected. Common areas to mask include camera timestamps and trees that frequently blow in the wind. The goal is to avoid wasting object detection cycles looking at these areas.
@@ -384,7 +336,7 @@ cameras:
          coordinates: "0,461,3,0,1919,0,1919,843,1699,492,1344,458,1346,336,973,317,869,375,866,432"
 ```
-**Step 6: Enable recordings**
+### Step 6: Enable recordings
 In order to review activity in the Frigate UI, recordings need to be enabled.
@@ -433,10 +385,7 @@ If you only plan to use Frigate for recording, it is still recommended to define
 By default, Frigate will retain video of all tracked objects for 10 days. The full set of options for recording can be found [here](../configuration/advanced/reference.md).
-</TabItem>
+### Step 7: Complete config
 </Tabs>
 ### Complete config
 At this point you have a complete config with basic functionality.
@@ -66,19 +66,17 @@ An FFmpeg message meaning it probed the stream but never saw enough decodable vi
 ## Recording
-<FaqItem id="no-new-recording-segments" question="No new recording segments were created (or: No new valid recording segments were created / No valid segments created since last invalid segment) for <camera> in the last 120s">
+<FaqItem id="no-new-recording-segments" question="No new recording segments were created for <camera> in the last 120s">
-Frigate's record watchdog is restarting the record FFmpeg process because the camera stopped producing usable recordings. The wording distinguishes the cases: `No new recording segments` means no new segment file reached the cache, so ffmpeg isn't getting video out of the record stream; the two `valid` variants mean recordings are arriving but keep failing validation. Either way the fault is on the camera or network side, and the restart is Frigate trying to recover.
+Frigate's record watchdog is restarting the record FFmpeg process because no valid segment has reached the cache. This means the record stream is not connecting or the segments are being rejected (see the audio-codec entry below).
-See [Recordings: no new recording segments were created](/troubleshooting/recordings#no-new-recording-segments-were-created).
+See [Recordings: the record stream isn't connecting](/troubleshooting/recordings#the-record-stream-isnt-connecting).
 </FaqItem>
-<FaqItem id="invalid-or-missing-video-stream-in-segment" question="Invalid or missing video stream in segment. Discarding. / Discarding a corrupt recording segment / Failed to probe corrupt segment / Invalid recording segment detected">
+<FaqItem id="invalid-or-missing-video-stream-in-segment" question="Invalid or missing video stream in segment. Discarding.">
-A cached recording segment failed validation and was deleted, either because it had no readable video stream or because its length was impossible. This nearly always means the camera stopped sending usable video partway through the segment: a camera that rebooted, dropped the connection, or ran out of simultaneous connections, or an unreliable link such as WiFi or a failing switch port. Broken camera timestamps (a "Smart Codec" / H.264+ mode) cause the corrupt-segment variants. The same stream failure trips the record watchdog, so the restarts above usually appear alongside these messages.
+A cached recording segment failed validation (no readable video stream) and was deleted. The most common cause is a segment that was truncated because the record FFmpeg process was killed mid-write, so this often appears alongside, and as a consequence of, the record-stream restarts above. A segment containing only audio triggers it too.
 See [Recordings: invalid or missing video stream in segment](/troubleshooting/recordings#invalid-or-missing-video-stream-in-segment).
 </FaqItem>
@@ -209,50 +209,6 @@ If the record stream uses a "Smart Codec"/H.264+ mode or changes encoding parame
 </FaqItem>
 <FaqItem id="invalid-or-missing-video-stream-in-segment" question="I see the message: WARNING : Invalid or missing video stream in segment ... Discarding.">
 Every recording segment is validated before it leaves the cache. Frigate probes each finished `.mp4` in `/tmp/cache` and requires a readable video stream and a valid duration before moving to storage. A segment that fails is deleted, so those ~10 seconds of footage are lost. Three messages come from this check:
 - `Invalid or missing video stream in segment <path>. Discarding.` The segment holds no video, or could not be read at all.
 - `Failed to probe corrupt segment <path>` followed by `Discarding a corrupt recording segment: <path>`. The segment was read, but its length could not be determined.
 - `Discarding a corrupt recording segment: <path>` on its own. The segment's length is impossible (empty, or longer than ten minutes), which points at broken timestamps coming from the camera.
 For each one, the camera watchdog also logs `Invalid recording segment detected for <camera> at <timestamp>`.
 :::warning
 This is almost always a **camera or network problem**, not a Frigate one. A segment is only complete once ffmpeg has finished writing it, so anything that interrupts the stream partway through leaves behind a file that cannot be saved. Frigate is reporting the interruption, not causing it.
 :::
 #### Start with the camera and the network
 - **The camera dropped the connection.** Cameras reboot, reinitialize their stream when switching to night mode, and cut clients off when they are overloaded or out of simultaneous connections. Count everything pulling from the camera at once: Frigate's detect and record streams, go2rtc, a phone app, and any other NVR each use one. Routing all roles through a single [RTSP restream](/configuration/restream#reduce-connections-to-camera) so the camera only ever sees one connection often resolves this by itself.
 - **The link to the camera is unreliable.** WiFi cameras, powerline adapters, a saturated uplink, a failing switch port, or a marginal cable all produce this pattern, and usually only on one camera at a time. WiFi cameras are [not recommended](https://ipcamtalk.com/threads/multiple-cameras-high-bandwidth.77100/#post-861110).
 - **The camera cannot reliably send what it is being asked for.** A high bitrate 4K stream can be more than the camera's own hardware can encode and push out under load. Lower the bitrate, or record a lower-resolution profile.
 - **The camera is using a "Smart Codec", H.264+, or H.265+ mode.** These change encoding parameters mid-stream and produce the broken timestamps behind the corrupt-segment variant. Turn the mode off and set the camera's keyframe interval equal to its frame rate. See [Segments are only ~1 second long](#segments-are-only-1-second-long).
 Read the rest of the Frigate and/or go2rtc log around the **first** occurrence. When the camera or the network is at fault, other messages show up with it, such as `No frames received from <camera> in 20 seconds`, `Non-monotonic DTS`, `RTP: PT=xx: bad cseq`, `error while decoding MB`, or a connection timeout. Each of those is explained in [Common error messages](/troubleshooting/common_errors). To confirm the camera is the source, open its stream in the [go2rtc web interface](/troubleshooting/go2rtc) on port `1984` or play the same URL in VLC, and leave it running long enough for the failures to happen again.
 #### If the camera and network check out
 - **Audio the recording cannot store.** Some cameras send G.711 audio, which cannot be saved in an MP4 and stops segments from finalizing. See [Incompatible audio codec](#incompatible-audio-codec-recordings-silently-fail-to-save).
 - **Frigate itself was stopped or restarted.** A single warning per camera around a restart is expected and needs no action.
 - **The system ran out of room or memory.** A full `/tmp/cache`, or the host killing Frigate for using too much memory, cuts off the segment being written. Both leave other errors in the log alongside this one. See [No space left on device](#errno-28-no-space-left-on-device).
 </FaqItem>
 <FaqItem id="no-new-recording-segments-were-created" question="I see the message: ERROR : No new recording segments were created for <camera> in the last 120s. Restarting the ffmpeg record process...">
 When a camera stops producing usable recordings for two minutes, Frigate restarts that camera's record process to try to recover. The wording tells you how far the recordings got:
 - **`No new recording segments were created`**: no new segment file showed up in the cache at all, so ffmpeg isn't getting video out of the record stream. The camera is unreachable or refusing the connection, the stream URL, path, or credentials are wrong, or the camera accepted the connection and then sent nothing. See [The record stream isn't connecting](#the-record-stream-isnt-connecting).
 - **`No new valid recording segments were created`** and **`No valid segments created since last invalid segment`**: recordings are arriving, but they keep failing validation, so the camera is sending video that cannot be saved. See [Invalid or missing video stream in segment](#invalid-or-missing-video-stream-in-segment) above.
 The restart is Frigate recovering from a problem, not causing one. One of these after a camera reboot or a brief network drop is normal. Seeing them repeat every couple of minutes means the camera or the network is still failing, and the restarts can extend the damage, because each one cuts off the segment that was being written. Work from the earliest failure in that camera's log rather than from the restarts.
 </FaqItem>
 <FaqItem id="i-see-the-message-warning--unable-to-keep-up-with-recording-segments-in-cache-for-camera-keeping-the-5-most-recent-segments-out-of-6-and-discarding-the-rest" question="I see the message: WARNING : Unable to keep up with recording segments in cache for camera. Keeping the 5 most recent segments out of 6 and discarding the rest...">
 This warning means the recording maintainer cannot move recording segments from the RAM cache to disk fast enough. When the cache fills up, Frigate discards the oldest segments to avoid running out of memory and crashing, so you lose recorded footage. This is almost always a storage throughput or system resource problem. Work through the steps below to identify which.
@@ -122,7 +122,6 @@ const sidebars: SidebarsConfig = {
          "configuration/ffmpeg_presets",
          "configuration/pwa",
          "configuration/tls",
          "configuration/non_root",
        ],
      },
      {
@@ -62,9 +62,6 @@ paths:
                type: string
        '401':
          description: Authentication Failed
        '403':
          description: Access Denied (proxy user resolved to a default role of 
            'none')
      security: []
      x-required-role: public
  /profile:
@@ -1479,10 +1476,12 @@ paths:
        - Classification
      summary: Get custom classification attributes
      description: |-
-        **Access:** Authenticated user with access to all cameras.
+        **Access:** Any authenticated user.
        Returns custom classification attributes for a given object type.
            Only includes models with classification_type set to 'attribute'.
            Callers without access to every camera only receive values that have been
            recorded on the cameras they can access.
            By default returns a flat sorted list of all attribute labels.
            If group_by_model is true, returns attributes grouped by model name.
      operationId: get_custom_attributes_classification_attributes_get
@@ -1514,7 +1513,7 @@ paths:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - frigateUserAuth: []
-      x-required-role: all_cameras
+      x-required-role: any
  /classification/{name}/train:
    get:
      tags:
@@ -4056,58 +4055,6 @@ paths:
      security:
        - frigateAdminAuth: []
      x-required-role: admin
  /hardware/hwaccel:
    get:
      tags:
        - Hardware
      summary: Hwaccel Recommendation
      description: |-
        **Access:** Admin role required.
        Get the hardware decoding this system can do.
        Args:
            detector: Hardware key of the detection hardware in use, which biases
                the recommendation toward that hardware's GPU
            codecs: Comma separated codecs of the streams that will be decoded,
                used to drop families that cannot decode one of them
        Returns:
            The recommended family (empty when none fits) and every usable family
      operationId: hwaccel_recommendation_hardware_hwaccel_get
      parameters:
        - name: detector
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Detector
        - name: codecs
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Codecs
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HwaccelRecommendation'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - frigateAdminAuth: []
      x-required-role: admin
  /events:
    get:
      tags:
@@ -7197,17 +7144,13 @@ paths:
          in: query
          required: false
          schema:
-            anyOf:
+            type: number
              - type: number
              - type: 'null'
            title: After
        - name: before
          in: query
          required: false
          schema:
-            anyOf:
+            type: number
              - type: number
              - type: 'null'
            title: Before
      responses:
        '200':
@@ -8729,43 +8672,6 @@ components:
        - label
      title: HardwareUnit
      description: One physical piece of hardware.
    HwaccelFamily:
      properties:
        key:
          type: string
          title: Family key
          description: Stable identifier for this kind of hardware decoding.
        presets:
          additionalProperties:
            type: string
          type: object
          title: Presets
          description: The ffmpeg preset for each codec this family decodes, or 
            a single 'any' preset when it decodes every codec.
      type: object
      required:
        - key
        - presets
      title: HwaccelFamily
      description: A kind of hardware decoding, and the presets that drive it.
    HwaccelRecommendation:
      properties:
        recommended:
          type: string
          title: Recommended family
          description: Key of the family that fits this system best, or an empty
            string when none does.
        available:
          items:
            $ref: '#/components/schemas/HwaccelFamily'
          type: array
          title: Available families
          description: Every family this system's hardware can use, best first.
      type: object
      required:
        - recommended
      title: HwaccelRecommendation
      description: The hardware decoding this system can do.
    Last24HoursReview:
      properties:
        reviewed_alert:
@@ -497,7 +497,6 @@ def resolve_role(
                     Admin matches short-circuit to admin.
                 - If no role_map is configured, treat the header as role names directly.
      2. If no valid role is found, return proxy_config.default_role if it's valid in config_roles, else 'viewer'.
         The literal value 'none' is a valid default and means access should be denied.
    Args:
        headers (dict): Incoming request headers (case-insensitive).
@@ -510,17 +509,10 @@ def resolve_role(
    default_role = proxy_config.default_role
    role_header = proxy_config.header_map.role
-    # Validate default_role against config; fallback to 'viewer' if invalid.
+    # Validate default_role against config; fallback to 'viewer' if invalid
-    # "none" is a sentinel meaning "deny access when no mapping matches"; it is
+    validated_default = default_role if default_role in config_roles else "viewer"
    # reserved in AuthConfig.validate_roles so it is never a configured role.
    validated_default = (
        default_role
        if default_role in config_roles or default_role == "none"
        else "viewer"
    )
    if not config_roles:
-        # Edge case: no roles defined
+        validated_default = "viewer"  # Edge case: no roles defined
        validated_default = "none" if default_role == "none" else "viewer"
    if not role_header:
        logger.debug(
@@ -625,9 +617,6 @@ def resolve_role(
            },
        },
        401: {"description": "Authentication Failed"},
        403: {
            "description": "Access Denied (proxy user resolved to a default role of 'none')"
        },
    },
 )
 def auth(request: Request):
@@ -677,10 +666,6 @@ def auth(request: Request):
        config_roles_set = set(auth_config.roles.keys())
        role = resolve_role(request.headers, proxy_config, config_roles_set)
        if role == "none":
            logger.debug("Resolved role is 'none', denying access")
            return Response("", status_code=403)
        success_response.headers["remote-role"] = role
        deny_status = deny_response_for_media_uri(original_url, role, frigate_config)
@@ -11,10 +11,14 @@ from typing import Any
 import cv2
 from fastapi import APIRouter, Depends, Request, UploadFile
 from fastapi.responses import JSONResponse
-from peewee import DoesNotExist
+from peewee import DoesNotExist, fn
 from playhouse.shortcuts import model_to_dict
-from frigate.api.auth import require_full_camera_access, require_role
+from frigate.api.auth import (
    allow_any_authenticated,
    get_allowed_cameras_for_filter,
    require_role,
 )
 from frigate.api.defs.request.classification_body import (
    AudioTranscriptionBody,
    DeleteFaceImagesBody,
@@ -739,19 +743,81 @@ def get_classification_dataset(name: str):
    )
 def get_observed_attributes(
    model_attributes: dict[str, list[str]],
    object_labels: set[str],
    allowed_cameras: list[str],
 ) -> dict[str, set[str]]:
    """Get the attribute values recorded on the given cameras.
    Args:
        model_attributes: Labels each attribute model can emit, keyed by model name
        object_labels: Object types those models run on
        allowed_cameras: Cameras the caller has access to
    Returns:
        Values seen for each model, keyed by model name
    """
    if not model_attributes or not object_labels or not allowed_cameras:
        return {}
    model_names = list(model_attributes.keys())
    query = (
        Event.select(
            *[
                fn.json_extract(Event.data, f'$."{model_name}"')
                for model_name in model_names
            ]
        )
        .where(
            (Event.camera << allowed_cameras) & (Event.label << sorted(object_labels))
        )
        .distinct()
        .tuples()
    )
    targets = {
        model_name: set(attributes)
        for model_name, attributes in model_attributes.items()
    }
    observed: dict[str, set[str]] = {model_name: set() for model_name in model_names}
    for row in query.iterator():
        found = False
        for model_name, value in zip(model_names, row):
            if isinstance(value, str) and value not in observed[model_name]:
                observed[model_name].add(value)
                found = True
        if found and all(
            observed[model_name] >= targets[model_name] for model_name in model_names
        ):
            break
    return observed
@router.get(
    "/classification/attributes",
-    dependencies=[Depends(require_full_camera_access)],
+    dependencies=[Depends(allow_any_authenticated())],
    summary="Get custom classification attributes",
    description="""Returns custom classification attributes for a given object type.
    Only includes models with classification_type set to 'attribute'.
    Callers without access to every camera only receive values that have been
    recorded on the cameras they can access.
    By default returns a flat sorted list of all attribute labels.
    If group_by_model is true, returns attributes grouped by model name.""",
 )
 def get_custom_attributes(
-    request: Request, object_type: str = None, group_by_model: bool = False
+    request: Request,
    object_type: str = None,
    group_by_model: bool = False,
    allowed_cameras: list[str] = Depends(get_allowed_cameras_for_filter),
 ):
    models_with_attributes = {}
    objects_by_model = {}
    for (
        model_key,
@@ -782,6 +848,32 @@ def get_custom_attributes(
        if attributes:
            model_name = model_config.name or model_key
            models_with_attributes[model_name] = sorted(attributes)
            objects_by_model[model_name] = model_objects
    # the dataset holds every label a model can emit, including ones never
    # applied to an event, so callers without full camera access are limited to
    # the values actually recorded on the cameras they can see
    all_cameras = set(request.app.frigate_config.cameras.keys())
    if models_with_attributes and not all_cameras.issubset(allowed_cameras):
        observed = get_observed_attributes(
            models_with_attributes,
            set().union(*objects_by_model.values()),
            allowed_cameras,
        )
        models_with_attributes = {
            model_name: [
                attribute
                for attribute in attributes
                if attribute in observed.get(model_name, set())
            ]
            for model_name, attributes in models_with_attributes.items()
        }
        models_with_attributes = {
            model_name: attributes
            for model_name, attributes in models_with_attributes.items()
            if attributes
        }
    if group_by_model:
        return JSONResponse(content=models_with_attributes)
@@ -1,9 +1,7 @@
 """Export apis."""
 import contextlib
 import datetime
 import logging
 import os
 import random
 import string
 import time
@@ -11,13 +9,12 @@ import zipfile
 from collections import deque
 from collections.abc import Iterator
 from pathlib import Path
 from urllib.parse import quote
 import psutil
 from fastapi import APIRouter, Depends, Query, Request
 from fastapi.responses import JSONResponse, StreamingResponse
 from pathvalidate import sanitize_filename
-from peewee import DatabaseError, DoesNotExist, IntegrityError
+from peewee import DoesNotExist
 from playhouse.shortcuts import model_to_dict
 from frigate.api.auth import (
@@ -73,7 +70,6 @@ from frigate.record.export import (
    DEFAULT_TIME_LAPSE_FFMPEG_ARGS,
    ChaptersEnum,
    PlaybackSourceEnum,
    export_video_path,
    validate_ffmpeg_args,
 )
 from frigate.util.path import sanitize_contained_path
@@ -407,17 +403,14 @@ class _StreamingZipBuffer:
 def _unique_archive_name(export: Export, used: set[str]) -> str:
-    """Zip entry name for an export, de-duplicated within the archive.
+    base = sanitize_filename(export.name) if export.name else None
-
+    if not base:
-    The on-disk name is the one the user sees either way: renaming an export
+        base = f"{export.camera}_{int(export.date)}"
    renames its file, so a zip entry and an individual download can't drift.
    """
    source = Path(export.video_path)
    candidate = source.name
    candidate = f"{base}.mp4"
    counter = 1
    while candidate in used:
-        candidate = f"{source.stem}_{counter}{source.suffix}"
+        candidate = f"{base}_{counter}.mp4"
        counter += 1
    used.add(candidate)
@@ -460,22 +453,6 @@ def _stream_case_archive(exports: list[Export]) -> Iterator[bytes]:
    yield from buffer.drain()
 def _content_disposition(filename: str, ascii_fallback: str) -> str:
    """Build an attachment Content-Disposition that survives non-ASCII names.
    Header values are encoded as latin-1, so a name outside that range cannot
    go in filename at all. RFC 6266 handles this with a pair: a plain ASCII
    filename for old clients, plus a percent-encoded UTF-8 filename* that
    every current browser prefers.
    """
    ascii_name = filename if filename.isascii() else ascii_fallback
    return (
        f'attachment; filename="{ascii_name}"; '
        f"filename*=UTF-8''{quote(filename, safe='')}"
    )
@router.get(
    "/cases/{case_id}/download",
    dependencies=[Depends(allow_any_authenticated())],
@@ -518,9 +495,7 @@ def download_export_case(
        _stream_case_archive(exports),
        media_type="application/zip",
        headers={
-            "Content-Disposition": _content_disposition(
+            "Content-Disposition": f'attachment; filename="{archive_base}.zip"',
                f"{archive_base}.zip", f"{case_id}.zip"
            ),
        },
    )
@@ -933,59 +908,8 @@ async def export_rename(event_id: str, body: ExportRenameBody, request: Request)
            status_code=404,
        )
    if export.in_progress:
        return JSONResponse(
            content={
                "success": False,
                "message": "Export is still being written and can't be renamed yet.",
            },
            status_code=400,
        )
    new_path = export_video_path(body.name, export.id)
    old_path = export.video_path
    moved = new_path != old_path
    # move the file first so a rename that can't happen leaves the row alone
    if moved:
        try:
            os.rename(old_path, new_path)
        except OSError:
            logger.exception("Failed to rename export file for %s", event_id)
            return JSONResponse(
                content={"success": False, "message": "Failed to rename export."},
                status_code=500,
            )
    export.name = body.name
-    export.video_path = new_path
+    export.save()
    try:
        export.save()
    except DatabaseError as err:
        # the queue database has no transactions, so undo the move by hand
        if moved:
            with contextlib.suppress(OSError):
                os.rename(new_path, old_path)
        if isinstance(err, IntegrityError):
            logger.warning(
                "Export %s cannot be renamed, %s is taken", event_id, new_path
            )
            return JSONResponse(
                content={
                    "success": False,
                    "message": "Another export already uses that name.",
                },
                status_code=409,
            )
        logger.exception("Failed to save renamed export %s", event_id)
        return JSONResponse(
            content={"success": False, "message": "Failed to rename export."},
            status_code=500,
        )
    return JSONResponse(
        content=(
            {
@@ -7,7 +7,6 @@ from fastapi import APIRouter, Depends
 from frigate.api.auth import require_role
 from frigate.api.defs.tags import Tags
 from frigate.detectors.hardware import DetectionHardware, hardware_prober
 from frigate.util.hwaccel import HwaccelRecommendation, hwaccel_options
 logger = logging.getLogger(__name__)
@@ -29,29 +28,3 @@ def probe_hardware(refresh: bool = False) -> list[DetectionHardware]:
        Every kind of detection hardware that was found
    """
    return hardware_prober.probe(refresh=refresh)
@router.get(
    "/hardware/hwaccel",
    response_model=HwaccelRecommendation,
    dependencies=[Depends(require_role(["admin"]))],
 )
 def hwaccel_recommendation(
    detector: str | None = None, codecs: str | None = None
 ) -> HwaccelRecommendation:
    """Get the hardware decoding this system can do.
    Args:
        detector: Hardware key of the detection hardware in use, which biases
            the recommendation toward that hardware's GPU
        codecs: Comma separated codecs of the streams that will be decoded,
            used to drop families that cannot decode one of them
    Returns:
        The recommended family (empty when none fits) and every usable family
    """
    wanted = {
        codec.strip().lower() for codec in (codecs or "").split(",") if codec.strip()
    }
    recommended, available = hwaccel_options(detector, wanted)
    return HwaccelRecommendation(recommended=recommended, available=available)
@@ -1060,7 +1060,7 @@ async def event_thumbnail(
    except DoesNotExist:
        thumbnail_bytes = None
-    if not thumbnail_bytes:
+    if thumbnail_bytes is None:
        # see if the object is currently being tracked
        try:
            camera_states = request.app.detected_frames_processor.get_camera_states()
@@ -1076,7 +1076,7 @@ async def event_thumbnail(
                status_code=404,
            )
-    if not thumbnail_bytes:
+    if thumbnail_bytes is None:
        return JSONResponse(
            content={"success": False, "message": "Event not found"},
            status_code=404,
@@ -1085,13 +1085,6 @@ async def event_thumbnail(
    img_as_np = np.frombuffer(thumbnail_bytes, dtype=np.uint8)
    img = cv2.imdecode(img_as_np, flags=1)
    if img is None:
        # thumbnail on disk is truncated or corrupt
        return JSONResponse(
            content={"success": False, "message": "Event not found"},
            status_code=404,
        )
    # android notifications prefer a 2:1 ratio
    if format == "android":
        img = cv2.copyMakeBorder(
@@ -358,13 +358,10 @@ async def recordings_coverage(
@router.get("/{camera_name}/recordings", dependencies=[Depends(require_camera_access)])
 async def recordings(
    camera_name: str,
-    after: float | None = None,
+    after: float = (datetime.now() - timedelta(hours=1)).timestamp(),
-    before: float | None = None,
+    before: float = datetime.now().timestamp(),
 ):
    """Return specific camera recordings between the given 'after'/'end' times. If not provided the last hour will be used"""
    now = datetime.now()
    after = after if after is not None else (now - timedelta(hours=1)).timestamp()
    before = before if before is not None else now.timestamp()
    recordings = (
        Recordings.select(
            Recordings.id,
@@ -50,7 +50,6 @@ from frigate.debug_replay import (
    cleanup_replay_cameras,
 )
 from frigate.detectors.detector_config import SceneEnum
 from frigate.detectors.detector_types import api_types
 from frigate.detectors.device import build_detector_config, runner_names
 from frigate.embeddings import EmbeddingProcess, EmbeddingsContext
 from frigate.events.audio import AudioProcessor
@@ -89,7 +88,6 @@ from frigate.util.builtin import empty_and_close_queue
 from frigate.util.image import UntrackedSharedMemory
 from frigate.util.ownership import chown_to_runtime
 from frigate.util.process import FrigateProcess
 from frigate.util.runtime_deps import RuntimeDependencyError
 from frigate.util.services import set_file_limit
 from frigate.version import VERSION
 from frigate.watchdog import FrigateWatchdog
@@ -233,17 +231,6 @@ class FrigateApp:
        migrate_db.close()
        # a root frigate service creates these as root; wal and shm recreated
        # later in the run are realigned by the per-boot /config sweep
        for db_file in (
            self.config.database.path,
            f"{self.config.database.path}-wal",
            f"{self.config.database.path}-shm",
            self.config.database.path.replace("frigate.db", "backup.db"),
        ):
            if os.path.exists(db_file):
                chown_to_runtime(db_file)
    def init_go2rtc(self) -> None:
        for proc in psutil.process_iter(["pid", "name"]):
            if proc.info["name"] == "go2rtc":
@@ -363,26 +350,6 @@ class FrigateApp:
        )
        self.dispatcher.profile_manager = self.profile_manager
    def ensure_detector_dependencies(self) -> None:
        """Install runtimes for the configured detector types.
        Runs before any detector process starts so one install serves them
        all and the user site is on sys.path before the forkserver copies it.
        A failure is logged and startup continues; the detector process then
        fails on its own with a clear import error.
        """
        detector_types = {
            spec.detector
            for model in self.config.models
            for spec in self.config.devices_for_model(model)
        }
        for detector_type in sorted(detector_types):
            try:
                api_types[detector_type].ensure_dependencies()
            except RuntimeDependencyError as err:
                logger.error("Unable to prepare the %s runtime: %s", detector_type, err)
    def start_detectors(self) -> None:
        model_cameras: dict[SceneEnum, list[str]] = {
            model.scene: [] for model in self.config.models
@@ -612,7 +579,6 @@ class FrigateApp:
        # Ensure global state.
        self.ensure_dirs()
        self.ensure_detector_dependencies()
        # Set soft file limits.
        set_file_limit()
@@ -61,11 +61,6 @@ class CameraState:
        # face/LPR pipelines when using a model without built-in detection.
        self.face_recognition_min_obj_area: int = 0
        self.lpr_min_obj_area: int = 0
        self.lp_objects = {
            label
            for label, attributes in self.model.attributes_map.items()
            if "license_plate" in attributes
        }
        if (
            self.camera_config.face_recognition.enabled
@@ -452,7 +447,7 @@ class CameraState:
                and obj_area >= self.face_recognition_min_obj_area
                and updated_obj.obj_data.get("sub_label") is None
            ) or (
-                obj_label in self.lp_objects
+                obj_label in ("car", "motorcycle")
                and self.lpr_min_obj_area > 0
                and obj_area >= self.lpr_min_obj_area
                and updated_obj.obj_data.get("sub_label") is None
@@ -548,7 +543,7 @@ class CameraState:
                    current_best.thumbnail_data is not None
                    and obj.thumbnail_data is not None
                    and is_better_thumbnail(
-                        obj.thumbnail_attributes,
+                        object_type,
                        current_best.thumbnail_data,
                        obj.thumbnail_data,
                        self.camera_config.frame_shape,
@@ -430,7 +430,6 @@ class WebPushClient(Communicator):
        # Don't notify if message is an update and important fields don't have an update
        if (
            state == "update"
            and payload["before"]["severity"] == payload["after"]["severity"]
            and len(payload["before"]["data"]["objects"])
            == len(payload["after"]["data"]["objects"])
            and len(payload["before"]["data"]["zones"])
@@ -78,14 +78,11 @@ class AuthConfig(FrigateBaseModel):
                    f"Invalid role name '{role}'. Must be alphanumeric with underscores."
                )
-        # 'none' is the deny sentinel for proxy.default_role, where it is matched
+        # Ensure 'admin' and 'viewer' are not used as custom role names
-        # case-insensitively, so every casing of it has to be reserved here
+        reserved_roles = {"admin", "viewer"}
-        used_reserved = sorted(
+        if v.keys() & reserved_roles:
            r for r in v if r in ("admin", "viewer") or r.lower() == "none"
        )
        if used_reserved:
            raise ValueError(
-                f"Reserved role name(s) {', '.join(used_reserved)} cannot be used as custom roles."
+                f"Reserved roles {reserved_roles} cannot be used as custom roles."
            )
        # Ensure no role has an empty camera list
@@ -4,13 +4,7 @@ from pydantic import Field, field_validator
 from ..base import FrigateBaseModel
-__all__ = [
+__all__ = ["ReviewConfig", "DetectionsConfig", "AlertsConfig", "ImageSourceEnum"]
    "ReviewConfig",
    "DetectionsConfig",
    "AlertsConfig",
    "ImageSourceEnum",
    "ReviewResponseStyleEnum",
 ]
 class ImageSourceEnum(str, Enum):
@@ -20,15 +14,6 @@ class ImageSourceEnum(str, Enum):
    recordings = "recordings"
 class ReviewResponseStyleEnum(str, Enum):
    """Writing style presets for GenAI review descriptions."""
    default = "default"
    natural = "natural"
    concise = "concise"
    detailed = "detailed"
 DEFAULT_ALERT_OBJECTS = ["person", "car"]
@@ -153,11 +138,6 @@ class GenAIReviewConfig(FrigateBaseModel):
        description="Preferred language to request from the GenAI provider for generated responses.",
        default=None,
    )
    response_style: ReviewResponseStyleEnum = Field(
        default=ReviewResponseStyleEnum.default,
        title="Response style",
        description="Writing style preset for generated review descriptions. Presets adjust the tone and level of detail of the user-facing title, summary, and scene description; 'default' leaves the built-in prompt unchanged.",
    )
    activity_context_prompt: str = Field(
        default="""### Normal Activity Indicators (Level 0)
 - Known/verified people in any zone at any time
@@ -43,7 +43,7 @@ class ProxyConfig(FrigateBaseModel):
    default_role: str | None = Field(
        default="viewer",
        title="Default role",
-        description="Default role assigned to proxy-authenticated users when no role mapping applies. Set to 'none' to deny access to unmapped users.",
+        description="Default role assigned to proxy-authenticated users when no role mapping applies.",
    )
    separator: str | None = Field(
        default=",",
@@ -51,16 +51,6 @@ class ProxyConfig(FrigateBaseModel):
        description="Character used to split multiple values provided in proxy headers.",
    )
    @field_validator("default_role", mode="before")
    @classmethod
    def normalize_deny_sentinel(cls, v):
        # Fail closed on capitalization: an unnormalized "None" would miss the
        # sentinel and fall back to viewer, granting the access it was meant to
        # deny. Other role names stay case-sensitive.
        if isinstance(v, str) and v.strip().lower() == "none":
            return "none"
        return v
    @field_validator("separator", mode="before")
    @classmethod
    def validate_separator_length(cls, v):
@@ -53,11 +53,7 @@ DEFAULT_ATTRIBUTE_LABEL_MAP = {
        "ups",
        "usps",
    ],
    "truck": ["license_plate"],
    "garbage_truck": ["license_plate"],
    "motorcycle": ["license_plate"],
    "bus": ["license_plate"],
    "school_bus": ["license_plate"],
 }
 ATTRIBUTE_LABEL_DISPLAY_MAP = {
    "amazon": "Amazon",
@@ -1290,7 +1290,7 @@ class LicensePlateProcessingMixin:
                and obj_data.get("label") != "license_plate"
            ):
                logger.debug(
-                    f"{camera}: Not a processing license plate for {obj_data.get('label', 'unknown')}."
+                    f"{camera}: Not a processing license plate for non car/motorcycle object."
                )
                return
@@ -1367,7 +1367,7 @@ class LicensePlateProcessingMixin:
                if not license_plate:
                    logger.debug(
-                        f"{camera}: Detected no license plates for {obj_data.get('label', 'unknown')} object."
+                        f"{camera}: Detected no license plates for car/motorcycle object."
                    )
                    return
@@ -601,7 +601,6 @@ def run_analysis(
        genai_config.preferred_language,
        genai_config.debug_save_thumbnails,
        genai_config.activity_context_prompt,
        genai_config.response_style,
    )
    review_inference_speed.update(datetime.datetime.now().timestamp() - start)
@@ -1,11 +1,9 @@
 import logging
 from abc import ABC, abstractmethod
 from typing import ClassVar
 import numpy as np
 from frigate.detectors.detector_config import BaseDetectorConfig, ModelTypeEnum
 from frigate.util.runtime_deps import RuntimeManifest, activate, ensure_installed
 logger = logging.getLogger(__name__)
@@ -14,10 +12,6 @@ class DetectionApi(ABC):
    type_key: str
    supported_models: list[ModelTypeEnum]
    # pinned SDK artifacts that are installed at runtime instead of being
    # shipped in the image; None when the runtime is already available
    runtime_manifest: ClassVar[RuntimeManifest | None] = None
    @abstractmethod
    def __init__(self, detector_config: BaseDetectorConfig):
        self.detector_config = detector_config
@@ -29,23 +23,6 @@ class DetectionApi(ABC):
    def detect_raw(self, tensor_input):
        pass
    @classmethod
    def ensure_dependencies(cls) -> None:
        """Download and install this detector's runtime if it is not present.
        Runs once in the main process before detector processes start, so a
        single install serves every process and the user site is on sys.path
        before it is inherited.
        """
        if cls.runtime_manifest is not None:
            ensure_installed(cls.runtime_manifest)
    @classmethod
    def activate_dependencies(cls) -> None:
        """Make the installed runtime importable in the current process."""
        if cls.runtime_manifest is not None:
            activate(cls.runtime_manifest)
    def calculate_grids_strides(self, expanded=True) -> None:
        grids = []
        expanded_strides = []
@@ -25,31 +25,25 @@ def is_arm64_platform() -> bool:
    return machine in ("aarch64", "arm64", "armv8", "armv7l")
-def get_ort_session_options(model_type: str | None = None) -> ort.SessionOptions | None:
+def get_ort_session_options(
    is_complex_model: bool = False,
 ) -> ort.SessionOptions | None:
    """Get ONNX Runtime session options with appropriate settings.
    Args:
-        model_type: Model being loaded, used to pin its graph optimization level.
+        is_complex_model: Whether the model needs basic optimization to avoid graph fusion issues.
    Returns:
-        SessionOptions with a pinned optimization level, or None for default settings.
+        SessionOptions with appropriate optimization level, or None for default settings.
    """
-    # Import here to avoid circular imports
+    if is_complex_model:
-    from frigate.embeddings.types import EnrichmentModelTypeEnum
+        sess_options = ort.SessionOptions()
        sess_options.graph_optimization_level = (
            ort.GraphOptimizationLevel.ORT_ENABLE_BASIC
        )
        return sess_options
-    if model_type == EnrichmentModelTypeEnum.jina_v2.value:
+    return None
        # below EXTENDED the CUDA EP returns an identical vector for every image,
        # and ORT_ENABLE_ALL fails to build on CPU with a SimplifiedLayerNormFusion error
        level = ort.GraphOptimizationLevel.ORT_ENABLE_EXTENDED
    elif model_type == EnrichmentModelTypeEnum.jina_v1.value:
        # aggressive optimizations create or expect nodes that don't exist
        level = ort.GraphOptimizationLevel.ORT_ENABLE_BASIC
    else:
        return None
    sess_options = ort.SessionOptions()
    sess_options.graph_optimization_level = level
    return sess_options
 # Import OpenVINO only when needed to avoid circular dependencies
@@ -121,6 +115,21 @@ class BaseModelRunner(ABC):
 class ONNXModelRunner(BaseModelRunner):
    """Run ONNX models using ONNX Runtime."""
    @staticmethod
    def is_cpu_complex_model(model_type: str) -> bool:
        """Check if model needs basic optimization level to avoid graph fusion issues.
        Some models (like Jina-CLIP) have issues with aggressive optimizations like
        SimplifiedLayerNormFusion that create or expect nodes that don't exist.
        """
        # Import here to avoid circular imports
        from frigate.embeddings.types import EnrichmentModelTypeEnum
        return model_type in [
            EnrichmentModelTypeEnum.jina_v1.value,
            EnrichmentModelTypeEnum.jina_v2.value,
        ]
    @staticmethod
    def is_migraphx_complex_model(model_type: str) -> bool:
        # Import here to avoid circular imports
@@ -314,34 +323,17 @@ class OpenVINOModelRunner(BaseModelRunner):
        if device in ["GPU", "AUTO", "NPU"]:
            self.ov_core.set_property(device, {"PERFORMANCE_HINT": "LATENCY"})
        if device in ["GPU", "AUTO"]:
            try:
                self.ov_core.set_property("GPU", {"GPU_QUEUE_THROTTLE": "LOW"})
            except Exception as e:
                logger.debug(f"GPU_QUEUE_THROTTLE not supported: {e}")
        # Some keys must be passed as compile-time config so that it can be caught
        compile_config = {}
        if device == "NPU" and OpenVINOModelRunner.is_detection_model(model_type):
-            compile_config["NPU_TURBO"] = "YES"
+            try:
                self.ov_core.set_property(device, {"NPU_TURBO": "YES"})
            except Exception as e:
                logger.debug(f"NPU_TURBO not supported by driver: {e}")
        # Compile model under the shared lock
        with _OPENVINO_LOCK:
-            try:
+            self.compiled_model = self.ov_core.compile_model(
-                self.compiled_model = self.ov_core.compile_model(
+                model=model_path, device_name=device
-                    model=model_path, device_name=device, config=compile_config
+            )
                )
            except RuntimeError as e:
                if not compile_config:
                    raise
                logger.debug(
                    f"Failed to compile with {compile_config}, retrying without: {e}"
                )
                self.compiled_model = self.ov_core.compile_model(
                    model=model_path, device_name=device
                )
            # Create reusable inference request
            self.infer_request = self.compiled_model.create_infer_request()
@@ -634,7 +626,9 @@ def get_optimized_runner(
    return ONNXModelRunner(
        ort.InferenceSession(
            model_path,
-            sess_options=get_ort_session_options(model_type),
+            sess_options=get_ort_session_options(
                ONNXModelRunner.is_cpu_complex_model(model_type)
            ),
            providers=providers,
            provider_options=options,
        ),
@@ -10,28 +10,11 @@ from frigate.const import MODEL_CACHE_DIR
 from frigate.detectors.detection_api import DetectionApi
 from frigate.detectors.detector_config import BaseDetectorConfig, ModelTypeEnum
 from frigate.util.model import post_process_yolo
 from frigate.util.runtime_deps import Artifact, ArtifactKind, RuntimeManifest
 logger = logging.getLogger(__name__)
 DETECTOR_KEY = "axengine"
 # The AXEngine python package is installed at first start rather than shipped
 # in the image; its native libraries are bind mounted from the host.
 AXENGINE_VERSION = "0.1.3"
 AXENGINE_MANIFEST = RuntimeManifest(
    name=DETECTOR_KEY,
    version=AXENGINE_VERSION,
    artifacts=(
        Artifact(
            url=f"https://github.com/AXERA-TECH/pyaxengine/releases/download/{AXENGINE_VERSION}-frigate/axengine-{AXENGINE_VERSION}-py3-none-any.whl",
            sha256="e995b8a887b067dc3456512aae2fa9c84f70e708c28b11caf184efdc254c64ae",
            kind=ArtifactKind.wheel,
        ),
    ),
    import_check="axengine",
 )
 supported_models = {
    ModelTypeEnum.yologeneric: "frigate-yolov9-.*$",
 }
@@ -51,18 +34,12 @@ class AxengineDetectorConfig(BaseDetectorConfig):
 class Axengine(DetectionApi):
    type_key = DETECTOR_KEY
    runtime_manifest = AXENGINE_MANIFEST
    def __init__(self, config: AxengineDetectorConfig):
        self.activate_dependencies()
        try:
            import axengine as axe
        except ModuleNotFoundError:
-            raise ImportError(
+            raise ImportError("AXEngine is not installed.") from None
                "AXEngine is not installed. Frigate installs it at startup when an "
                "axengine detector is configured; check the startup log for errors."
            ) from None
        logger.info("__init__ axengine")
        super().__init__(config)
@@ -16,14 +16,6 @@ from frigate.detectors.detector_config import (
    BaseDetectorConfig,
 )
 from frigate.object_detection.util import RequestStore, ResponseStore
 from frigate.util.runtime_deps import (
    ArchiveDest,
    ArchiveMapping,
    Artifact,
    ArtifactKind,
    RuntimeManifest,
    find_tool,
 )
 logger = logging.getLogger(__name__)
@@ -60,58 +52,11 @@ H8L_DEFAULT_MODEL = "yolov6n.hef"
 H8_DEFAULT_URL = "https://hailo-model-zoo.s3.eu-west-2.amazonaws.com/ModelZoo/Compiled/v2.14.0/hailo8/yolov6n.hef"
 H8L_DEFAULT_URL = "https://hailo-model-zoo.s3.eu-west-2.amazonaws.com/ModelZoo/Compiled/v2.14.0/hailo8l/yolov6n.hef"
 # HailoRT is installed at first start rather than shipped in the image. The
 # tarball carries libhailort and hailortcli, the wheel the python bindings.
 HAILORT_VERSION = "4.21.0"
 HAILORT_RELEASE = (
    f"https://github.com/frigate-nvr/hailort/releases/download/v{HAILORT_VERSION}"
 )
 HAILORT_MAPPINGS = (
    ArchiveMapping("rootfs/usr/local/lib/", ArchiveDest.lib),
    ArchiveMapping("rootfs/usr/local/bin/", ArchiveDest.bin),
 )
 HAILORT_MANIFEST = RuntimeManifest(
    name=DETECTOR_KEY,
    version=HAILORT_VERSION,
    artifacts=(
        Artifact(
            url=f"{HAILORT_RELEASE}/hailort-debian12-amd64.tar.gz",
            sha256="0a57ac5f7cc8c2c3668133189d9285b55f498e8cb219797e203f6f5015fec4b3",
            kind=ArtifactKind.archive,
            mappings=HAILORT_MAPPINGS,
            machines=("x86_64",),
        ),
        Artifact(
            url=f"{HAILORT_RELEASE}/hailort-debian12-arm64.tar.gz",
            sha256="dd840548eb5d0d147c99aee2cb013d39d64be09c5bc63061171fcfacf4547b3f",
            kind=ArtifactKind.archive,
            mappings=HAILORT_MAPPINGS,
            machines=("aarch64",),
        ),
        Artifact(
            url=f"{HAILORT_RELEASE}/hailort-{HAILORT_VERSION}-cp311-cp311-linux_x86_64.whl",
            sha256="8112a973ab48095399b29d883f31987828df5861b8553f614c89f098a67b3fb6",
            kind=ArtifactKind.wheel,
            machines=("x86_64",),
        ),
        Artifact(
            url=f"{HAILORT_RELEASE}/hailort-{HAILORT_VERSION}-cp311-cp311-linux_aarch64.whl",
            sha256="658432a43573280d472f6402d7934669effe7f163ba3dffa31c50bbeeaa7c01d",
            kind=ArtifactKind.wheel,
            machines=("aarch64",),
        ),
    ),
    preload=(f"libhailort.so.{HAILORT_VERSION}",),
    import_check="hailo_platform",
 )
 def detect_hailo_arch():
    try:
        result = subprocess.run(
-            [find_tool("hailortcli"), "fw-control", "identify"],
+            ["hailortcli", "fw-control", "identify"], capture_output=True, text=True
            capture_output=True,
            text=True,
        )
        if result.returncode != 0:
            logger.error(f"Inference error: {result.stderr}")
@@ -151,10 +96,7 @@ class HailoAsyncInference:
                VDevice,
            )
        except ModuleNotFoundError:
-            raise ImportError(
+            pass
                "HailoRT is not installed. Frigate installs it at startup when a "
                "Hailo detector is configured; check the startup log for errors."
            ) from None
        self.input_store = input_store
        self.output_store = output_store
@@ -260,11 +202,9 @@ class HailoAsyncInference:
 # ----------------- HailoDetector Class ----------------- #
 class HailoDetector(DetectionApi):
    type_key = DETECTOR_KEY
    runtime_manifest = HAILORT_MANIFEST
    def __init__(self, detector_config: "HailoDetectorConfig"):
        global ARCH
        self.activate_dependencies()
        ARCH = detect_hailo_arch()
        self.cache_dir = MODEL_CACHE_DIR
        self.device_type = detector_config.device
@@ -18,58 +18,11 @@ from frigate.detectors.detector_config import (
 )
 from frigate.util.file import FileLock
 from frigate.util.model import xyxy_to_xywh_for_nms
 from frigate.util.runtime_deps import (
    ArchiveDest,
    ArchiveMapping,
    Artifact,
    ArtifactKind,
    RuntimeManifest,
 )
 logger = logging.getLogger(__name__)
 DETECTOR_KEY = "memryx"
 # The MemryX SDK is installed at first start rather than shipped in the image.
 # The release archive holds the python package with its compiled extensions
 # and, per architecture, the shared libraries they link against. libmemx has
 # no SONAME, so the libraries are resolved through LD_LIBRARY_PATH.
 MEMRYX_VERSION = "2.1.0"
 MEMRYX_ARCHIVE_ROOT = f"mx_accl_frigate-{MEMRYX_VERSION}/memryx/"
 MEMRYX_LIBS = ("libmemx.so*", "libmx_accl.so*")
 MEMRYX_MANIFEST = RuntimeManifest(
    name=DETECTOR_KEY,
    version=MEMRYX_VERSION,
    artifacts=(
        Artifact(
            url=f"https://github.com/memryx/mx_accl_frigate/archive/refs/tags/v{MEMRYX_VERSION}.zip",
            sha256="54d1971dee54688541561b7bd9136342be51707b68c11a2a5e575fa19e69bc51",
            kind=ArtifactKind.archive,
            filename=f"mx_accl_frigate-{MEMRYX_VERSION}.zip",
            mappings=(
                ArchiveMapping(
                    MEMRYX_ARCHIVE_ROOT, ArchiveDest.site_packages, subdir="memryx"
                ),
                ArchiveMapping(
                    f"{MEMRYX_ARCHIVE_ROOT}x86/",
                    ArchiveDest.lib,
                    include=MEMRYX_LIBS,
                    machines=("x86_64",),
                ),
                ArchiveMapping(
                    f"{MEMRYX_ARCHIVE_ROOT}arm/",
                    ArchiveDest.lib,
                    include=MEMRYX_LIBS,
                    machines=("aarch64",),
                ),
            ),
        ),
    ),
    preload=("libmemx.so", "libmx_accl.so.2"),
    import_check="memryx",
    needs_ld_library_path=True,
 )
 # Configuration class for model settings
 class ModelConfig(BaseModel):
@@ -103,20 +56,17 @@ class MemryXDetector(DetectionApi):
        ModelTypeEnum.yologeneric,  # Treated as yolov9 in MemryX implementation
        ModelTypeEnum.yolox,
    ]
    runtime_manifest = MEMRYX_MANIFEST
    def __init__(self, detector_config):
        """Initialize MemryX detector with the provided configuration."""
        self.activate_dependencies()
        try:
            # Import MemryX SDK
            from memryx import AsyncAccl
        except ModuleNotFoundError:
            raise ImportError(
-                "MemryX SDK is not installed. Frigate installs it at startup when "
+                "MemryX SDK is not installed. Install it and set up MIX environment."
                "a MemryX detector is configured; check the startup log for errors."
            ) from None
            return
        # Initialize stop_event as None, will be set later by set_stop_event()
        self.stop_event = None
@@ -128,7 +78,7 @@ class MemryXDetector(DetectionApi):
            detector_config.model.model_type = model_cfg.model_type
        else:
            logger.info(
-                "model_type not set in config, defaulting to yolonas for MemryX"
+                "model_type not set in config — defaulting to yolonas for MemryX."
            )
            detector_config.model.model_type = ModelTypeEnum.yolonas
@@ -104,7 +104,6 @@ class GenAIClient:
        preferred_language: str | None,
        debug_save: bool,
        activity_context_prompt: str,
        response_style: str = "default",
    ) -> ReviewMetadata | None:
        """Generate a description for the review item activity."""
        context_prompt = build_review_description_prompt(
@@ -113,7 +112,6 @@ class GenAIClient:
            concerns,
            preferred_language,
            activity_context_prompt,
            response_style,
        )
        logger.debug(
@@ -16,48 +16,6 @@ from frigate.config.ui import UnitSystemEnum
 from frigate.data_processing.post.types import ReviewMetadata
 from frigate.models import Event
 # Base guidance per response field. `observations` is a reasoning scaffold,
 # not user-facing, so style presets never override it.
 REVIEW_DESCRIPTION_FIELD_GUIDELINES: dict[str, str] = {
    "observations": "Include the very start of the activity — for example, a vehicle entering the frame or pulling into the driveway — even if it lasts only a few frames and the rest of the clip is dominated by a longer activity. Include each arrival, departure, object handled, and notable change in position or state. Each item is a single concrete fact written as a complete sentence.",
    "scene": 'Describe how the sequence begins, then the progression of events — all significant movements and actions in order. For example, if a vehicle arrives and then a person exits, describe both sequentially. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name — do not replace them with generic terms. For unnamed objects (e.g., "person", "car"), refer to them naturally with articles (e.g., "a person", "the car"). Your description should align with and support the threat level you assign.',
    "title": "Name the primary activity across the observations, together with the location. An activity is what is being done with objects, tools, or surfaces; locomotion through the scene qualifies as the activity only when no other interaction is observed. For named subjects, always use their name. For unnamed objects, refer to them naturally with articles.",
    "shortSummary": "Briefly summarize the primary activity across the observations.",
    "potential_threat_level": "Must be consistent with your scene description and the activity patterns above.",
 }
 # Style presets keyed by ReviewResponseStyleEnum value. Presets replace the
 # base guidance rather than append to it, so the prompt never carries
 # competing style instructions.
 REVIEW_RESPONSE_STYLES: dict[str, dict[str, str]] = {
    "natural": {
        "scene": 'Recount what happened the way a person would describe it to a neighbor, in plain everyday language: how the sequence begins, then each significant movement and action in the order it happens. Use flowing sentences that connect related actions, written the way people actually talk rather than like a surveillance report. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name rather than a generic term. Refer to unnamed objects naturally with articles. Stay factual, and keep the description consistent with the threat level you assign.',
        "title": 'Write the title as a short, sentence-case headline in present tense: the subject, then what they do, phrased the way you would text it to the homeowner. Describe only the action you see; do not assign the person a role or purpose that is not visibly indicated by a uniform, a marked vehicle, or a "(delivery/service)" tag in Objects in Scene. Name the main thing done, not just movement through the scene, unless movement is all that happens. For named subjects, always use their name.',
        "shortSummary": "Sum up the primary activity in one short, natural sentence, as if mentioning it to someone in passing.",
    },
    "concise": {
        "scene": 'Cover each significant movement and action in order using as few short, direct sentences as possible, omitting environmental and cosmetic detail unless it affects the assessment. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name. For unnamed objects, refer to them naturally with articles. Your description should align with and support the threat level you assign.',
        "title": 'Write the title as a terse label of two to four words naming the specific activity observed and where it happened. Do not assign a role or purpose that is not visibly indicated by a uniform, a marked vehicle, or a "(delivery/service)" tag in Objects in Scene. For named subjects, always use their name.',
        "shortSummary": "Summarize the primary activity in one short sentence.",
    },
    "detailed": {
        "scene": 'Describe how the sequence begins, then the progression of events — all significant movements and actions in order, including the specifics that best identify the subjects: colors, clothing, carried items, positions, and paths of movement, plus environmental details like lighting changes when they stand out. Favor the most identifying details over exhaustive coverage, and keep every added detail observational rather than speculative. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name rather than a generic term. For unnamed objects, refer to them naturally with articles. Your description should align with and support the threat level you assign.',
        "title": 'Write the title as a specific description of who did what and where, in under roughly twelve words, including the most distinguishing visible detail of the subject, such as clothing or vehicle color. Do not assign a role or purpose that is not visibly indicated by a uniform, a marked vehicle, or a "(delivery/service)" tag in Objects in Scene. Name the main thing done, not just movement through the scene, unless movement is all that happens. For named subjects, always use their name.',
        "shortSummary": "Briefly summarize the primary activity across the observations, including the most identifying visible detail, such as vehicle color or clothing.",
    },
 }
 def get_review_field_guidelines(response_style: str = "default") -> dict[str, str]:
    """Return per-field response guidance with the style preset applied.
    "default" (or an unknown value) applies no overrides.
    """
    return {
        **REVIEW_DESCRIPTION_FIELD_GUIDELINES,
        **REVIEW_RESPONSE_STYLES.get(response_style, {}),
    }
 def build_review_description_prompt(
    review_data: dict[str, Any],
@@ -65,7 +23,6 @@ def build_review_description_prompt(
    concerns: list[str],
    preferred_language: str | None,
    activity_context_prompt: str,
    response_style: str = "default",
 ) -> str:
    """Build the prompt for review activity description generation."""
@@ -92,8 +49,6 @@ def build_review_description_prompt(
        else:
            return "\n- (No objects detected)"
    fields = get_review_field_guidelines(response_style)
    return f"""
 Your task is to analyze a sequence of images taken in chronological order from a security camera.
@@ -120,11 +75,11 @@ When forming your description:
 ## Response Field Guidelines
 Respond with a JSON object matching the provided schema. Field-specific guidance:
- `observations`: {fields["observations"]}
+- `observations`: Include the very start of the activity — for example, a vehicle entering the frame or pulling into the driveway — even if it lasts only a few frames and the rest of the clip is dominated by a longer activity. Include each arrival, departure, object handled, and notable change in position or state. Each item is a single concrete fact written as a complete sentence.
- `scene`: {fields["scene"]}
+- `scene`: Describe how the sequence begins, then the progression of events — all significant movements and actions in order. For example, if a vehicle arrives and then a person exits, describe both sequentially. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name — do not replace them with generic terms. For unnamed objects (e.g., "person", "car"), refer to them naturally with articles (e.g., "a person", "the car"). Your description should align with and support the threat level you assign.
- `title`: {fields["title"]}
+- `title`: Name the primary activity across the observations, together with the location. An activity is what is being done with objects, tools, or surfaces; locomotion through the scene qualifies as the activity only when no other interaction is observed. For named subjects, always use their name. For unnamed objects, refer to them naturally with articles.
- `shortSummary`: {fields["shortSummary"]}
+- `shortSummary`: Briefly summarize the primary activity across the observations.
- `potential_threat_level`: {fields["potential_threat_level"]}
+- `potential_threat_level`: Must be consistent with your scene description and the activity patterns above.
 {get_concern_prompt()}
 ## Sequence Details
@@ -353,23 +353,9 @@ class ObjectDetectProcess:
        logging.info("Detection process has exited...")
    def start_or_restart(self) -> None:
        if (self.detect_process is not None) and self.detect_process.is_alive():
            logging.info("Waiting for detection process to exit gracefully...")
            self.detect_process.join(timeout=30)
            if self.detect_process.exitcode is None:
                # detection_start is set only after detection_queue.get()
                # returns. If it was reset during the grace period, the process
                # recovered and may be waiting on the shared queue again.
                if self.detection_start.value == 0.0:  # type: ignore[attr-defined]
                    logging.info("Detection process recovered before restart")
                    return
                logging.info("Detection process didn't exit. Force killing...")
                self.detect_process.kill()
                self.detect_process.join()
            logging.info("Detection process has exited...")
        self.detection_start.value = 0.0  # type: ignore[attr-defined]
        if (self.detect_process is not None) and self.detect_process.is_alive():
            self.stop()
        # Async path for MemryX
        if self.detector_config.type == "memryx":
@@ -23,7 +23,6 @@ from frigate.ffmpeg_presets import (
 )
 from frigate.models import Previews
 from frigate.util.image import copy_yuv_to_position, get_blank_yuv_frame, get_yuv_crop
 from frigate.util.ownership import chown_to_runtime
 logger = logging.getLogger(__name__)
@@ -186,7 +185,6 @@ class FFMpegConverter(threading.Thread):
        if p.returncode == 0:
            logger.debug("successfully saved preview")
            chown_to_runtime(self.path)
            self.requestor.send_data(
                INSERT_PREVIEW,
                {
@@ -15,7 +15,6 @@ from pathlib import Path
 from typing import Any
 import pytz  # type: ignore[import-untyped]
 from pathvalidate import sanitize_filename
 from peewee import DoesNotExist
 from frigate.config import FfmpegConfig, FrigateConfig
@@ -35,7 +34,6 @@ from frigate.ffmpeg_presets import (
 )
 from frigate.models import Export, Previews, Recordings, ReviewSegment
 from frigate.util.ffmpeg import run_ffmpeg_with_progress
 from frigate.util.ownership import chown_to_runtime
 from frigate.util.time import is_current_hour
 logger = logging.getLogger(__name__)
@@ -206,22 +204,6 @@ class PlaybackSourceEnum(str, Enum):
    preview = "preview"
 EXPORT_FILE_NAME_MAX_BYTES = 255
 def export_video_path(name: str, export_id: str) -> str:
    """Path an export's video is stored at once the user has named it.
    The id suffix keeps the path unique when two exports share a name, and
    keeps the result a single path component whatever the user typed.
    """
    suffix = f"_{export_id.split('_')[-1]}.mp4"
    budget = EXPORT_FILE_NAME_MAX_BYTES - len(suffix.encode())
    stem = sanitize_filename(name).encode()[:budget].decode(errors="ignore")
    return os.path.join(EXPORT_DIR, f"{stem.strip('. ') or 'export'}{suffix}")
 class RecordingExporter(threading.Thread):
    """Exports a specific set of recordings for a camera to storage as a single file."""
@@ -935,14 +917,8 @@ class RecordingExporter(threading.Thread):
            "%Y%m%d_%H%M%S"
        )
        cleaned_export_id = self.export_id.split("_")[-1]
-
+        video_path = f"{EXPORT_DIR}/{self.camera}_{filename_start_datetime}-{filename_end_datetime}_{cleaned_export_id}.mp4"
        if self.user_provided_name:
            video_path = export_video_path(self.user_provided_name, self.export_id)
        else:
            video_path = f"{EXPORT_DIR}/{self.camera}_{filename_start_datetime}-{filename_end_datetime}_{cleaned_export_id}.mp4"
        thumb_path = self.save_thumbnail(self.export_id)
        if thumb_path:
            chown_to_runtime(thumb_path)
        export_values = {
            Export.id: self.export_id,
@@ -1017,7 +993,6 @@ class RecordingExporter(threading.Thread):
            Path(thumb_path).unlink(missing_ok=True)
            return
        else:
            chown_to_runtime(video_path)
            self._emit_progress("finalizing", 100.0)
            Export.update({Export.in_progress: False}).where(
                Export.id == self.export_id
@@ -43,7 +43,6 @@ from frigate.const import (
 from frigate.models import Recordings, ReviewSegment
 from frigate.review.types import SeverityEnum
 from frigate.util.media import get_keyframe_offsets
 from frigate.util.ownership import chown_to_runtime
 from frigate.util.services import get_video_properties
 logger = logging.getLogger(__name__)
@@ -929,11 +928,6 @@ class RecordingMaintainer(threading.Thread):
        )
        os.makedirs(directory, exist_ok=True)
        # own every level makedirs creates so the host user can prune recordings
        level = directory
        while level != RECORD_DIR:
            chown_to_runtime(level)
            level = os.path.dirname(level)
        # file will be in utc due to path_time being in utc
        file_name = f"{path_time.strftime('%M.%S.mp4')}"
@@ -972,8 +966,6 @@ class RecordingMaintainer(threading.Thread):
                        f"Copied {file_path} in {datetime.datetime.now().timestamp() - start_frame} seconds."
                    )
                chown_to_runtime(file_path)
                try:
                    # get the segment size of the cache file
                    # file without faststart is same size
@@ -11,7 +11,6 @@ from typing import Any
 from frigate.comms.inter_process import InterProcessRequestor
 from frigate.config import FrigateConfig
 from frigate.const import FREQUENCY_STATS_POINTS
 from frigate.stats.hardware import HardwareStats
 from frigate.stats.prometheus import update_metrics
 from frigate.stats.util import stats_snapshot
 from frigate.types import StatsTrackingTypes
@@ -33,7 +32,7 @@ class StatsEmitter(threading.Thread):
        self.config = config
        self.stats_tracking = stats_tracking
        self.stop_event = stop_event
-        self.hardware_stats = HardwareStats(config)
+        self.hwaccel_errors: dict[str, float] = {}
        self.stats_history: list[dict[str, Any]] = []
        # create communication for stats
@@ -45,7 +44,7 @@ class StatsEmitter(threading.Thread):
            return self.stats_history[-1]
        else:
            stats = stats_snapshot(
-                self.config, self.stats_tracking, self.hardware_stats
+                self.config, self.stats_tracking, self.hwaccel_errors
            )
            self.stats_history.append(stats)
            return stats
@@ -135,7 +134,7 @@ class StatsEmitter(threading.Thread):
            logger.debug("Starting stats collection")
            stats = stats_snapshot(
-                self.config, self.stats_tracking, self.hardware_stats
+                self.config, self.stats_tracking, self.hwaccel_errors
            )
            self.stats_history.append(stats)
            self.stats_history = self.stats_history[-MAX_STATS_POINTS:]
@@ -145,5 +144,4 @@ class StatsEmitter(threading.Thread):
            logger.debug("Finished stats collection")
        self.hardware_stats.stop()
        logger.info("Exiting stats emitter...")
@@ -1,474 +0,0 @@
 """Config driven hardware usage collection for stats."""
 import logging
 import os
 import time
 from collections.abc import Callable
 from concurrent.futures import Future, ThreadPoolExecutor, wait
 from dataclasses import dataclass, field
 from functools import cache, partial
 from glob import glob
 from typing import Any
 from frigate.config import FrigateConfig
 from frigate.config.camera.updater import (
    CameraConfigUpdateEnum,
    CameraConfigUpdateSubscriber,
 )
 from frigate.config.classification import SemanticSearchModelEnum
 from frigate.const import FFMPEG_HWACCEL_AMF, FFMPEG_HWACCEL_VULKAN
 from frigate.detectors.hardware import DEV_ROOT, hardware_prober
 from frigate.util.services import (
    get_amd_gpu_stats,
    get_axcl_npu_stats,
    get_cpu_stats,
    get_hailo_temps,
    get_intel_gpu_stats,
    get_jetson_stats,
    get_nvidia_gpu_stats,
    get_openvino_npu_stats,
    get_rockchip_gpu_stats,
    get_rockchip_npu_stats,
    is_vaapi_amd_driver,
 )
 logger = logging.getLogger(__name__)
 HARDWARE_ERROR_COOLDOWN_SECONDS = 3600
 POLL_TIMEOUT_SECONDS = 10
 # hardware names polled here, in the order used to resolve a generic GPU demand
 GPU_HARDWARE_KEYS = {
    "onnx:nvidia": "nvidia",
    "tensorrt": "jetson",
    "onnx:amd": "amd_gpu",
    "openvino:GPU": "intel_gpu",
    "rknn": "rockchip",
 }
@dataclass
 class HardwarePollResult:
    """Usage entries from one hardware poll, split by stats bucket."""
    gpu: dict[str, dict[str, Any]] = field(default_factory=dict)
    npu: dict[str, dict[str, Any]] = field(default_factory=dict)
    ok: bool = True
@cache
 def _is_amd_vaapi() -> bool:
    """Cached vaapi driver check, the driver cannot change at runtime."""
    return is_vaapi_amd_driver()
 def _present_hardware() -> set[str]:
    return {hardware.key for hardware in hardware_prober.probe()}
 def _gpu_device_nodes_exist(name: str) -> bool:
    """Whether the GPU's device nodes are visible to this container.
    The prober reads /proc and /sys, which show the host kernel's hardware
    even when a device was not passed into the container, so a GPU is only
    usable when its device nodes exist too.
    """
    if name == "nvidia":
        return bool(glob(f"{DEV_ROOT}/nvidia*"))
    elif name in ("amd_gpu", "intel_gpu"):
        return bool(glob(f"{DEV_ROOT}/dri/*"))
    return True
 def _present_gpu() -> str | None:
    """The hardware name of the first usable GPU found on this system, if any."""
    present = _present_hardware()
    for key, name in GPU_HARDWARE_KEYS.items():
        if key in present and _gpu_device_nodes_exist(name):
            return name
    return None
 def _poll_nvidia(config: FrigateConfig) -> HardwarePollResult:
    nvidia_usage = get_nvidia_gpu_stats()
    if not nvidia_usage:
        return HardwarePollResult(
            gpu={"nvidia-gpu": {"vendor": "nvidia", "gpu": "", "mem": ""}}, ok=False
        )
    gpu: dict[str, dict[str, Any]] = {}
    for entry in nvidia_usage.values():
        gpu[entry["name"]] = {
            "vendor": "nvidia",
            "gpu": str(round(float(entry["gpu"]), 2)) + "%",
            "mem": str(round(float(entry["mem"]), 2)) + "%",
            "enc": str(round(float(entry["enc"]), 2)) + "%",
            "dec": str(round(float(entry["dec"]), 2)) + "%",
            "temp": str(entry["temp"]),
        }
    return HardwarePollResult(gpu=gpu)
 def _poll_jetson(config: FrigateConfig) -> HardwarePollResult:
    jetson_usage = get_jetson_stats()
    if not jetson_usage:
        return HardwarePollResult(
            gpu={"jetson-gpu": {"vendor": "nvidia", "gpu": "", "mem": ""}}, ok=False
        )
    return HardwarePollResult(gpu={"jetson-gpu": {"vendor": "nvidia", **jetson_usage}})
 def _poll_intel_gpu(config: FrigateConfig) -> HardwarePollResult:
    intel_usage = get_intel_gpu_stats(config.telemetry.stats.intel_gpu_device)
    if not intel_usage:
        return HardwarePollResult(
            gpu={"intel-gpu": {"vendor": "intel", "gpu": "", "mem": ""}}, ok=False
        )
    gpu: dict[str, dict[str, Any]] = {}
    for entry in intel_usage.values():
        name = entry.pop("name")
        gpu[name] = entry
    return HardwarePollResult(gpu=gpu)
 def _poll_amd_gpu(config: FrigateConfig) -> HardwarePollResult:
    amd_usage = get_amd_gpu_stats()
    if not amd_usage:
        return HardwarePollResult(
            gpu={"amd-vaapi": {"vendor": "amd", "gpu": "", "mem": ""}}, ok=False
        )
    return HardwarePollResult(gpu={"amd-vaapi": {"vendor": "amd", **amd_usage}})
 def _poll_rockchip(config: FrigateConfig) -> HardwarePollResult:
    result = HardwarePollResult()
    rga_usage = get_rockchip_gpu_stats()
    if rga_usage:
        result.gpu["rockchip"] = {"vendor": "rockchip", **rga_usage}
    npu_usage = get_rockchip_npu_stats()
    if npu_usage:
        result.npu["rockchip"] = npu_usage
    result.ok = bool(rga_usage or npu_usage)
    return result
 def _poll_rpi(config: FrigateConfig) -> HardwarePollResult:
    # RPi v4l2m2m is currently not able to get usage stats
    return HardwarePollResult(
        gpu={"rpi-v4l2m2m": {"vendor": "rpi", "gpu": "", "mem": ""}}
    )
 def _poll_intel_npu(config: FrigateConfig) -> HardwarePollResult:
    npu_usage = get_openvino_npu_stats()
    if not npu_usage:
        return HardwarePollResult(ok=False)
    return HardwarePollResult(npu={"openvino": npu_usage})
 def _poll_axengine(config: FrigateConfig) -> HardwarePollResult:
    npu_usage = get_axcl_npu_stats()
    if not npu_usage:
        return HardwarePollResult(ok=False)
    return HardwarePollResult(npu={"axengine": npu_usage})
 POLLERS: dict[str, Callable[[FrigateConfig], HardwarePollResult]] = {
    "nvidia": _poll_nvidia,
    "jetson": _poll_jetson,
    "intel_gpu": _poll_intel_gpu,
    "amd_gpu": _poll_amd_gpu,
    "rockchip": _poll_rockchip,
    "rpi": _poll_rpi,
    "intel_npu": _poll_intel_npu,
    "axengine": _poll_axengine,
 }
 def _hwaccel_hardware(args: str) -> str | None:
    """Map an ffmpeg hwaccel arg string (preset or raw args) to a hardware name."""
    if "cuvid" in args or "nvidia" in args:
        return "nvidia"
    elif "nvmpi" in args or "jetson" in args:
        return "jetson"
    elif "qsv" in args:
        return "intel_gpu"
    elif FFMPEG_HWACCEL_AMF in args or "amf" in args:
        return "amd_gpu"
    elif "vaapi" in args:
        return "amd_gpu" if _is_amd_vaapi() else "intel_gpu"
    elif "preset-rk" in args or "rkmpp" in args:
        return "rockchip"
    elif "v4l2m2m" in args or "rpi" in args:
        return "rpi"
    elif FFMPEG_HWACCEL_VULKAN in args or "vulkan" in args:
        # vulkan is vendor neutral, attribute it to whichever GPU is present
        return _present_gpu()
    return None
 class HardwareStats:
    """Catalogs and polls all hardware relevant to the config."""
    def __init__(self, config: FrigateConfig) -> None:
        self.config = config
        # hardware name -> bound poll function; the catalog of what to monitor
        self._monitored: dict[str, Callable[[], HardwarePollResult]] = {}
        self._errors: dict[str, float] = {}
        self._executor = ThreadPoolExecutor(
            max_workers=8, thread_name_prefix="hw_stats"
        )
        self._config_subscriber = CameraConfigUpdateSubscriber(
            config,
            config.cameras,
            [
                CameraConfigUpdateEnum.add,
                CameraConfigUpdateEnum.remove,
                CameraConfigUpdateEnum.ffmpeg,
                CameraConfigUpdateEnum.audio_transcription,
                CameraConfigUpdateEnum.semantic_search,
                CameraConfigUpdateEnum.face_recognition,
                CameraConfigUpdateEnum.lpr,
            ],
        )
        self.update_config()
    def update_config(self) -> None:
        """Recalculate all hardware that needs to be monitored from the config."""
        names = self._scan_ffmpeg() | self._scan_detectors() | self._scan_enrichments()
        monitored: dict[str, Callable[[], HardwarePollResult]] = {}
        for name in sorted(names):
            if name == "intel_gpu" and not self.config.telemetry.stats.intel_gpu_stats:
                continue
            if name == "amd_gpu" and not self.config.telemetry.stats.amd_gpu_stats:
                continue
            monitored[name] = partial(POLLERS[name], self.config)
        self._monitored = monitored
        logger.debug("Monitoring hardware for stats: %s", list(monitored))
    def update_stats(self, all_stats: dict[str, Any]) -> None:
        """Poll the monitored hardware concurrently and fill usage stats."""
        if self._config_subscriber.check_for_updates():
            self.update_config()
        now = time.monotonic()
        hardware_futures: dict[Future[HardwarePollResult], str] = {}
        for name, poll in self._monitored.items():
            last_error = self._errors.get(name)
            if last_error is not None:
                if now - last_error < HARDWARE_ERROR_COOLDOWN_SECONDS:
                    continue
                self._errors.pop(name, None)
            hardware_futures[self._executor.submit(poll)] = name
        cpu_future = self._executor.submit(get_cpu_stats)
        futures: list[Future[Any]] = [*hardware_futures, cpu_future]
        done, _ = wait(futures, timeout=POLL_TIMEOUT_SECONDS)
        gpu_usages: dict[str, dict[str, Any]] = {}
        npu_usages: dict[str, dict[str, Any]] = {}
        for future, name in hardware_futures.items():
            if future not in done:
                logger.warning("Timed out collecting %s stats", name)
                self._errors[name] = time.monotonic()
                continue
            try:
                result = future.result()
            except Exception:
                logger.exception("Failed to collect %s stats", name)
                self._errors[name] = time.monotonic()
                continue
            gpu_usages.update(result.gpu)
            npu_usages.update(result.npu)
            if not result.ok:
                self._errors[name] = time.monotonic()
        if gpu_usages:
            all_stats["gpu_usages"] = gpu_usages
        if npu_usages:
            all_stats["npu_usages"] = npu_usages
        if cpu_future in done:
            try:
                cpu_stats = cpu_future.result()
            except Exception:
                logger.exception("Failed to collect cpu stats")
            else:
                if cpu_stats:
                    all_stats["cpu_usages"] = cpu_stats
    def stop(self) -> None:
        self._config_subscriber.stop()
        self._executor.shutdown(wait=False, cancel_futures=True)
    def _scan_ffmpeg(self) -> set[str]:
        """Hardware used by camera hwaccel args (presets or raw ffmpeg args)."""
        hwaccel_args: list[str] = []
        for camera in self.config.cameras.values():
            args = camera.ffmpeg.hwaccel_args
            if isinstance(args, list):
                args = " ".join(args)
            if args and args not in hwaccel_args:
                hwaccel_args.append(args)
            for stream_input in camera.ffmpeg.inputs:
                args = stream_input.hwaccel_args
                if isinstance(args, list):
                    args = " ".join(args)
                if args and args not in hwaccel_args:
                    hwaccel_args.append(args)
        names: set[str] = set()
        for args in hwaccel_args:
            name = _hwaccel_hardware(args)
            if name is not None:
                names.add(name)
        return names
    def _scan_detectors(self) -> set[str]:
        """Hardware used by the configured detection models."""
        names: set[str] = set()
        for model in self.config.models:
            for spec in self.config.devices_for_model(model):
                if spec.detector == "rknn":
                    names.add("rockchip")
                elif spec.detector == "axengine":
                    names.add("axengine")
                elif spec.detector == "tensorrt":
                    names.add("jetson")
                elif spec.detector == "openvino":
                    if spec.device == "NPU":
                        names.add("intel_npu")
                    elif spec.device is None or spec.device.startswith("GPU"):
                        names.add("intel_gpu")
                elif spec.detector == "onnx":
                    gpu = _present_gpu()
                    if gpu is not None:
                        names.add(gpu)
        return names
    def _scan_enrichments(self) -> set[str]:
        """Hardware used by enabled enrichments, resolved to the present GPU."""
        config = self.config
        names: set[str] = set()
        gpu = _present_gpu()
        if gpu is not None:
            semantic = config.semantic_search
            if (
                semantic.enabled
                # GenAI providers run remotely and use no local hardware
                and (
                    semantic.model is None
                    or isinstance(semantic.model, SemanticSearchModelEnum)
                )
                and (
                    semantic.device
                    or ("GPU" if semantic.model_size == "large" else "CPU")
                )
                != "CPU"
            ):
                names.add(gpu)
            if (
                config.face_recognition.enabled
                and (config.face_recognition.device or "GPU") != "CPU"
            ):
                names.add(gpu)
            if config.lpr.enabled and (config.lpr.device or "AUTO") != "CPU":
                names.add(gpu)
        # audio transcription runs on CUDA only, and the device is global only
        transcription = config.audio_transcription
        transcription_enabled = transcription.enabled or any(
            camera.audio_transcription.enabled for camera in config.cameras.values()
        )
        if (
            transcription_enabled
            and transcription.device == "GPU"
            and "onnx:nvidia" in _present_hardware()
            and _gpu_device_nodes_exist("nvidia")
        ):
            names.add("nvidia")
        return names
 def read_temperature(path: str) -> float | None:
    """Read a sysfs temperature file, converting millidegrees to degrees.
    Returns None when the file does not exist.
    """
    if os.path.isfile(path):
        with open(path) as f:
            line = f.readline().strip()
            return int(line) / 1000
    return None
 def get_hardware_temperatures(detector_type: str) -> list[float | None]:
    """Per unit temperatures for a detector type, in stable device order."""
    if detector_type == "edgetpu":
        # PCIe Corals expose a temperature through the apex driver
        base = "/sys/class/apex/"
        if os.path.isdir(base):
            return [
                read_temperature(os.path.join(base, apex, "temp"))
                for apex in sorted(os.listdir(base))
            ]
    elif detector_type == "hailo8l":
        hailo_temps = get_hailo_temps()
        return [hailo_temps[name] for name in sorted(hailo_temps.keys())]
    return []
@@ -1,6 +1,8 @@
 """Utilities for stats."""
 import asyncio
 import logging
 import os
 import shutil
 import time
 from json import JSONDecodeError
@@ -14,17 +16,29 @@ from frigate.config import FrigateConfig
 from frigate.const import CACHE_DIR, CLIPS_DIR, RECORD_DIR
 from frigate.data_processing.types import DataProcessorMetrics
 from frigate.object_detection.base import ObjectDetectProcess
 from frigate.stats.hardware import HardwareStats, get_hardware_temperatures
 from frigate.types import StatsTrackingTypes
 from frigate.util.services import (
    calculate_shm_requirements,
    get_amd_gpu_stats,
    get_axcl_npu_stats,
    get_bandwidth_stats,
    get_cpu_stats,
    get_fs_type,
    get_hailo_temps,
    get_intel_gpu_stats,
    get_jetson_stats,
    get_nvidia_gpu_stats,
    get_openvino_npu_stats,
    get_rockchip_gpu_stats,
    get_rockchip_npu_stats,
    is_vaapi_amd_driver,
 )
 from frigate.version import VERSION
 logger = logging.getLogger(__name__)
 HWACCEL_ERROR_COOLDOWN_SECONDS = 3600
 def get_latest_version(config: FrigateConfig) -> str:
    if not config.telemetry.version_check:
@@ -64,6 +78,64 @@ def stats_init(
    return stats_tracking
 def read_temperature(path: str) -> float | None:
    if os.path.isfile(path):
        with open(path) as f:
            line = f.readline().strip()
            return int(line) / 1000
    return None
 def get_temperatures() -> dict[str, float]:
    temps = {}
    # Get temperatures for all attached Corals
    base = "/sys/class/apex/"
    if os.path.isdir(base):
        for apex in os.listdir(base):
            temp = read_temperature(os.path.join(base, apex, "temp"))
            if temp is not None:
                temps[apex] = temp
    # Get temperatures for Hailo devices
    temps.update(get_hailo_temps())
    return temps
 def get_detector_temperature(
    detector_type: str,
    detector_index_by_type: dict[str, int],
 ) -> float | None:
    """Get temperature for a specific detector based on its type."""
    if detector_type == "edgetpu":
        # Get temperatures for all attached Corals
        base = "/sys/class/apex/"
        if os.path.isdir(base):
            apex_devices = sorted(os.listdir(base))
            index = detector_index_by_type.get("edgetpu", 0)
            if index < len(apex_devices):
                apex_name = apex_devices[index]
                temp = read_temperature(os.path.join(base, apex_name, "temp"))
                if temp is not None:
                    return temp
    elif detector_type == "hailo8l":
        # Get temperatures for Hailo devices
        hailo_temps = get_hailo_temps()
        if hailo_temps:
            hailo_device_names = sorted(hailo_temps.keys())
            index = detector_index_by_type.get("hailo8l", 0)
            if index < len(hailo_device_names):
                device_name = hailo_device_names[index]
                return hailo_temps[device_name]
    elif detector_type == "rknn":
        # Rockchip temperatures are handled by the GPU / NPU stats
        # as there are not detector specific temperatures
        pass
    return None
 def get_detector_stats(
    stats_tracking: StatsTrackingTypes,
 ) -> dict[str, dict[str, Any]]:
@@ -89,20 +161,190 @@ def get_detector_stats(
            "pid": pid,
        }
-        temps = get_hardware_temperatures(detector_type)
+        temp = get_detector_temperature(detector_type, {detector_type: current_index})
-        if current_index < len(temps) and temps[current_index] is not None:
+        if temp is not None:
-            detector_stat["temperature"] = round(temps[current_index], 1)
+            detector_stat["temperature"] = round(temp, 1)
        detector_stats[name] = detector_stat
    return detector_stats
 def get_processing_stats(
    config: FrigateConfig,
    stats: dict[str, str],
    hwaccel_errors: dict[str, float],
 ) -> None:
    """Get stats for cpu / gpu."""
    async def run_tasks() -> None:
        stats_tasks = [
            asyncio.create_task(set_gpu_stats(config, stats, hwaccel_errors)),
            asyncio.create_task(set_cpu_stats(stats)),
            asyncio.create_task(set_npu_usages(config, stats)),
        ]
        if config.telemetry.stats.network_bandwidth:
            stats_tasks.append(asyncio.create_task(set_bandwidth_stats(config, stats)))
        await asyncio.wait(stats_tasks)
    loop = asyncio.new_event_loop()
    asyncio.set_event_loop(loop)
    loop.run_until_complete(run_tasks())
    loop.close()
 async def set_cpu_stats(all_stats: dict[str, Any]) -> None:
    """Set cpu usage from top."""
    cpu_stats = get_cpu_stats()
    if cpu_stats:
        all_stats["cpu_usages"] = cpu_stats
 async def set_bandwidth_stats(config: FrigateConfig, all_stats: dict[str, Any]) -> None:
    """Set bandwidth from nethogs."""
    bandwidth_stats = get_bandwidth_stats(config)
    if bandwidth_stats:
        all_stats["bandwidth_usages"] = bandwidth_stats
 async def set_gpu_stats(
    config: FrigateConfig,
    all_stats: dict[str, Any],
    hwaccel_errors: dict[str, float],
 ) -> None:
    """Parse GPUs from hwaccel args and use for stats."""
    hwaccel_args = []
    for camera in config.cameras.values():
        args = camera.ffmpeg.hwaccel_args
        if isinstance(args, list):
            args = " ".join(args)
        if args and args not in hwaccel_args:
            hwaccel_args.append(args)
        for stream_input in camera.ffmpeg.inputs:
            args = stream_input.hwaccel_args
            if isinstance(args, list):
                args = " ".join(args)
            if args and args not in hwaccel_args:
                hwaccel_args.append(args)
    stats: dict[str, dict] = {}
    intel_gpu_collected = False
    now = time.monotonic()
    for args in hwaccel_args:
        last_error = hwaccel_errors.get(args)
        if last_error is not None:
            if now - last_error < HWACCEL_ERROR_COOLDOWN_SECONDS:
                continue
            hwaccel_errors.pop(args, None)
        if "cuvid" in args or "nvidia" in args:
            # nvidia GPU
            nvidia_usage = get_nvidia_gpu_stats()
            if nvidia_usage:
                for i in range(len(nvidia_usage)):
                    stats[nvidia_usage[i]["name"]] = {
                        "vendor": "nvidia",
                        "gpu": str(round(float(nvidia_usage[i]["gpu"]), 2)) + "%",
                        "mem": str(round(float(nvidia_usage[i]["mem"]), 2)) + "%",
                        "enc": str(round(float(nvidia_usage[i]["enc"]), 2)) + "%",
                        "dec": str(round(float(nvidia_usage[i]["dec"]), 2)) + "%",
                        "temp": str(nvidia_usage[i]["temp"]),
                    }
            else:
                stats["nvidia-gpu"] = {"vendor": "nvidia", "gpu": "", "mem": ""}
                hwaccel_errors[args] = time.monotonic()
        elif "nvmpi" in args or "jetson" in args:
            # nvidia Jetson
            jetson_usage = get_jetson_stats()
            if jetson_usage:
                stats["jetson-gpu"] = {"vendor": "nvidia", **jetson_usage}
            else:
                stats["jetson-gpu"] = {"vendor": "nvidia", "gpu": "", "mem": ""}
                hwaccel_errors[args] = time.monotonic()
        elif "qsv" in args or ("vaapi" in args and not is_vaapi_amd_driver()):
            if not config.telemetry.stats.intel_gpu_stats:
                continue
            if not intel_gpu_collected:
                # intel GPU (QSV or VAAPI both use the same physical GPU)
                intel_gpu_collected = True
                intel_usage = get_intel_gpu_stats(
                    config.telemetry.stats.intel_gpu_device
                )
                if intel_usage:
                    for entry in intel_usage.values():
                        name = entry.pop("name")
                        stats[name] = entry
                else:
                    stats["intel-gpu"] = {"vendor": "intel", "gpu": "", "mem": ""}
                    hwaccel_errors[args] = time.monotonic()
        elif "vaapi" in args:
            if not config.telemetry.stats.amd_gpu_stats:
                continue
            # AMD VAAPI GPU
            amd_usage = get_amd_gpu_stats()
            if amd_usage:
                stats["amd-vaapi"] = {"vendor": "amd", **amd_usage}
            else:
                stats["amd-vaapi"] = {"vendor": "amd", "gpu": "", "mem": ""}
                hwaccel_errors[args] = time.monotonic()
        elif "preset-rk" in args:
            rga_usage = get_rockchip_gpu_stats()
            if rga_usage:
                stats["rockchip"] = {"vendor": "rockchip", **rga_usage}
        elif "v4l2m2m" in args or "rpi" in args:
            # RPi v4l2m2m is currently not able to get usage stats
            stats["rpi-v4l2m2m"] = {"vendor": "rpi", "gpu": "", "mem": ""}
    if stats:
        all_stats["gpu_usages"] = stats
 async def set_npu_usages(config: FrigateConfig, all_stats: dict[str, Any]) -> None:
    stats: dict[str, dict] = {}
    for model in config.models:
        for device in config.devices_for_model(model):
            if device.detector == "rknn":
                # Rockchip NPU usage
                rk_usage = get_rockchip_npu_stats()
                stats["rockchip"] = rk_usage
            elif device.detector == "openvino" and device.device == "NPU":
                # OpenVINO NPU usage
                ov_usage = get_openvino_npu_stats()
                stats["openvino"] = ov_usage
            elif device.detector == "axengine":
                # AXERA NPU usage
                axcl_usage = get_axcl_npu_stats()
                stats["axengine"] = axcl_usage
    if stats:
        all_stats["npu_usages"] = stats
 def stats_snapshot(
    config: FrigateConfig,
    stats_tracking: StatsTrackingTypes,
-    hardware_stats: HardwareStats,
+    hwaccel_errors: dict[str, float],
 ) -> dict[str, Any]:
    """Get a snapshot of the current stats that are being tracked."""
    camera_metrics = stats_tracking["camera_metrics"]
@@ -245,13 +487,7 @@ def stats_snapshot(
                embeddings_metrics.classification_cps[key].value, 2
            )
-    hardware_stats.update_stats(stats)
+    get_processing_stats(config, stats, hwaccel_errors)
    if config.telemetry.stats.network_bandwidth:
        bandwidth_stats = get_bandwidth_stats(config)
        if bandwidth_stats:
            stats["bandwidth_usages"] = bandwidth_stats
    stats["service"] = {
        "uptime": (int(time.time()) - stats_tracking["started"]),
@@ -0,0 +1,189 @@
 """Tests for GET /classification/attributes."""
 import os
 import shutil
 import unittest
 from frigate.api.auth import get_allowed_cameras_for_filter
 from frigate.const import CLIPS_DIR
 from frigate.models import Event, Recordings, ReviewSegment
 from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
 # "limited_user" only reaches front_door, so it never sees the values that were
 # recorded on back_door.
 _CONFIG = {
    "mqtt": {"host": "mqtt"},
    "auth": {"roles": {"limited_user": ["front_door"]}},
    "classification": {
        "custom": {
            "delivery_service": {
                "enabled": True,
                "object_config": {
                    "objects": ["car"],
                    "classification_type": "attribute",
                },
            }
        }
    },
    "cameras": {
        "front_door": {
            "ffmpeg": {
                "inputs": [{"path": "rtsp://10.0.0.1:554/video", "roles": ["detect"]}]
            },
            "detect": {"height": 1080, "width": 1920, "fps": 5},
        },
        "back_door": {
            "ffmpeg": {
                "inputs": [{"path": "rtsp://10.0.0.2:554/video", "roles": ["detect"]}]
            },
            "detect": {"height": 1080, "width": 1920, "fps": 5},
        },
    },
 }
 class TestClassificationAttributesAccess(BaseTestHttp):
    """The attribute list is read from the training dataset on disk, which holds
    every label a model can emit regardless of which camera recorded it. Callers
    without full camera access are cut back to the values on their own cameras,
    so these tests pin that scoping.
    """
    def setUp(self):
        super().setUp([Event, ReviewSegment, Recordings])
        self.minimal_config = _CONFIG
        self.app = super().create_app()
        self.model_dir = os.path.join(CLIPS_DIR, "delivery_service")
        for category in ("DHL", "Amazon", "Hermes", "none"):
            os.makedirs(
                os.path.join(self.model_dir, "dataset", category), exist_ok=True
            )
    def tearDown(self):
        shutil.rmtree(self.model_dir, ignore_errors=True)
        self.app.dependency_overrides.clear()
        super().tearDown()
    def _insert_event(self, event_id: str, camera: str, attribute: str | None):
        data = {"type": "object", "score": 0.9}
        if attribute is not None:
            data["delivery_service"] = attribute
        Event.insert(
            id=event_id,
            label="car",
            camera=camera,
            start_time=100,
            end_time=200,
            top_score=0.9,
            score=0.9,
            false_positive=False,
            zones=[],
            thumbnail="",
            has_clip=True,
            has_snapshot=True,
            region=[],
            box=[],
            area=0,
            retain_indefinitely=False,
            ratio=1.0,
            plus_id=None,
            model_hash="",
            detector_type="cpu",
            model_type="ssd",
            data=data,
        ).execute()
    def _get(self, role: str, **params):
        # the base class resolves every camera by default, so drop the override
        # to exercise the real role to allowed-cameras resolution
        self.app.dependency_overrides.pop(get_allowed_cameras_for_filter, None)
        with AuthTestClient(self.app) as client:
            return client.get(
                "/classification/attributes",
                params=params,
                headers={"remote-user": "test", "remote-role": role},
            )
    def _insert_split_events(self):
        self._insert_event("front", "front_door", "DHL")
        self._insert_event("back", "back_door", "Amazon")
    def test_admin_gets_every_trained_label(self):
        self._insert_split_events()
        assert self._get("admin").json() == ["Amazon", "DHL", "Hermes"]
    def test_viewer_gets_every_trained_label(self):
        self._insert_split_events()
        assert self._get("viewer").json() == ["Amazon", "DHL", "Hermes"]
    def test_restricted_role_only_gets_its_own_cameras(self):
        self._insert_split_events()
        assert self._get("limited_user").json() == ["DHL"]
    def test_restricted_role_grouped_by_model(self):
        self._insert_split_events()
        assert self._get("limited_user", group_by_model="true").json() == {
            "delivery_service": ["DHL"]
        }
    def test_restricted_role_with_no_recorded_values(self):
        self._insert_event("back", "back_door", "Amazon")
        assert self._get("limited_user").json() == []
        assert self._get("limited_user", group_by_model="true").json() == {}
    def test_restricted_role_ignores_events_without_the_attribute(self):
        self._insert_event("front", "front_door", None)
        assert self._get("limited_user").json() == []
    def test_restricted_role_with_a_dotted_model_name(self):
        # model names are unrestricted config keys, and an unquoted "." in the
        # json path would be read as a nested lookup and match nothing
        self.app.frigate_config.classification.custom["delivery.service"] = (
            self.app.frigate_config.classification.custom.pop("delivery_service")
        )
        self.app.frigate_config.classification.custom[
            "delivery.service"
        ].name = "delivery.service"
        os.rename(self.model_dir, os.path.join(CLIPS_DIR, "delivery.service"))
        self.model_dir = os.path.join(CLIPS_DIR, "delivery.service")
        data = {"type": "object", "score": 0.9, "delivery.service": "DHL"}
        Event.insert(
            id="front",
            label="car",
            camera="front_door",
            start_time=100,
            end_time=200,
            top_score=0.9,
            score=0.9,
            false_positive=False,
            zones=[],
            thumbnail="",
            has_clip=True,
            has_snapshot=True,
            region=[],
            box=[],
            area=0,
            retain_indefinitely=False,
            ratio=1.0,
            plus_id=None,
            model_hash="",
            detector_type="cpu",
            model_type="ssd",
            data=data,
        ).execute()
        assert self._get("limited_user").json() == ["DHL"]
    def test_object_type_filters_out_unrelated_models(self):
        self._insert_split_events()
        assert self._get("limited_user", object_type="person").json() == []
        assert self._get("limited_user", object_type="car").json() == ["DHL"]
 if __name__ == "__main__":
    unittest.main()
@@ -1,7 +1,5 @@
 import io
 import os
 import tempfile
 import zipfile
 from unittest.mock import patch
 from frigate.jobs.export import (
@@ -368,91 +366,6 @@ class TestHttpExport(BaseTestHttp):
        assert response.status_code == 200
        assert response.json() == [queued_job.to_dict()]
    def test_rename_export_moves_the_file(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            video = os.path.join(tmpdir, "front_door_20260823_020615_abc123.mp4")
            thumb = os.path.join(tmpdir, "front_door_abc123.webp")
            for path, data in ((video, b"video"), (thumb, b"thumb")):
                with open(path, "wb") as handle:
                    handle.write(data)
            Export.create(
                id="front_door_abc123",
                camera="front_door",
                name="front door 2026-08-23 02:06:15 2026-08-23 02:07:34",
                date=100,
                video_path=video,
                thumb_path=thumb,
                in_progress=False,
            )
            with patch("frigate.record.export.EXPORT_DIR", tmpdir):
                with AuthTestClient(self.app) as client:
                    response = client.patch(
                        "/export/front_door_abc123/rename",
                        json={"name": "Package thief"},
                    )
            assert response.status_code == 200
            renamed = Export.get(Export.id == "front_door_abc123")
            assert renamed.name == "Package thief"
            assert os.path.basename(renamed.video_path) == "Package thief_abc123.mp4"
            assert os.path.exists(renamed.video_path)
            assert not os.path.exists(video)
    def test_rename_export_rejected_while_in_progress(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            video = os.path.join(tmpdir, "front_door_abc123.mp4")
            with open(video, "wb") as handle:
                handle.write(b"video")
            Export.create(
                id="front_door_running",
                camera="front_door",
                name="front door export",
                date=100,
                video_path=video,
                thumb_path=os.path.join(tmpdir, "t.webp"),
                in_progress=True,
            )
            with AuthTestClient(self.app) as client:
                response = client.patch(
                    "/export/front_door_running/rename",
                    json={"name": "Package thief"},
                )
            assert response.status_code == 400
            assert Export.get(Export.id == "front_door_running").video_path == video
    def test_rename_export_missing_file_leaves_the_row_alone(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            video = os.path.join(tmpdir, "front_door_gone_abc123.mp4")
            Export.create(
                id="front_door_gone",
                camera="front_door",
                name="front door export",
                date=100,
                video_path=video,
                thumb_path=os.path.join(tmpdir, "t.webp"),
                in_progress=False,
            )
            with patch("frigate.record.export.EXPORT_DIR", tmpdir):
                with AuthTestClient(self.app) as client:
                    response = client.patch(
                        "/export/front_door_gone/rename",
                        json={"name": "Package thief"},
                    )
            assert response.status_code == 500
            unchanged = Export.get(Export.id == "front_door_gone")
            assert unchanged.name == "front door export"
            assert unchanged.video_path == video
    def test_reap_stale_exports_deletes_rows_with_no_file(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            stale_video = os.path.join(tmpdir, "stale.mp4")
@@ -1518,79 +1431,3 @@ class TestHttpExport(BaseTestHttp):
            )
        assert response.status_code == 403
    def test_download_export_case_with_multibyte_name(self):
        """A case name outside latin-1 must not break the response headers."""
        case = ExportCase.create(
            id="case_multibyte",
            name="テスト事案",
            description="",
            created_at=10,
            updated_at=10,
        )
        with tempfile.TemporaryDirectory() as tmpdir:
            video_path = os.path.join(tmpdir, "現場カメラ.mp4")
            with open(video_path, "wb") as handle:
                handle.write(b"video")
            Export.create(
                id="export_multibyte",
                camera="front_door",
                name="現場カメラ",
                date=100,
                video_path=video_path,
                thumb_path=os.path.join(tmpdir, "multibyte_export.webp"),
                in_progress=False,
                export_case=case,
            )
            with AuthTestClient(self.app) as client:
                response = client.get(f"/cases/{case.id}/download")
        assert response.status_code == 200
        # RFC 5987/6266: the UTF-8 name rides in filename*, and a latin-1 safe
        # fallback stays in filename for old clients.
        assert response.headers["content-disposition"] == (
            'attachment; filename="case_multibyte.zip"; '
            "filename*=UTF-8''%E3%83%86%E3%82%B9%E3%83%88%E4%BA%8B%E6%A1%88.zip"
        )
        archive = zipfile.ZipFile(io.BytesIO(response.content))
        assert archive.namelist() == ["現場カメラ.mp4"]
    def test_download_export_case_with_ascii_name(self):
        """An ASCII case name still gets a plain, readable filename."""
        case = ExportCase.create(
            id="case_ascii",
            name="Burglary 2026-08",
            description="",
            created_at=10,
            updated_at=10,
        )
        with tempfile.TemporaryDirectory() as tmpdir:
            video_path = os.path.join(tmpdir, "ascii_export.mp4")
            with open(video_path, "wb") as handle:
                handle.write(b"video")
            Export.create(
                id="export_ascii",
                camera="front_door",
                name="Front door",
                date=100,
                video_path=video_path,
                thumb_path=os.path.join(tmpdir, "ascii_export.webp"),
                in_progress=False,
                export_case=case,
            )
            with AuthTestClient(self.app) as client:
                response = client.get(f"/cases/{case.id}/download")
        assert response.status_code == 200
        assert (
            response.headers["content-disposition"]
            == 'attachment; filename="Burglary 2026-08.zip"; '
            "filename*=UTF-8''Burglary%202026-08.zip"
        )
@@ -1,8 +1,7 @@
 """Unit tests for recordings/media API endpoints."""
 from dataclasses import dataclass
-from datetime import UTC, datetime, timedelta
+from datetime import UTC, datetime
 from unittest.mock import patch
 import pytz
 from fastapi import Request
@@ -1839,27 +1838,6 @@ class TestHttpMedia(BaseTestHttp):
                        recording["id"] for recording in response.json()
                    ] == expected_ids
    def test_recordings_default_range_follows_the_request_clock(self):
        """Omitted bounds resolve at request time, not at module import time."""
        uptime = timedelta(hours=2)
        recorded_at = (datetime.now() + uptime).timestamp()
        class UptimeDatetime(datetime):
            """Stands in for a process that booted `uptime` ago."""
            @classmethod
            def now(cls, tz=None):
                return datetime.now(tz) + uptime
        with AuthTestClient(self.app) as client:
            self._insert_recording("after_boot", recorded_at - 20, recorded_at - 10)
            with patch("frigate.api.record.datetime", UptimeDatetime):
                response = client.get("/front_door/recordings")
            assert response.status_code == 200
            assert [recording["id"] for recording in response.json()] == ["after_boot"]
    def test_vod_handles_all_range_relations(self):
        """VOD clips every interval relation with positive playback duration."""
        with AuthTestClient(self.app) as client:
@@ -1,26 +0,0 @@
 """Tests for bandwidth stats privilege handling."""
 import unittest
 from unittest.mock import MagicMock, patch
 from frigate.util import services
 class TestBandwidthStatsPrivileges(unittest.TestCase):
    def setUp(self):
        services._bandwidth_warning_logged = False
    @patch("frigate.util.services.sp.run")
    @patch("frigate.util.services.os.geteuid", return_value=1000)
    def test_returns_empty_and_warns_once_without_root(self, _, sp_run):
        config = MagicMock()
        with self.assertLogs("frigate.util.services", level="WARNING") as logs:
            assert services.get_bandwidth_stats(config) == {}
            assert services.get_bandwidth_stats(config) == {}
        sp_run.assert_not_called()
        warnings = [m for m in logs.output if "require root" in m]
        assert len(warnings) == 1
 if __name__ == "__main__":
    unittest.main()
@@ -1,41 +0,0 @@
 """Tests for ONNX Runtime session option selection."""
 import unittest
 import onnxruntime as ort
 from frigate.detectors.detection_runners import get_ort_session_options
 from frigate.detectors.detector_config import ModelTypeEnum
 from frigate.embeddings.types import EnrichmentModelTypeEnum
 class TestGetOrtSessionOptions(unittest.TestCase):
    def test_jina_v2_uses_extended(self):
        """jina-clip-v2 returns an identical vector for every image on the CUDA
        execution provider at anything below EXTENDED."""
        options = get_ort_session_options(EnrichmentModelTypeEnum.jina_v2.value)
        self.assertIsNotNone(options)
        self.assertEqual(
            options.graph_optimization_level,
            ort.GraphOptimizationLevel.ORT_ENABLE_EXTENDED,
        )
    def test_jina_v1_uses_basic(self):
        options = get_ort_session_options(EnrichmentModelTypeEnum.jina_v1.value)
        self.assertIsNotNone(options)
        self.assertEqual(
            options.graph_optimization_level,
            ort.GraphOptimizationLevel.ORT_ENABLE_BASIC,
        )
    def test_other_models_use_defaults(self):
        for model_type in [
            None,
            EnrichmentModelTypeEnum.paddleocr.value,
            EnrichmentModelTypeEnum.arcface.value,
            ModelTypeEnum.rfdetr.value,
        ]:
            with self.subTest(model_type=model_type):
                self.assertIsNone(get_ort_session_options(model_type))
@@ -1,76 +0,0 @@
 import unittest
 from types import SimpleNamespace
 from unittest.mock import Mock, call, patch
 from frigate.object_detection.base import ObjectDetectProcess
 def _make_detector(
    detection_start: SimpleNamespace,
    process: Mock,
    stop_event: Mock,
 ) -> ObjectDetectProcess:
    detector = ObjectDetectProcess.__new__(ObjectDetectProcess)
    detector.name = "test"
    detector.cameras = ["front"]
    detector.detection_queue = Mock()
    detector.avg_inference_speed = Mock()
    detector.detection_start = detection_start
    detector.detect_process = process
    detector.config = Mock()
    detector.detector_config = SimpleNamespace(type="onnx")
    detector.stop_event = stop_event
    return detector
 class TestDetectorRestart(unittest.TestCase):
    @patch("frigate.object_detection.base.DetectorRunner")
    def test_restart_is_abandoned_when_inference_recovers(
        self, detector_runner: Mock
    ) -> None:
        detection_start = SimpleNamespace(value=123.0)
        process = Mock(exitcode=None)
        process.is_alive.return_value = True
        process.join.side_effect = lambda timeout=None: setattr(
            detection_start, "value", 0.0
        )
        detector = _make_detector(detection_start, process, Mock())
        detector.start_or_restart()
        process.join.assert_called_once_with(timeout=30)
        process.kill.assert_not_called()
        self.assertIs(detector.detect_process, process)
        detector_runner.assert_not_called()
    @patch("frigate.object_detection.base.DetectorRunner")
    def test_restart_force_kills_detector_that_remains_stuck(
        self, detector_runner: Mock
    ) -> None:
        detection_start = SimpleNamespace(value=123.0)
        process = Mock(exitcode=None)
        process.is_alive.return_value = True
        process.kill.side_effect = lambda: setattr(process, "exitcode", -9)
        stop_event = Mock()
        detector = _make_detector(detection_start, process, stop_event)
        detector.start_or_restart()
        process.join.assert_has_calls([call(timeout=30), call()])
        process.kill.assert_called_once_with()
        self.assertEqual(detection_start.value, 0.0)
        detector_runner.assert_called_once_with(
            "frigate.detector:test",
            detector.detection_queue,
            detector.cameras,
            detector.avg_inference_speed,
            detection_start,
            detector.config,
            detector.detector_config,
            stop_event,
        )
        detector_runner.return_value.start.assert_called_once_with()
 if __name__ == "__main__":
    unittest.main()
@@ -1,9 +1,6 @@
 import unittest
 from pathlib import Path
-from frigate.api.export import _unique_archive_name
+from frigate.record.export import validate_ffmpeg_args
 from frigate.models import Export
 from frigate.record.export import export_video_path, validate_ffmpeg_args
 class TestValidateFfmpegArgs(unittest.TestCase):
@@ -131,82 +128,5 @@ class TestValidateFfmpegArgs(unittest.TestCase):
        self.assertRejected("-metadata comment=x")
 class TestExportVideoPath(unittest.TestCase):
    """Tests for the file path an export takes once the user names it."""
    EXPORT_ID = "front_door_abc123"
    def test_uses_the_name_the_user_gave(self):
        self.assertEqual(
            export_video_path("Package thief", self.EXPORT_ID),
            "/media/frigate/exports/Package thief_abc123.mp4",
        )
    def test_id_suffix_keeps_shared_names_apart(self):
        self.assertNotEqual(
            export_video_path("clip", "front_door_abc123"),
            export_video_path("clip", "front_door_def456"),
        )
    def test_long_names_fit_the_filesystem_limit(self):
        # Names are capped in bytes, not characters: 244 CJK characters is
        # under any character cap and still 732 bytes on disk.
        for name in ("A" * 256, "\u76e3" * 256, "\U0001f3a5" * 100):
            file_name = Path(export_video_path(name, self.EXPORT_ID)).name
            self.assertLessEqual(len(file_name.encode()), 255)
    def test_truncation_keeps_the_name_decodable(self):
        file_name = Path(export_video_path("\u76e3" * 256, self.EXPORT_ID)).name
        self.assertTrue(file_name.endswith("_abc123.mp4"))
        self.assertNotIn("\ufffd", file_name)
    def test_stays_inside_the_export_dir(self):
        for name in ("../../etc/passwd", "..", "a/b", "...", ""):
            path = Path(export_video_path(name, self.EXPORT_ID))
            self.assertEqual(str(path.parent), "/media/frigate/exports")
 class TestUniqueArchiveName(unittest.TestCase):
    """Tests for zip entry names in a case download.
    Entries use the on-disk file name, which is also what an individual
    download produces, so the two can't drift.
    """
    def build_export(self, video_path: str) -> Export:
        return Export(
            id="front_door_abc123",
            camera="front_door",
            name="whatever the display name is",
            date=1756000000.0,
            video_path=video_path,
            thumb_path=video_path.replace(".mp4", ".webp"),
            in_progress=False,
        )
    def test_uses_the_on_disk_file_name(self):
        export = self.build_export(
            "/media/frigate/exports/front_door_20260823_020615-20260823_020734_abc123.mp4"
        )
        self.assertEqual(
            _unique_archive_name(export, set()),
            "front_door_20260823_020615-20260823_020734_abc123.mp4",
        )
    def test_follows_a_renamed_file(self):
        export = self.build_export("/media/frigate/exports/Package thief_abc123.mp4")
        self.assertEqual(
            _unique_archive_name(export, set()), "Package thief_abc123.mp4"
        )
    def test_entries_are_deduplicated(self):
        export = self.build_export("/media/frigate/exports/Package thief_abc123.mp4")
        used: set[str] = set()
        self.assertEqual(_unique_archive_name(export, used), "Package thief_abc123.mp4")
        self.assertEqual(
            _unique_archive_name(export, used), "Package thief_abc123_1.mp4"
        )
 if __name__ == "__main__":
    unittest.main()
@@ -1,154 +0,0 @@
 """Tests for custom ffmpeg path resolution and the root-mode guard."""
 import unittest
 from unittest.mock import patch
 from frigate.const import DEFAULT_FFMPEG_VERSION
 from frigate.util.config import (
    _warn_ignored_ffmpeg_path,
    frigate_service_is_granular_root,
    resolve_ffmpeg_path,
 )
 BUNDLED = f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg"
 CUSTOM = "/config/custom-ffmpeg"
 class TestConfigFfmpegRootGuard(unittest.TestCase):
    """A user-writable ffmpeg must not run as root under FRIGATE_ROOT_SERVICES."""
    def setUp(self) -> None:
        # the warning is memoized so it fires once per path, not per camera
        _warn_ignored_ffmpeg_path.cache_clear()
    def _resolve(self, path: str, *, euid: int, env: dict, binary: str = "ffmpeg"):
        with (
            patch("os.geteuid", return_value=euid),
            patch.dict("os.environ", env, clear=True),
        ):
            return resolve_ffmpeg_path(path, binary)
    def test_custom_path_used_when_service_is_unprivileged(self) -> None:
        self.assertEqual(
            self._resolve(CUSTOM, euid=1000, env={}), f"{CUSTOM}/bin/ffmpeg"
        )
    def test_escape_hatch_keeps_working_exactly_as_before(self) -> None:
        # FRIGATE_RUN_AS_ROOT never sweeps /config and leaves no unprivileged
        # service, so a custom build there is as safe as it was pre-drop
        self.assertEqual(
            self._resolve(CUSTOM, euid=0, env={"FRIGATE_RUN_AS_ROOT": "true"}),
            f"{CUSTOM}/bin/ffmpeg",
        )
    def test_custom_path_ignored_when_frigate_is_a_root_service(self) -> None:
        self.assertEqual(
            self._resolve(CUSTOM, euid=0, env={"FRIGATE_ROOT_SERVICES": "frigate"}),
            BUNDLED,
        )
    def test_ffprobe_is_guarded_too(self) -> None:
        self.assertEqual(
            self._resolve(
                CUSTOM,
                euid=0,
                env={"FRIGATE_ROOT_SERVICES": "frigate"},
                binary="ffprobe",
            ),
            f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffprobe",
        )
    def test_another_root_service_does_not_trigger_the_guard(self) -> None:
        # go2rtc running as root says nothing about who spawns ffmpeg
        self.assertEqual(
            self._resolve(CUSTOM, euid=0, env={"FRIGATE_ROOT_SERVICES": "go2rtc"}),
            f"{CUSTOM}/bin/ffmpeg",
        )
    def test_root_services_has_no_effect_under_docker_user(self) -> None:
        # docker's own user: means the service never had root to keep, which is
        # also the case for get_ffmpeg_path.py in a --user container
        self.assertEqual(
            self._resolve(CUSTOM, euid=1000, env={"FRIGATE_ROOT_SERVICES": "frigate"}),
            f"{CUSTOM}/bin/ffmpeg",
        )
    def test_path_outside_config_is_left_alone(self) -> None:
        # only /config is runtime-user-owned; a root-owned tree stays usable
        self.assertEqual(
            self._resolve(
                "/opt/custom-ffmpeg", euid=0, env={"FRIGATE_ROOT_SERVICES": "frigate"}
            ),
            "/opt/custom-ffmpeg/bin/ffmpeg",
        )
    def test_traversal_out_of_config_does_not_evade_the_guard(self) -> None:
        self.assertEqual(
            self._resolve(
                "/config/../config/custom-ffmpeg",
                euid=0,
                env={"FRIGATE_ROOT_SERVICES": "frigate"},
            ),
            BUNDLED,
        )
    def test_media_tree_is_guarded_too(self) -> None:
        # config.yml is uid-1000-writable, so ffmpeg.path can be pointed at any
        # writable tree; /config alone would be an evasion, not a guard
        self.assertEqual(
            self._resolve(
                "/media/frigate/evil", euid=0, env={"FRIGATE_ROOT_SERVICES": "frigate"}
            ),
            BUNDLED,
        )
    def test_config_dir_itself_is_guarded(self) -> None:
        self.assertEqual(
            self._resolve("/config", euid=0, env={"FRIGATE_ROOT_SERVICES": "frigate"}),
            BUNDLED,
        )
    def test_default_alias_is_unaffected(self) -> None:
        self.assertEqual(
            self._resolve("default", euid=0, env={"FRIGATE_ROOT_SERVICES": "frigate"}),
            BUNDLED,
        )
 class TestFrigateServiceIsGranularRoot(unittest.TestCase):
    """Root via FRIGATE_ROOT_SERVICES only, never via the escape hatch."""
    def _check(self, *, euid: int, env: dict) -> bool:
        with (
            patch("os.geteuid", return_value=euid),
            patch.dict("os.environ", env, clear=True),
        ):
            return frigate_service_is_granular_root()
    def test_false_without_any_root_signal(self) -> None:
        self.assertFalse(self._check(euid=0, env={}))
    def test_escape_hatch_is_not_granular_root(self) -> None:
        # the escape hatch restores old behavior wholesale, sweep included
        self.assertFalse(self._check(euid=0, env={"FRIGATE_RUN_AS_ROOT": "true"}))
        self.assertFalse(
            self._check(
                euid=0,
                env={"FRIGATE_RUN_AS_ROOT": "true", "FRIGATE_ROOT_SERVICES": "frigate"},
            )
        )
    def test_membership_ignores_whitespace_and_other_entries(self) -> None:
        self.assertTrue(
            self._check(euid=0, env={"FRIGATE_ROOT_SERVICES": "go2rtc, frigate"})
        )
        self.assertFalse(
            self._check(euid=0, env={"FRIGATE_ROOT_SERVICES": "go2rtc,nginx"})
        )
    def test_substring_of_a_service_name_does_not_match(self) -> None:
        self.assertFalse(self._check(euid=0, env={"FRIGATE_ROOT_SERVICES": "frigatee"}))
 if __name__ == "__main__":
    unittest.main()
@@ -70,19 +70,3 @@ class TestFileUtils(TestCase):
            assert rendered_image is not None
            assert rendered_image.shape[0] == 40
            assert rendered_image.max() > 0
    def test_get_event_thumbnail_bytes_ignores_empty_file(self):
        """Verify empty thumbnail files are treated as missing."""
        event = SimpleNamespace(id="empty-thumb", camera="front_door", thumbnail=None)
        with (
            tempfile.TemporaryDirectory() as thumb_dir,
            patch.object(file_util, "THUMB_DIR", thumb_dir),
        ):
            camera_dir = os.path.join(thumb_dir, event.camera)
            os.makedirs(camera_dir)
            with open(os.path.join(camera_dir, f"{event.id}.webp"), "wb"):
                pass
            assert file_util.get_event_thumbnail_bytes(event) is None
@@ -1,87 +0,0 @@
 """Tests for GenAI prompt builders."""
 import unittest
 from frigate.config.camera.review import ReviewResponseStyleEnum
 from frigate.genai.prompts import (
    REVIEW_DESCRIPTION_FIELD_GUIDELINES,
    REVIEW_RESPONSE_STYLES,
    build_review_description_prompt,
    get_review_field_guidelines,
 )
 class TestReviewResponseStyle(unittest.TestCase):
    def _build_prompt(self, response_style: str = "default") -> str:
        review_data = {
            "camera": "Front Door",
            "start": "Monday, 09:30 AM",
            "duration": 25,
            "zones": [],
            "unified_objects": ["person"],
        }
        return build_review_description_prompt(
            review_data,
            [b"fake-image"],
            [],
            None,
            "activity context",
            response_style,
        )
    def test_default_style_leaves_prompt_unchanged(self):
        self.assertEqual(
            get_review_field_guidelines("default"),
            REVIEW_DESCRIPTION_FIELD_GUIDELINES,
        )
        self.assertEqual(self._build_prompt("default"), self._build_prompt())
    def test_unknown_style_leaves_prompt_unchanged(self):
        self.assertEqual(self._build_prompt("unknown"), self._build_prompt())
    def test_styles_replace_user_facing_field_guidance(self):
        default_prompt = self._build_prompt()
        for style, overrides in REVIEW_RESPONSE_STYLES.items():
            prompt = self._build_prompt(style)
            for field_name, guidance in overrides.items():
                self.assertIn(f"- `{field_name}`: {guidance}", prompt)
                self.assertNotIn(
                    REVIEW_DESCRIPTION_FIELD_GUIDELINES[field_name], prompt
                )
            # Everything outside the overridden guidance lines is unchanged
            self.assertEqual(
                [
                    line
                    for line in prompt.splitlines()
                    if not any(line.startswith(f"- `{f}`:") for f in overrides)
                ],
                [
                    line
                    for line in default_prompt.splitlines()
                    if not any(line.startswith(f"- `{f}`:") for f in overrides)
                ],
            )
    def test_styles_never_touch_reasoning_or_threat_fields(self):
        # observations is a reasoning scaffold and potential_threat_level is
        # scoring guidance; presets restyle only the user-facing fields.
        for overrides in REVIEW_RESPONSE_STYLES.values():
            self.assertTrue(
                set(overrides) <= {"scene", "title", "shortSummary"},
                f"unexpected override fields: {set(overrides)}",
            )
    def test_config_enum_matches_style_presets(self):
        enum_styles = {e.value for e in ReviewResponseStyleEnum}
        self.assertEqual(enum_styles, {"default", *REVIEW_RESPONSE_STYLES})
    def test_enum_value_selects_preset(self):
        prompt = self._build_prompt(ReviewResponseStyleEnum.natural)
        self.assertIn(
            REVIEW_RESPONSE_STYLES["natural"]["shortSummary"],
            prompt,
        )
 if __name__ == "__main__":
    unittest.main()
@@ -1,418 +0,0 @@
 """Tests for config driven hardware stats collection."""
 import time
 import unittest
 from types import SimpleNamespace
 from unittest.mock import patch
 from frigate.config import FrigateConfig
 from frigate.detectors.device import DeviceSpec
 from frigate.detectors.hardware import DetectionHardware
 from frigate.stats import hardware
 from frigate.stats.hardware import (
    HardwarePollResult,
    HardwareStats,
    _gpu_device_nodes_exist,
    _hwaccel_hardware,
    get_hardware_temperatures,
 )
 def found(key: str) -> DetectionHardware:
    """A probe result carrying only the fields the scanners read."""
    return DetectionHardware(
        key=key,
        detector=key.partition(":")[0],
        name=key,
        units=[],
        count=0,
        unlimited=True,
    )
 class HardwareStatsTestCase(unittest.TestCase):
    def setUp(self):
        subscriber = patch("frigate.stats.hardware.CameraConfigUpdateSubscriber")
        self.subscriber = subscriber.start()
        self.addCleanup(subscriber.stop)
        self.subscriber.return_value.check_for_updates.return_value = {}
        # probed hardware is treated as passed into the container by default
        device_nodes = patch(
            "frigate.stats.hardware._gpu_device_nodes_exist", return_value=True
        )
        self.device_nodes = device_nodes.start()
        self.addCleanup(device_nodes.stop)
        hardware._is_amd_vaapi.cache_clear()
        self.addCleanup(hardware._is_amd_vaapi.cache_clear)
    def make_config(self, hwaccel_args: str = "", **overrides) -> FrigateConfig:
        config = {
            "mqtt": {"host": "mqtt"},
            "cameras": {
                "back": {
                    "ffmpeg": {
                        "hwaccel_args": hwaccel_args,
                        "inputs": [
                            {"path": "rtsp://10.0.0.1:554/video", "roles": ["detect"]}
                        ],
                    },
                },
            },
            **overrides,
        }
        with patch("frigate.config.config.auto_detect_hwaccel", return_value=""):
            return FrigateConfig(**config)
    def make_stats(
        self, config: FrigateConfig | None = None, present: tuple[str, ...] = ()
    ) -> HardwareStats:
        with patch.object(
            hardware.hardware_prober,
            "probe",
            return_value=[found(key) for key in present],
        ):
            stats = HardwareStats(config or self.make_config())
        self.addCleanup(stats.stop)
        return stats
 class TestHwaccelHardware(HardwareStatsTestCase):
    def test_preset_and_raw_args(self):
        cases = {
            "preset-nvidia": "nvidia",
            "-c:v h264_cuvid": "nvidia",
            "preset-jetson-h264": "jetson",
            "-c:v h264_nvmpi": "jetson",
            "preset-intel-qsv-h264": "intel_gpu",
            "-hwaccel qsv": "intel_gpu",
            "preset-amd-amf": "amd_gpu",
            "preset-rk-h264": "rockchip",
            "preset-rkmpp": "rockchip",
            "preset-rpi-64-h264": "rpi",
            "-c:v h264_v4l2m2m": "rpi",
            "": None,
            "-hwaccel none": None,
        }
        for args, expected in cases.items():
            self.assertEqual(_hwaccel_hardware(args), expected, args)
    def test_vaapi_driver_disambiguation(self):
        with patch("frigate.stats.hardware.is_vaapi_amd_driver", return_value=True):
            self.assertEqual(_hwaccel_hardware("preset-vaapi"), "amd_gpu")
        hardware._is_amd_vaapi.cache_clear()
        with patch("frigate.stats.hardware.is_vaapi_amd_driver", return_value=False):
            self.assertEqual(_hwaccel_hardware("-hwaccel vaapi"), "intel_gpu")
    def test_vulkan_resolves_to_present_gpu(self):
        with patch.object(
            hardware.hardware_prober,
            "probe",
            return_value=[found("cpu"), found("onnx:amd")],
        ):
            self.assertEqual(_hwaccel_hardware("preset-vulkan"), "amd_gpu")
        with patch.object(
            hardware.hardware_prober, "probe", return_value=[found("cpu")]
        ):
            self.assertIsNone(_hwaccel_hardware("preset-vulkan"))
 class TestGpuDeviceNodes(HardwareStatsTestCase):
    def test_host_gpu_without_device_nodes_is_skipped(self):
        # /proc and /sys show the host's nvidia card even when it is not
        # passed into the container, so resolution falls to the intel GPU
        self.device_nodes.side_effect = lambda name: name != "nvidia"
        with patch.object(
            hardware.hardware_prober,
            "probe",
            return_value=[found("onnx:nvidia"), found("openvino:GPU")],
        ):
            self.assertEqual(hardware._present_gpu(), "intel_gpu")
    def test_device_node_globs(self):
        with patch("frigate.stats.hardware.glob", return_value=[]):
            self.assertFalse(_gpu_device_nodes_exist("nvidia"))
            self.assertFalse(_gpu_device_nodes_exist("intel_gpu"))
            self.assertFalse(_gpu_device_nodes_exist("amd_gpu"))
            self.assertTrue(_gpu_device_nodes_exist("jetson"))
        with patch(
            "frigate.stats.hardware.glob", return_value=["/dev/nvidia0"]
        ) as dev_glob:
            self.assertTrue(_gpu_device_nodes_exist("nvidia"))
            dev_glob.assert_called_with("/dev/nvidia*")
 class TestScanFfmpeg(HardwareStatsTestCase):
    def test_camera_and_input_args(self):
        config = self.make_config("preset-nvidia")
        config.cameras["back"].ffmpeg.inputs[0].hwaccel_args = "-hwaccel qsv"
        stats = self.make_stats(config)
        self.assertEqual(stats._scan_ffmpeg(), {"nvidia", "intel_gpu"})
    def test_no_hwaccel(self):
        stats = self.make_stats(self.make_config())
        self.assertEqual(stats._scan_ffmpeg(), set())
 class TestScanDetectors(HardwareStatsTestCase):
    def scan(self, specs: list[DeviceSpec], present: tuple[str, ...] = ()) -> set[str]:
        stats = self.make_stats()
        model = SimpleNamespace()
        stats.config = SimpleNamespace(
            models=[model], devices_for_model=lambda m: specs
        )
        with patch.object(
            hardware.hardware_prober,
            "probe",
            return_value=[found(key) for key in present],
        ):
            return stats._scan_detectors()
    def test_detector_mapping(self):
        self.assertEqual(self.scan([DeviceSpec("rknn", "rknn", None)]), {"rockchip"})
        self.assertEqual(
            self.scan([DeviceSpec("axengine", "axengine", None)]), {"axengine"}
        )
        self.assertEqual(
            self.scan([DeviceSpec("tensorrt:0", "tensorrt", "0")]), {"jetson"}
        )
        self.assertEqual(
            self.scan([DeviceSpec("openvino:NPU", "openvino", "NPU")]), {"intel_npu"}
        )
        self.assertEqual(
            self.scan([DeviceSpec("openvino:GPU", "openvino", "GPU")]), {"intel_gpu"}
        )
        self.assertEqual(
            self.scan([DeviceSpec("openvino", "openvino", None)]), {"intel_gpu"}
        )
        self.assertEqual(
            self.scan([DeviceSpec("openvino:CPU", "openvino", "CPU")]), set()
        )
        self.assertEqual(self.scan([DeviceSpec("cpu", "cpu", None)]), set())
        self.assertEqual(self.scan([DeviceSpec("hailo8l", "hailo8l", None)]), set())
    def test_onnx_resolves_to_present_gpu(self):
        spec = DeviceSpec("onnx", "onnx", None)
        self.assertEqual(self.scan([spec], ("onnx:nvidia",)), {"nvidia"})
        self.assertEqual(self.scan([spec], ("onnx:amd",)), {"amd_gpu"})
        self.assertEqual(self.scan([spec], ("cpu",)), set())
 class TestScanEnrichments(HardwareStatsTestCase):
    def scan(self, config: FrigateConfig, present: tuple[str, ...]) -> set[str]:
        stats = self.make_stats(config)
        with patch.object(
            hardware.hardware_prober,
            "probe",
            return_value=[found(key) for key in present],
        ):
            return stats._scan_enrichments()
    def test_semantic_search_large_demands_gpu(self):
        config = self.make_config(
            semantic_search={"enabled": True, "model_size": "large"}
        )
        self.assertEqual(self.scan(config, ("onnx:nvidia",)), {"nvidia"})
    def test_semantic_search_small_stays_cpu(self):
        config = self.make_config(
            semantic_search={"enabled": True, "model_size": "small"}
        )
        self.assertEqual(self.scan(config, ("onnx:nvidia",)), set())
    def test_semantic_search_explicit_cpu_device(self):
        config = self.make_config(
            semantic_search={"enabled": True, "model_size": "large", "device": "CPU"}
        )
        self.assertEqual(self.scan(config, ("onnx:nvidia",)), set())
    def test_face_recognition_defaults_to_gpu(self):
        config = self.make_config(face_recognition={"enabled": True})
        self.assertEqual(self.scan(config, ("onnx:amd",)), {"amd_gpu"})
    def test_lpr_defaults_to_auto(self):
        config = self.make_config(lpr={"enabled": True})
        self.assertEqual(self.scan(config, ("openvino:GPU",)), {"intel_gpu"})
    def test_no_gpu_present_means_no_demand(self):
        config = self.make_config(
            semantic_search={"enabled": True, "model_size": "large"}
        )
        self.assertEqual(self.scan(config, ("cpu",)), set())
    def test_audio_transcription_gpu_is_cuda_only(self):
        config = self.make_config()
        config.audio_transcription.enabled = True
        config.audio_transcription.device = "GPU"
        self.assertEqual(self.scan(config, ("onnx:nvidia",)), {"nvidia"})
        self.assertEqual(self.scan(config, ("onnx:amd",)), set())
 class TestUpdateConfig(HardwareStatsTestCase):
    def test_catalog_from_hwaccel(self):
        stats = self.make_stats(self.make_config("preset-nvidia"))
        self.assertEqual(set(stats._monitored), {"nvidia"})
    def test_telemetry_gates(self):
        config = self.make_config(
            "preset-intel-qsv-h264",
            telemetry={"stats": {"intel_gpu_stats": False}},
        )
        stats = self.make_stats(config)
        self.assertEqual(set(stats._monitored), set())
    def test_recalculated_on_config_update(self):
        config = self.make_config()
        stats = self.make_stats(config)
        self.assertEqual(set(stats._monitored), set())
        config.cameras["back"].ffmpeg.hwaccel_args = "preset-rk-h264"
        self.subscriber.return_value.check_for_updates.return_value = {
            "ffmpeg": ["back"]
        }
        with patch("frigate.stats.hardware.get_cpu_stats", return_value={}):
            stats.update_stats({})
        self.assertEqual(set(stats._monitored), {"rockchip"})
 class TestUpdateStats(HardwareStatsTestCase):
    def run_stats(self, stats: HardwareStats) -> dict:
        all_stats: dict = {}
        with patch("frigate.stats.hardware.get_cpu_stats", return_value={}):
            stats.update_stats(all_stats)
        return all_stats
    def test_polls_once_and_formats_legacy_shape(self):
        stats = self.make_stats(self.make_config("preset-nvidia"))
        usage = {
            0: {"name": "RTX", "gpu": 12.5, "mem": 25.0, "enc": 1, "dec": 2, "temp": 60}
        }
        with patch(
            "frigate.stats.hardware.get_nvidia_gpu_stats", return_value=usage
        ) as nvidia:
            all_stats = self.run_stats(stats)
        nvidia.assert_called_once()
        self.assertEqual(
            all_stats["gpu_usages"],
            {
                "RTX": {
                    "vendor": "nvidia",
                    "gpu": "12.5%",
                    "mem": "25.0%",
                    "enc": "1.0%",
                    "dec": "2.0%",
                    "temp": "60",
                }
            },
        )
    def test_failure_emits_fallback_and_latches_cooldown(self):
        stats = self.make_stats(self.make_config("preset-nvidia"))
        with patch(
            "frigate.stats.hardware.get_nvidia_gpu_stats", return_value={}
        ) as nvidia:
            all_stats = self.run_stats(stats)
            self.assertEqual(
                all_stats["gpu_usages"],
                {"nvidia-gpu": {"vendor": "nvidia", "gpu": "", "mem": ""}},
            )
            self.assertIn("nvidia", stats._errors)
            # in cooldown, the second cycle skips the poll
            all_stats = self.run_stats(stats)
            nvidia.assert_called_once()
            self.assertNotIn("gpu_usages", all_stats)
            # an expired cooldown is retried
            stats._errors["nvidia"] -= hardware.HARDWARE_ERROR_COOLDOWN_SECONDS + 1
            self.run_stats(stats)
            self.assertEqual(nvidia.call_count, 2)
    def test_npu_failure_latches_cooldown(self):
        stats = self.make_stats(self.make_config())
        stats._monitored = {"axengine": lambda: hardware._poll_axengine(stats.config)}
        with patch(
            "frigate.stats.hardware.get_axcl_npu_stats", return_value=None
        ) as axcl:
            all_stats = self.run_stats(stats)
            self.assertNotIn("npu_usages", all_stats)
            self.assertIn("axengine", stats._errors)
            self.run_stats(stats)
            axcl.assert_called_once()
    def test_rockchip_fills_both_buckets(self):
        stats = self.make_stats(self.make_config("preset-rk-h264"))
        with (
            patch(
                "frigate.stats.hardware.get_rockchip_gpu_stats",
                return_value={"gpu": "12.5%", "mem": "-%"},
            ),
            patch(
                "frigate.stats.hardware.get_rockchip_npu_stats",
                return_value={"npu": 42.0, "mem": "-%"},
            ),
        ):
            all_stats = self.run_stats(stats)
        self.assertEqual(
            all_stats["gpu_usages"],
            {"rockchip": {"vendor": "rockchip", "gpu": "12.5%", "mem": "-%"}},
        )
        self.assertEqual(
            all_stats["npu_usages"], {"rockchip": {"npu": 42.0, "mem": "-%"}}
        )
    def test_pollers_run_concurrently(self):
        stats = self.make_stats(self.make_config())
        def slow_poll() -> HardwarePollResult:
            time.sleep(0.2)
            return HardwarePollResult()
        stats._monitored = {"nvidia": slow_poll, "intel_gpu": slow_poll}
        start = time.monotonic()
        self.run_stats(stats)
        self.assertLess(time.monotonic() - start, 0.35)
 class TestHardwareTemperatures(unittest.TestCase):
    @patch("frigate.stats.hardware.read_temperature", side_effect=[45.0, 55.0])
    @patch("frigate.stats.hardware.os.listdir", return_value=["apex_1", "apex_0"])
    @patch("frigate.stats.hardware.os.path.isdir", return_value=True)
    def test_edgetpu_sorted_by_device(self, isdir, listdir, read):
        self.assertEqual(get_hardware_temperatures("edgetpu"), [45.0, 55.0])
        read.assert_any_call("/sys/class/apex/apex_0/temp")
    @patch(
        "frigate.stats.hardware.get_hailo_temps",
        return_value={"hailo8l-1": 52.0, "hailo8l-0": 51.0},
    )
    def test_hailo_sorted_by_name(self, temps):
        self.assertEqual(get_hardware_temperatures("hailo8l"), [51.0, 52.0])
    def test_unsupported_type(self):
        self.assertEqual(get_hardware_temperatures("rknn"), [])
@@ -1,225 +0,0 @@
 """Tests for the hardware decoding recommendation."""
 import os
 import tempfile
 import unittest
 from unittest.mock import patch
 from frigate.detectors.hardware import DetectionHardware
 from frigate.util import hwaccel
 def found(key: str) -> DetectionHardware:
    """A probe result carrying only the fields the recommendation reads."""
    return DetectionHardware(
        key=key,
        detector=key.partition(":")[0],
        name=key,
        units=[],
        count=0,
        unlimited=True,
    )
 class HwaccelRecommendationTestCase(unittest.TestCase):
    """Points every read at an empty fixture tree, so nothing is found by default."""
    def setUp(self):
        self.root = tempfile.TemporaryDirectory()
        self.addCleanup(self.root.cleanup)
        self.proc_root = os.path.join(self.root.name, "proc")
        os.makedirs(self.proc_root)
        patcher = patch.object(hwaccel, "PROC_ROOT", self.proc_root)
        patcher.start()
        self.addCleanup(patcher.stop)
        drm = patch.object(hwaccel, "enumerate_drm_devices", return_value={})
        self.drm = drm.start()
        self.addCleanup(drm.stop)
    def options(self, keys=(), detector_key=None, codecs=None):
        """Run the recommendation against a fixed set of hardware keys."""
        with patch.object(
            hwaccel.hardware_prober,
            "probe",
            return_value=[found(key) for key in keys],
        ):
            return hwaccel.hwaccel_options(detector_key, codecs)
    def recommend(self, keys=(), detector_key=None, codecs=None) -> str:
        """The recommended family key."""
        return self.options(keys, detector_key, codecs)[0]
    def available(self, keys=(), detector_key=None, codecs=None) -> list[str]:
        """The keys of the usable families, best first."""
        return [family.key for family in self.options(keys, detector_key, codecs)[1]]
    def presets(self, keys=(), detector_key=None, codecs=None) -> dict:
        """The presets each usable family provides."""
        return {
            family.key: family.presets
            for family in self.options(keys, detector_key, codecs)[1]
        }
    def write_cpuinfo(self, model_name: str) -> None:
        with open(os.path.join(self.proc_root, "cpuinfo"), "w") as f:
            f.write(f"processor\t: 0\nmodel name\t: {model_name}\n")
    def write_device_tree(self) -> None:
        os.makedirs(os.path.join(self.proc_root, "device-tree"), exist_ok=True)
        with open(os.path.join(self.proc_root, "device-tree", "compatible"), "w") as f:
            f.write("raspberrypi,5-model-b\x00brcm,bcm2712\x00")
 class TestPriority(HwaccelRecommendationTestCase):
    def test_nothing_found_recommends_nothing(self):
        self.assertEqual(self.recommend(), "")
    def test_nvidia_wins_over_intel(self):
        self.assertEqual(self.recommend(["onnx:nvidia", "openvino:GPU"]), "nvidia")
    def test_a_jetson_uses_its_own_family(self):
        self.assertEqual(self.recommend(["tensorrt"]), "jetson")
    def test_a_rockchip_uses_rkmpp(self):
        self.assertEqual(self.recommend(["rknn"]), "rkmpp")
    def test_an_amd_gpu_uses_vaapi(self):
        self.assertEqual(self.recommend(["onnx:amd"]), "vaapi")
 class TestDetectorBias(HwaccelRecommendationTestCase):
    def test_a_chosen_intel_gpu_beats_a_present_nvidia(self):
        self.assertEqual(
            self.recommend(["onnx:nvidia", "openvino:GPU"], "openvino:GPU"), "vaapi"
        )
    def test_a_chosen_npu_decodes_through_the_igpu(self):
        self.assertEqual(
            self.recommend(["openvino:NPU", "openvino:GPU"], "openvino:NPU"), "vaapi"
        )
    def test_an_npu_without_an_igpu_falls_through(self):
        self.assertEqual(self.recommend(["openvino:NPU"], "openvino:NPU"), "")
    def test_a_cpu_choice_still_recommends_the_present_gpu(self):
        self.assertEqual(self.recommend(["cpu", "openvino:GPU"], "cpu"), "vaapi")
 class TestIntelGeneration(HwaccelRecommendationTestCase):
    def test_the_xe_driver_prefers_qsv(self):
        self.drm.return_value = {"0000:00:02.0": "xe"}
        self.assertEqual(self.recommend(["openvino:GPU"], codecs={"h264"}), "intel-qsv")
    def test_gen13_prefers_qsv(self):
        self.write_cpuinfo("13th Gen Intel(R) Core(TM) i5-13500")
        self.assertEqual(self.recommend(["openvino:GPU"], codecs={"h264"}), "intel-qsv")
    def test_a_core_ultra_prefers_qsv(self):
        self.write_cpuinfo("Intel(R) Core(TM) Ultra 7 155H")
        self.assertEqual(self.recommend(["openvino:GPU"], codecs={"h264"}), "intel-qsv")
    def test_gen13_prefers_qsv_for_mixed_codecs(self):
        # each camera resolves the family to its own codec
        self.write_cpuinfo("13th Gen Intel(R) Core(TM) i5-13500")
        self.assertEqual(
            self.recommend(["openvino:GPU"], codecs={"h264", "h265"}), "intel-qsv"
        )
    def test_gen12_prefers_vaapi(self):
        self.write_cpuinfo("12th Gen Intel(R) Core(TM) i5-12400")
        self.assertEqual(self.recommend(["openvino:GPU"], codecs={"h264"}), "vaapi")
    def test_gen12_still_offers_qsv(self):
        self.write_cpuinfo("12th Gen Intel(R) Core(TM) i5-12400")
        self.assertEqual(self.available(["openvino:GPU"]), ["vaapi", "intel-qsv"])
    def test_an_older_model_string_prefers_vaapi(self):
        self.write_cpuinfo("Intel(R) Core(TM) i7-8700K CPU @ 3.70GHz")
        self.assertEqual(self.recommend(["openvino:GPU"], codecs={"h264"}), "vaapi")
    def test_missing_cpuinfo_prefers_vaapi(self):
        self.assertEqual(self.recommend(["openvino:GPU"], codecs={"h264"}), "vaapi")
    def test_qsv_is_not_offered_before_gen8(self):
        self.write_cpuinfo("7th Gen Intel(R) Core(TM) i5-7500")
        self.assertEqual(self.available(["openvino:GPU"]), ["vaapi"])
 class TestUnknownCodecs(HwaccelRecommendationTestCase):
    def test_a_codec_agnostic_family_wins_when_no_codec_is_known(self):
        # a qsv preset would have to guess a codec for cameras added later
        self.drm.return_value = {"0000:00:02.0": "xe"}
        self.assertEqual(self.recommend(["openvino:GPU"]), "vaapi")
    def test_hardware_with_no_agnostic_family_still_recommends(self):
        self.assertEqual(self.recommend(["tensorrt"]), "jetson")
 class TestAvailableFamilies(HwaccelRecommendationTestCase):
    def test_nothing_found_offers_nothing(self):
        self.assertEqual(self.available(), [])
    def test_only_families_the_hardware_can_use_are_offered(self):
        self.assertEqual(self.available(["onnx:nvidia"]), ["nvidia"])
    def test_a_pi_does_not_offer_desktop_gpu_families(self):
        self.write_device_tree()
        self.assertEqual(self.available(), ["rpi"])
    def test_an_intel_system_does_not_offer_the_pi_family(self):
        offered = self.available(["openvino:GPU"])
        self.assertIn("vaapi", offered)
        self.assertNotIn("rpi", offered)
        self.assertNotIn("nvidia", offered)
    def test_every_gpu_present_is_offered(self):
        offered = self.available(["onnx:nvidia", "openvino:GPU"])
        self.assertEqual(offered[0], "nvidia")
        self.assertIn("vaapi", offered)
    def test_a_gpu_wins_over_the_pi_fallback(self):
        self.write_device_tree()
        self.assertEqual(self.recommend(["onnx:nvidia"]), "nvidia")
    def test_the_recommendation_is_always_offered(self):
        recommended, families = self.options(["openvino:GPU"], codecs={"h264"})
        self.assertIn(recommended, [family.key for family in families])
 class TestCodecCoverage(HwaccelRecommendationTestCase):
    def test_a_family_carries_a_preset_per_codec(self):
        self.assertEqual(
            self.presets(["tensorrt"])["jetson"],
            {"h264": "preset-jetson-h264", "h265": "preset-jetson-h265"},
        )
    def test_a_codec_agnostic_family_carries_one_preset(self):
        self.assertEqual(
            self.presets(["onnx:nvidia"])["nvidia"], {"any": "preset-nvidia"}
        )
    def test_hevc_is_treated_as_h265(self):
        self.assertEqual(self.available(["tensorrt"], codecs={"hevc"}), ["jetson"])
    def test_a_family_that_cannot_decode_a_codec_is_dropped(self):
        # a jetson decodes h264 and h265 only, so an mjpeg camera rules it out
        self.assertEqual(self.available(["tensorrt"], codecs={"mjpeg"}), [])
    def test_codec_agnostic_families_survive_any_codec(self):
        self.assertEqual(
            self.available(["onnx:nvidia"], codecs={"mjpeg", "h265"}), ["nvidia"]
        )
    def test_a_dropped_family_hands_off_to_the_next_hardware(self):
        self.assertEqual(
            self.recommend(["tensorrt", "onnx:nvidia"], codecs={"mjpeg"}), "nvidia"
        )
 if __name__ == "__main__":
    unittest.main()
@@ -14,11 +14,6 @@ class FakePwEntry:
 # The devcontainer image exports FRIGATE_RUN_AS_ROOT, so any test that has to
 # reach past the escape-hatch check pins the variable instead of inheriting it.
 class TestGetRuntimeIds(unittest.TestCase):
    def setUp(self) -> None:
        ownership.get_runtime_ids.cache_clear()
        # a value cached under this test's patches must not leak into later modules
        self.addCleanup(ownership.get_runtime_ids.cache_clear)
    @patch("frigate.util.ownership.os.geteuid", return_value=1000)
    def test_returns_none_when_not_root(self, _):
        assert ownership.get_runtime_ids() is None
@@ -40,21 +35,8 @@ class TestGetRuntimeIds(unittest.TestCase):
    def test_returns_frigate_ids_as_root(self, *_):
        assert ownership.get_runtime_ids() == (1500, 1500)
    @patch.dict("os.environ", {"FRIGATE_RUN_AS_ROOT": "false"})
    @patch("frigate.util.ownership.pwd.getpwnam", return_value=FakePwEntry())
    @patch("frigate.util.ownership.os.geteuid", return_value=0)
    def test_caches_lookup(self, _geteuid, getpwnam):
        assert ownership.get_runtime_ids() == (1500, 1500)
        assert ownership.get_runtime_ids() == (1500, 1500)
        getpwnam.assert_called_once()
 class TestChownToRuntime(unittest.TestCase):
    def setUp(self) -> None:
        ownership.get_runtime_ids.cache_clear()
        # a value cached under this test's patches must not leak into later modules
        self.addCleanup(ownership.get_runtime_ids.cache_clear)
    @patch("frigate.util.ownership.os.chown")
    @patch("frigate.util.ownership.get_runtime_ids", return_value=None)
    def test_noop_when_no_runtime_ids(self, _, chown):
@@ -1,9 +1,7 @@
 import unittest
 from pydantic import ValidationError
 from frigate.api.auth import resolve_role
-from frigate.config import AuthConfig, HeaderMappingConfig, ProxyConfig
+from frigate.config import HeaderMappingConfig, ProxyConfig
 from frigate.config.env import FRIGATE_ENV_VARS
@@ -96,137 +94,6 @@ class TestProxyRoleResolution(unittest.TestCase):
        self.assertEqual(role, self.proxy_config.default_role)
 class TestDefaultRoleNone(unittest.TestCase):
    def setUp(self):
        self.proxy_config = ProxyConfig(
            auth_secret=None,
            default_role="none",
            separator="|",
            header_map=HeaderMappingConfig(
                user="x-remote-user",
                role="x-remote-role",
                role_map={
                    "admin": ["group_admin"],
                    "viewer": ["group_viewer"],
                },
            ),
        )
        self.config_roles = list(["admin", "viewer"])
    def test_default_role_none_no_match(self):
        """Unmatched groups resolve to 'none' when default_role is 'none'."""
        headers = {"x-remote-role": "group_unknown"}
        role = resolve_role(headers, self.proxy_config, self.config_roles)
        self.assertEqual(role, "none")
    def test_default_role_none_with_match(self):
        """Matched groups still resolve normally when default_role is 'none'."""
        headers = {"x-remote-role": "group_admin"}
        role = resolve_role(headers, self.proxy_config, self.config_roles)
        self.assertEqual(role, "admin")
    def test_default_role_none_missing_header(self):
        """A missing role header resolves to 'none'."""
        headers = {}
        role = resolve_role(headers, self.proxy_config, self.config_roles)
        self.assertEqual(role, "none")
    def test_default_role_none_empty_header(self):
        """An empty role header resolves to 'none'."""
        headers = {"x-remote-role": ""}
        role = resolve_role(headers, self.proxy_config, self.config_roles)
        self.assertEqual(role, "none")
    def test_default_role_none_no_role_map(self):
        """An invalid direct role name resolves to 'none' without a role_map."""
        config = ProxyConfig(
            auth_secret=None,
            default_role="none",
            separator="|",
            header_map=HeaderMappingConfig(
                user="x-remote-user",
                role="x-remote-role",
                role_map=None,
            ),
        )
        headers = {"x-remote-role": "notarole"}
        role = resolve_role(headers, config, self.config_roles)
        self.assertEqual(role, "none")
    def test_default_role_none_no_role_header_configured(self):
        """Proxy configs without a role header resolve to 'none'."""
        config = ProxyConfig(
            auth_secret=None,
            default_role="none",
            separator="|",
            header_map=HeaderMappingConfig(user="x-remote-user"),
        )
        role = resolve_role({}, config, self.config_roles)
        self.assertEqual(role, "none")
    def test_default_role_none_no_roles_configured(self):
        """'none' survives the empty config_roles edge case."""
        headers = {"x-remote-role": "group_admin"}
        role = resolve_role(headers, self.proxy_config, set())
        self.assertEqual(role, "none")
    def test_default_role_none_is_case_insensitive(self):
        """Capitalized spellings must deny, not fall back to viewer."""
        for spelling in ("None", "NONE", "nOnE", " none "):
            with self.subTest(default_role=spelling):
                config = ProxyConfig(
                    auth_secret=None,
                    default_role=spelling,
                    separator="|",
                    header_map=HeaderMappingConfig(
                        user="x-remote-user",
                        role="x-remote-role",
                        role_map={"admin": ["group_admin"]},
                    ),
                )
                self.assertEqual(config.default_role, "none")
                role = resolve_role(
                    {"x-remote-role": "group_unknown"}, config, self.config_roles
                )
                self.assertEqual(role, "none")
    def test_other_role_names_stay_case_sensitive(self):
        """Only the deny sentinel is normalized; role names are untouched."""
        config = ProxyConfig(default_role="Operator")
        self.assertEqual(config.default_role, "Operator")
 class TestReservedRoleNames(unittest.TestCase):
    def test_reserved_names_rejected(self):
        """admin, viewer, and the 'none' deny sentinel cannot be custom roles."""
        for name in ("admin", "viewer", "none"):
            with self.subTest(role=name):
                with self.assertRaises(ValidationError):
                    AuthConfig(roles={name: ["front_door"]})
    def test_custom_role_still_allowed(self):
        config = AuthConfig(roles={"operator": ["front_door"]})
        self.assertEqual(config.roles["operator"], ["front_door"])
    def test_error_names_the_offending_role(self):
        """The message must say which name to rename, in a stable order."""
        with self.assertRaises(ValidationError) as ctx:
            AuthConfig(roles={"none": ["front_door"], "admin": ["front_door"]})
        self.assertIn("admin, none", str(ctx.exception))
    def test_none_reserved_in_every_casing(self):
        """proxy.default_role folds case, so a 'None' role would be unreachable."""
        for name in ("None", "NONE", "nOnE"):
            with self.subTest(role=name):
                with self.assertRaises(ValidationError):
                    AuthConfig(roles={name: ["front_door"]})
    def test_case_variant_of_a_normal_role_still_allowed(self):
        """Only 'none' folds case; other role names are untouched."""
        config = AuthConfig(roles={"Operator": ["front_door"]})
        self.assertEqual(config.roles["Operator"], ["front_door"])
 class TestProxyAuthSecretEnvString(unittest.TestCase):
    def setUp(self):
        self._original_env_vars = dict(FRIGATE_ENV_VARS)
@@ -442,71 +442,6 @@ class TestSegmentPathTime(unittest.IsolatedAsyncioTestCase):
        self.assertTrue(paths[1].endswith("30.23.mp4"), paths[1])
 class TestMoveSegmentOwnership(unittest.IsolatedAsyncioTestCase):
    """Every directory level makedirs creates must be handed to the runtime user."""
    def _build_maintainer(self) -> RecordingMaintainer:
        camera_config = MagicMock()
        camera_config.record.enabled = True
        camera_config.record.continuous.days = 1
        camera_config.record.motion.days = 0
        config = MagicMock()
        config.cameras = {"test_cam": camera_config}
        maintainer = RecordingMaintainer.__new__(RecordingMaintainer)
        maintainer.config = config
        maintainer.end_time_cache = {}
        maintainer.object_recordings_info = defaultdict(list)
        maintainer.audio_recordings_info = defaultdict(list)
        maintainer.recordings_publisher = MagicMock()
        maintainer.last_segment_end = {("test_cam", "main"): 0.0}
        return maintainer
    async def test_move_segment_chowns_all_created_levels(self):
        maintainer = self._build_maintainer()
        maintainer.config.ffmpeg.ffmpeg_path = "ffmpeg"
        start_time = datetime.datetime(2026, 6, 10, 14, 30, 22, tzinfo=datetime.UTC)
        proc = MagicMock()
        proc.returncode = 0
        proc.wait = AsyncMock(return_value=0)
        chown = MagicMock()
        with tempfile.TemporaryDirectory() as tmpdir:
            record_dir = os.path.join(tmpdir, "recordings")
            cache_path = os.path.join(tmpdir, "test_cam@20260610143022+0000.mp4")
            with open(cache_path, "wb") as f:
                f.write(b"\x00" * 16)
            with (
                patch("frigate.record.maintainer.RECORD_DIR", record_dir),
                patch(
                    "frigate.record.maintainer.asyncio.create_subprocess_exec",
                    AsyncMock(return_value=proc),
                ),
                patch("frigate.record.maintainer.chown_to_runtime", chown),
            ):
                result = await maintainer.move_segment(
                    "test_cam",
                    "main",
                    start_time,
                    start_time + datetime.timedelta(seconds=10),
                    10.0,
                    cache_path,
                    SegmentInfo(0, 0, 0, 0),
                )
            self.assertIsNotNone(result)
            camera_dir = os.path.join(record_dir, "2026-06-10", "14", "test_cam")
            hour_dir = os.path.dirname(camera_dir)
            date_dir = os.path.dirname(hour_dir)
            file_path = os.path.join(camera_dir, "30.22.mp4")
            chowned = [call.args[0] for call in chown.call_args_list]
            self.assertEqual(chowned, [camera_dir, hour_dir, date_dir, file_path])
 class TestSegmentStartChaining(unittest.IsolatedAsyncioTestCase):
    """Contiguous segments must chain start times across filename truncation.
@@ -1,563 +0,0 @@
 """Tests for runtime installation of detector SDKs into the user site."""
 import ctypes
 import hashlib
 import io
 import json
 import os
 import stat
 import subprocess
 import sys
 import tarfile
 import tempfile
 import unittest
 import zipfile
 from pathlib import Path
 from unittest.mock import patch
 from frigate.util import runtime_deps
 from frigate.util.runtime_deps import (
    ArchiveDest,
    ArchiveMapping,
    Artifact,
    ArtifactKind,
    RuntimeDependencyError,
    RuntimeManifest,
    activate,
    ensure_installed,
    find_tool,
 )
 LIB_PREFIX = "rootfs/usr/local/lib/"
 BIN_PREFIX = "rootfs/usr/local/bin/"
 MAPPINGS = (
    ArchiveMapping(LIB_PREFIX, ArchiveDest.lib),
    ArchiveMapping(BIN_PREFIX, ArchiveDest.bin),
 )
 def sha256(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()
 def make_tarball(members: dict[str, bytes | str], exec_names=()) -> bytes:
    """Build a tar.gz; a str value is a symlink target, bytes a file."""
    buffer = io.BytesIO()
    with tarfile.open(fileobj=buffer, mode="w:gz") as archive:
        for name, content in members.items():
            info = tarfile.TarInfo(name)
            if isinstance(content, str):
                info.type = tarfile.SYMTYPE
                info.linkname = content
                archive.addfile(info)
            else:
                info.size = len(content)
                info.mode = 0o755 if name in exec_names else 0o644
                archive.addfile(info, io.BytesIO(content))
    return buffer.getvalue()
 def make_zip(members: dict[str, bytes | str]) -> bytes:
    """Build a zip the way GitHub archives do, symlinks included."""
    buffer = io.BytesIO()
    with zipfile.ZipFile(buffer, "w") as archive:
        for name, content in members.items():
            info = zipfile.ZipInfo(name)
            if isinstance(content, str):
                info.external_attr = (stat.S_IFLNK | 0o777) << 16
                archive.writestr(info, content)
            else:
                info.external_attr = (stat.S_IFREG | 0o644) << 16
                archive.writestr(info, content)
    return buffer.getvalue()
 class RuntimeDepsTestCase(unittest.TestCase):
    def setUp(self) -> None:
        self.tmp = tempfile.TemporaryDirectory()
        root = Path(self.tmp.name)
        self.base = root / "base"
        self.site = self.base / "lib" / "python" / "site-packages"
        self.cache = root / "cache"
        self.downloads: list[str] = []
        self.download_content: bytes | None = None
        self.sys_path = list(sys.path)
        runtime_deps._loaded_libs.clear()
        def download(url: str, save_path: str, silent: bool = False) -> Path:
            self.downloads.append(url)
            if self.download_content is None:
                raise OSError("network is off")
            Path(save_path).write_bytes(self.download_content)
            return Path(save_path)
        self.patches = [
            patch.object(runtime_deps, "user_base", lambda: self.base),
            patch.object(runtime_deps, "user_site", lambda: self.site),
            patch.object(runtime_deps, "cache_dir", lambda name: self.cache / name),
            patch.object(runtime_deps.site, "ENABLE_USER_SITE", True),
            patch(
                "frigate.util.downloader.ModelDownloader.download_from_url", download
            ),
            patch("os.geteuid", return_value=1000),
            patch.dict("os.environ", {}, clear=True),
        ]
        for p in self.patches:
            p.start()
    def tearDown(self) -> None:
        for p in reversed(self.patches):
            p.stop()
        sys.path[:] = self.sys_path
        self.tmp.cleanup()
    def archive_manifest(
        self, data: bytes, version: str = "1.0", name: str = "test"
    ) -> RuntimeManifest:
        return RuntimeManifest(
            name=name,
            version=version,
            artifacts=(
                Artifact(
                    url=f"https://github.com/org/repo/releases/download/v{version}/runtime.tar.gz",
                    sha256=sha256(data),
                    kind=ArtifactKind.archive,
                    mappings=MAPPINGS,
                ),
            ),
        )
    def preseed(self, manifest: RuntimeManifest, data: bytes) -> Path:
        path = self.cache / manifest.name / manifest.artifacts[0].name
        path.parent.mkdir(parents=True, exist_ok=True)
        path.write_bytes(data)
        return path
 class TestFetch(RuntimeDepsTestCase):
    def test_preseeded_file_with_matching_sha256_skips_download(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": b"lib"})
        manifest = self.archive_manifest(data)
        self.preseed(manifest, data)
        ensure_installed(manifest)
        self.assertEqual(self.downloads, [])
        self.assertEqual((self.base / "lib" / "libfoo.so").read_bytes(), b"lib")
    def test_preseeded_file_with_wrong_sha256_is_downloaded_again(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": b"lib"})
        manifest = self.archive_manifest(data)
        self.preseed(manifest, b"corrupt")
        self.download_content = data
        ensure_installed(manifest)
        self.assertEqual(len(self.downloads), 1)
        self.assertTrue((self.base / "lib" / "libfoo.so").is_file())
    def test_download_with_wrong_sha256_raises_and_removes_file(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": b"lib"})
        manifest = self.archive_manifest(data)
        self.download_content = b"tampered"
        with self.assertRaises(RuntimeDependencyError):
            ensure_installed(manifest)
        self.assertFalse((self.cache / "test" / "runtime.tar.gz").exists())
        self.assertFalse((self.base / "lib" / "libfoo.so").exists())
    def test_download_failure_names_the_preseed_directory(self) -> None:
        manifest = self.archive_manifest(b"whatever")
        with self.assertRaises(RuntimeDependencyError) as ctx:
            ensure_installed(manifest)
        self.assertIn(str(self.cache / "test"), str(ctx.exception))
    def test_github_endpoint_mirror_is_honored(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": b"lib"})
        manifest = self.archive_manifest(data)
        self.download_content = data
        with patch.dict("os.environ", {"GITHUB_ENDPOINT": "https://mirror.test/"}):
            ensure_installed(manifest)
        self.assertEqual(
            self.downloads,
            ["https://mirror.test/org/repo/releases/download/v1.0/runtime.tar.gz"],
        )
    def test_non_github_urls_are_left_alone(self) -> None:
        with patch.dict("os.environ", {"GITHUB_ENDPOINT": "https://mirror.test"}):
            self.assertEqual(
                runtime_deps.resolve_url("https://example.com/a.whl"),
                "https://example.com/a.whl",
            )
 class TestInstall(RuntimeDepsTestCase):
    def test_archive_extracts_lib_and_bin_with_exec_bits_and_symlinks(self) -> None:
        data = make_tarball(
            {
                f"{LIB_PREFIX}libfoo.so.1": b"lib",
                f"{LIB_PREFIX}libfoo.so": "libfoo.so.1",
                f"{BIN_PREFIX}tool": b"#!/bin/sh\n",
                "rootfs/etc/ignored": b"no",
            },
            exec_names=(f"{BIN_PREFIX}tool",),
        )
        manifest = self.archive_manifest(data)
        self.preseed(manifest, data)
        ensure_installed(manifest)
        lib = self.base / "lib"
        self.assertEqual((lib / "libfoo.so.1").read_bytes(), b"lib")
        self.assertEqual(os.readlink(lib / "libfoo.so"), "libfoo.so.1")
        self.assertTrue(os.access(self.base / "bin" / "tool", os.X_OK))
        self.assertFalse((self.base / "etc").exists())
        stamp = json.loads(
            (self.base / "share" / "frigate" / "runtimes" / "test.json").read_text()
        )
        self.assertEqual(stamp["version"], "1.0")
        self.assertEqual(len(stamp["files"]), 3)
    def test_zip_archive_with_include_filter_and_site_packages_dest(self) -> None:
        data = make_zip(
            {
                "pkg-1.0/pkg/__init__.py": b"",
                "pkg-1.0/pkg/x86/libx.so.2": b"lib",
                "pkg-1.0/pkg/x86/libx.so": "libx.so.2",
                "pkg-1.0/pkg/x86/other.txt": b"skip",
            }
        )
        manifest = RuntimeManifest(
            name="test",
            version="1.0",
            artifacts=(
                Artifact(
                    url="https://github.com/org/pkg/archive/refs/tags/v1.0.zip",
                    sha256=sha256(data),
                    kind=ArtifactKind.archive,
                    filename="pkg-1.0.zip",
                    mappings=(
                        ArchiveMapping(
                            "pkg-1.0/pkg/", ArchiveDest.site_packages, subdir="pkg"
                        ),
                        ArchiveMapping(
                            "pkg-1.0/pkg/x86/", ArchiveDest.lib, include=("libx.so*",)
                        ),
                    ),
                ),
            ),
        )
        self.preseed(manifest, data)
        ensure_installed(manifest)
        self.assertTrue((self.site / "pkg" / "__init__.py").is_file())
        self.assertEqual(os.readlink(self.base / "lib" / "libx.so"), "libx.so.2")
        self.assertTrue((self.base / "lib" / "libx.so.2").is_file())
        self.assertFalse((self.base / "lib" / "other.txt").exists())
    def test_archive_member_escaping_destination_is_rejected(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}../../../../escaped": b"evil"})
        manifest = self.archive_manifest(data)
        self.preseed(manifest, data)
        with self.assertRaises(RuntimeDependencyError):
            ensure_installed(manifest)
        self.assertFalse((Path(self.tmp.name) / "escaped").exists())
    def test_symlink_pointing_outside_its_directory_is_rejected(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": "../../etc/passwd"})
        manifest = self.archive_manifest(data)
        self.preseed(manifest, data)
        with self.assertRaises(RuntimeDependencyError):
            ensure_installed(manifest)
    def test_wheel_is_installed_with_pip_into_the_user_site(self) -> None:
        data = b"not really a wheel"
        manifest = RuntimeManifest(
            name="test",
            version="1.0",
            artifacts=(
                Artifact(
                    url="https://example.com/thing-1.0-py3-none-any.whl",
                    sha256=sha256(data),
                    kind=ArtifactKind.wheel,
                ),
            ),
        )
        self.preseed(manifest, data)
        completed = subprocess.CompletedProcess([], 0, stdout="", stderr="")
        with patch.object(
            runtime_deps.subprocess, "run", return_value=completed
        ) as run:
            ensure_installed(manifest)
        args = run.call_args.args[0]
        self.assertEqual(args[:4], [sys.executable, "-m", "pip", "install"])
        self.assertIn("--user", args)
        self.assertIn("--no-index", args)
        self.assertIn("--no-deps", args)
        self.assertTrue(args[-1].endswith("thing-1.0-py3-none-any.whl"))
        # the staged copy is installed, not the one in the cache
        self.assertFalse(args[-1].startswith(str(self.cache)))
    def test_failed_pip_install_raises(self) -> None:
        data = b"wheel"
        manifest = RuntimeManifest(
            name="test",
            version="1.0",
            artifacts=(
                Artifact(
                    url="https://example.com/thing-1.0-py3-none-any.whl",
                    sha256=sha256(data),
                    kind=ArtifactKind.wheel,
                ),
            ),
        )
        self.preseed(manifest, data)
        completed = subprocess.CompletedProcess([], 1, stdout="", stderr="boom")
        with (
            patch.object(runtime_deps.subprocess, "run", return_value=completed),
            self.assertRaises(RuntimeDependencyError),
        ):
            ensure_installed(manifest)
    def test_matching_stamp_skips_a_second_install(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": b"lib"})
        manifest = self.archive_manifest(data)
        self.preseed(manifest, data)
        ensure_installed(manifest)
        with patch.object(runtime_deps, "_extract_archive") as extract:
            ensure_installed(manifest)
        extract.assert_not_called()
    def test_missing_installed_file_triggers_a_reinstall(self) -> None:
        data = make_tarball({f"{LIB_PREFIX}libfoo.so": b"lib"})
        manifest = self.archive_manifest(data)
        self.preseed(manifest, data)
        ensure_installed(manifest)
        (self.base / "lib" / "libfoo.so").unlink()
        ensure_installed(manifest)
        self.assertTrue((self.base / "lib" / "libfoo.so").is_file())
    def test_version_bump_reinstalls_and_removes_old_files(self) -> None:
        old = make_tarball({f"{LIB_PREFIX}libfoo.so.1": b"old"})
        old_manifest = self.archive_manifest(old, version="1.0")
        self.preseed(old_manifest, old)
        ensure_installed(old_manifest)
        new = make_tarball({f"{LIB_PREFIX}libfoo.so.2": b"new"})
        new_manifest = self.archive_manifest(new, version="2.0")
        self.preseed(new_manifest, new)
        ensure_installed(new_manifest)
        self.assertFalse((self.base / "lib" / "libfoo.so.1").exists())
        self.assertEqual((self.base / "lib" / "libfoo.so.2").read_bytes(), b"new")
    def test_only_artifacts_for_the_current_machine_are_used(self) -> None:
        x86 = make_tarball({f"{LIB_PREFIX}libx86.so": b"x"})
        arm = make_tarball({f"{LIB_PREFIX}libarm.so": b"a"})
        manifest = RuntimeManifest(
            name="test",
            version="1.0",
            artifacts=(
                Artifact(
                    url="https://example.com/x86.tar.gz",
                    sha256=sha256(x86),
                    kind=ArtifactKind.archive,
                    mappings=MAPPINGS,
                    machines=("x86_64",),
                ),
                Artifact(
                    url="https://example.com/arm.tar.gz",
                    sha256=sha256(arm),
                    kind=ArtifactKind.archive,
                    mappings=MAPPINGS,
                    machines=("aarch64",),
                ),
            ),
        )
        (self.cache / "test").mkdir(parents=True)
        (self.cache / "test" / "x86.tar.gz").write_bytes(x86)
        (self.cache / "test" / "arm.tar.gz").write_bytes(arm)
        with patch.object(runtime_deps.platform, "machine", return_value="aarch64"):
            ensure_installed(manifest)
        self.assertTrue((self.base / "lib" / "libarm.so").is_file())
        self.assertFalse((self.base / "lib" / "libx86.so").exists())
 class TestRootGuard(RuntimeDepsTestCase):
    """A root frigate service must never load code from a uid-1000 tree."""
    def test_refuses_a_runtime_user_writable_base_under_granular_root(self) -> None:
        manifest = self.archive_manifest(b"data")
        with (
            patch.object(runtime_deps, "user_base", lambda: Path("/config/.local")),
            patch("os.geteuid", return_value=0),
            patch.dict("os.environ", {"FRIGATE_ROOT_SERVICES": "frigate"}),
        ):
            with self.assertRaises(RuntimeDependencyError) as ctx:
                ensure_installed(manifest)
            self.assertIn("FRIGATE_ROOT_SERVICES", str(ctx.exception))
            self.assertIsNotNone(runtime_deps._usable_reason())
    def test_root_owned_base_is_allowed_under_granular_root(self) -> None:
        with (
            patch.object(runtime_deps, "user_base", lambda: Path("/root/.local")),
            patch("os.geteuid", return_value=0),
            patch.dict("os.environ", {"FRIGATE_ROOT_SERVICES": "frigate"}),
        ):
            self.assertIsNone(runtime_deps._usable_reason())
    def test_escape_hatch_is_not_guarded(self) -> None:
        with (
            patch.object(runtime_deps, "user_base", lambda: Path("/config/.local")),
            patch("os.geteuid", return_value=0),
            patch.dict("os.environ", {"FRIGATE_RUN_AS_ROOT": "true"}),
        ):
            self.assertIsNone(runtime_deps._usable_reason())
    def test_disabled_user_site_is_refused(self) -> None:
        with patch.object(runtime_deps.site, "ENABLE_USER_SITE", False):
            self.assertIsNotNone(runtime_deps._usable_reason())
    def test_activate_skips_a_refused_runtime(self) -> None:
        self.site.mkdir(parents=True)
        with (
            patch.object(runtime_deps, "user_base", lambda: Path("/config/.local")),
            patch("os.geteuid", return_value=0),
            patch.dict("os.environ", {"FRIGATE_ROOT_SERVICES": "frigate"}),
        ):
            activate(RuntimeManifest(name="test", version="1", artifacts=()))
        self.assertNotIn(str(self.site), sys.path)
 class TestActivate(RuntimeDepsTestCase):
    def test_adds_the_user_site_ahead_of_system_site_packages(self) -> None:
        self.site.mkdir(parents=True)
        activate(RuntimeManifest(name="test", version="1", artifacts=()))
        self.assertIn(str(self.site), sys.path)
        system = [
            i
            for i, p in enumerate(sys.path)
            if p.endswith(("site-packages", "dist-packages")) and p != str(self.site)
        ]
        if system:
            self.assertLess(sys.path.index(str(self.site)), system[0])
    def test_preloads_libraries_in_order_with_rtld_global(self) -> None:
        lib = self.base / "lib"
        lib.mkdir(parents=True)
        (lib / "liba.so").write_bytes(b"")
        (lib / "libb.so").write_bytes(b"")
        manifest = RuntimeManifest(
            name="test", version="1", artifacts=(), preload=("liba.so", "libb.so")
        )
        with patch.object(runtime_deps.ctypes, "CDLL") as cdll:
            activate(manifest)
            activate(manifest)
        self.assertEqual(
            [c.args[0] for c in cdll.call_args_list],
            [str(lib / "liba.so"), str(lib / "libb.so")],
        )
        self.assertTrue(
            all(c.kwargs["mode"] == ctypes.RTLD_GLOBAL for c in cdll.call_args_list)
        )
    def test_missing_ld_library_path_is_reported(self) -> None:
        manifest = RuntimeManifest(
            name="test", version="1", artifacts=(), needs_ld_library_path=True
        )
        with self.assertLogs(runtime_deps.logger, level="WARNING") as logs:
            activate(manifest)
        self.assertTrue(any("LD_LIBRARY_PATH" in line for line in logs.output))
        with (
            patch.dict(
                "os.environ", {"LD_LIBRARY_PATH": f"/usr/lib:{self.base / 'lib'}"}
            ),
            self.assertNoLogs(runtime_deps.logger, level="WARNING"),
        ):
            activate(manifest)
    def test_find_tool_prefers_the_user_bin(self) -> None:
        tool = self.base / "bin" / "sh"
        tool.parent.mkdir(parents=True)
        tool.write_text("#!/bin/sh\n")
        tool.chmod(0o755)
        self.assertEqual(find_tool("sh"), str(tool))
        self.assertEqual(find_tool("definitely-not-a-tool"), "definitely-not-a-tool")
 class TestDeclaredManifests(unittest.TestCase):
    """Every manifest a detector declares must be complete and pinned."""
    def test_manifests_are_pinned_for_both_architectures(self) -> None:
        from frigate.detectors import api_types
        manifests = [
            api.runtime_manifest
            for api in api_types.values()
            if api.runtime_manifest is not None
        ]
        self.assertGreaterEqual(len(manifests), 3)
        for manifest in manifests:
            with self.subTest(manifest=manifest.name):
                self.assertTrue(manifest.version)
                self.assertTrue(manifest.import_check)
                for artifact in manifest.artifacts:
                    self.assertRegex(artifact.sha256, r"^[0-9a-f]{64}$")
                    self.assertTrue(artifact.url.startswith("https://"))
                for machine in ("x86_64", "aarch64"):
                    self.assertTrue(
                        any(
                            not a.machines or machine in a.machines
                            for a in manifest.artifacts
                        ),
                        f"no artifact for {machine}",
                    )
 if __name__ == "__main__":
    unittest.main()
@@ -54,11 +54,6 @@ class TrackedObject:
        self.obj_data = obj_data
        self.colormap = model_config.colormap
        self.logos = model_config.all_attribute_logos
        self.thumbnail_attributes = [
            attr
            for attr in model_config.attributes_map.get(obj_data["label"], [])
            if attr in model_config.non_logo_attributes
        ]
        self.camera_config = camera_config
        self.ui_config = ui_config
        self.frame_cache = frame_cache
@@ -154,7 +149,7 @@ class TrackedObject:
        if not self.false_positive and has_valid_frame:
            # determine if this frame is a better thumbnail
            if self.thumbnail_data is None or is_better_thumbnail(
-                self.thumbnail_attributes,
+                self.obj_data["label"],
                self.thumbnail_data,
                obj_data,
                self.camera_config.frame_shape,
@@ -4,14 +4,11 @@ import asyncio
 import logging
 import os
 import shutil
 from functools import cache
 from typing import Any
 from ruamel.yaml import YAML
 from frigate.const import (
    BASE_DIR,
    CACHE_DIR,
    CONFIG_DIR,
    DEFAULT_FFMPEG_VERSION,
    EXPORT_DIR,
@@ -46,56 +43,13 @@ DROPPED_DETECTOR_OPTIONS = {
 }
 # Trees the unprivileged runtime user can write. A root frigate service must
 # not execute a binary from any of them; a compromised uid-1000 process could
 # plant one and be root after the next restart.
 RUNTIME_USER_WRITABLE_DIRS = (CONFIG_DIR, BASE_DIR, CACHE_DIR, "/dev/shm", "/tmp")
 def frigate_service_is_granular_root() -> bool:
    """Report whether FRIGATE_ROOT_SERVICES runs frigate as root.
    The escape hatch is excluded: it never sweeps /config and leaves no
    unprivileged service running, so custom binaries stay as safe as they
    were before the privilege drop.
    """
    if os.geteuid() != 0:
        return False
    if os.environ.get("FRIGATE_RUN_AS_ROOT", "false") == "true":
        return False
    entries = os.environ.get("FRIGATE_ROOT_SERVICES", "").split(",")
    return any("".join(entry.split()) == "frigate" for entry in entries)
 def is_runtime_user_writable(path: str) -> bool:
    """Report whether a path resolves inside a runtime-user-writable tree."""
    resolved = os.path.realpath(path)
    return any(
        resolved == root or resolved.startswith(f"{root}{os.sep}")
        for root in RUNTIME_USER_WRITABLE_DIRS
    )
@cache
 def _warn_ignored_ffmpeg_path(path: str) -> None:
    """Warn once per path; resolution runs per camera and per binary."""
    logger.warning(
        "Ignoring ffmpeg.path %s because FRIGATE_ROOT_SERVICES runs frigate as root and that location is writable by the unprivileged user; using the bundled build",
        path,
    )
 def resolve_ffmpeg_path(path: str, binary: str = "ffmpeg") -> str:
    """Resolve an ffmpeg version alias or custom path to a binary path.
    A bare version alias that is no longer bundled (for example one that was
    dropped when the default version changed) falls back to the default
    bundled version so existing configs keep working across an upgrade or a
-    revert. Custom install paths (anything absolute) are used as-is, except
+    revert. Custom install paths (anything absolute) are used as-is.
    one in a runtime-user-writable tree while FRIGATE_ROOT_SERVICES makes
    frigate root; see RUNTIME_USER_WRITABLE_DIRS.
    """
    if path == "default" or (
        not path.startswith("/") and path not in INCLUDED_FFMPEG_VERSIONS
@@ -104,11 +58,7 @@ def resolve_ffmpeg_path(path: str, binary: str = "ffmpeg") -> str:
    elif path in INCLUDED_FFMPEG_VERSIONS:
        version = path
    else:
-        if not (frigate_service_is_granular_root() and is_runtime_user_writable(path)):
+        return f"{path}/bin/{binary}"
            return f"{path}/bin/{binary}"
        _warn_ignored_ffmpeg_path(path)
        version = DEFAULT_FFMPEG_VERSION
    return f"/usr/lib/ffmpeg/{version}/bin/{binary}"
@@ -129,20 +79,10 @@ def redact_credential(obj: dict[str, Any], key: str) -> None:
 def find_config_file() -> str:
    """Return the path of the config file to use.
    Both .yml and .yaml are supported, so fall back to the other extension when
    the configured path does not exist. If neither exists the configured path is
    returned so a new config is created with the default .yml extension.
    """
    config_path = os.environ.get("CONFIG_FILE", DEFAULT_CONFIG_FILE)
    if not os.path.isfile(config_path):
-        base, ext = os.path.splitext(config_path)
+        config_path = config_path.replace("yml", "yaml")
        alternate = f"{base}.yaml" if ext == ".yml" else f"{base}.yml"
        if os.path.isfile(alternate):
            return alternate
    return config_path
@@ -652,7 +592,7 @@ def migrate_018_0(config: dict[str, dict[str, Any]]) -> dict[str, dict[str, Any]
    genai = new_config.get("genai")
    if genai and genai.get("provider"):
-        genai["roles"] = ["descriptions", "chat"]
+        genai["roles"] = ["embeddings", "descriptions", "chat"]
        new_config["genai"] = {"default": genai}
    # Remove deprecated sync_recordings from global record config
@@ -20,15 +20,14 @@ logger = logging.getLogger(__name__)
 def get_event_thumbnail_bytes(event: Event) -> bytes | None:
    # callers treat empty bytes as a valid image, so normalize them to None
    if event.thumbnail:
-        return base64.b64decode(event.thumbnail) or None
+        return base64.b64decode(event.thumbnail)
    else:
        try:
            with open(
                os.path.join(THUMB_DIR, event.camera, f"{event.id}.webp"), "rb"
            ) as f:
-                return f.read() or None
+                return f.read()
        except Exception:
            return None
@@ -1,273 +0,0 @@
 """Recommendation of ffmpeg hwaccel presets from the hardware on the system.
 Every check is a filesystem read, like the detection hardware probes, so this
 is cheap enough to serve from the API process.
 Presets are grouped into families because some of them only decode the codec
 they name. A family hides that: callers pick the family their hardware needs
 and resolve it per camera against that camera's detect stream.
 """
 import logging
 import re
 from pydantic import BaseModel, Field
 from frigate.const import (
    FFMPEG_HWACCEL_NVIDIA,
    FFMPEG_HWACCEL_RKMPP,
    FFMPEG_HWACCEL_VAAPI,
 )
 from frigate.detectors.hardware import hardware_prober
 from frigate.util.services import enumerate_drm_devices
 logger = logging.getLogger(__name__)
 # root the /proc reads use, so tests can point them at a fixture tree
 PROC_ROOT = "/proc"
 ANY_CODEC = "any"
 # a Raspberry Pi has no detection hardware of its own, so it gets a key here
 RASPBERRY_PI = "raspberrypi"
 # ffprobe names h265 streams hevc
 CODEC_ALIASES = {"hevc": "h265"}
 # e.g. "13th Gen Intel(R) Core(TM) i5-13500"
 INTEL_GEN_PATTERN = re.compile(r"(\d+)th Gen")
 # Core Ultra dropped the generation prefix and is newer than all of them
 INTEL_ULTRA_PATTERN = re.compile(r"Core\(TM\) Ultra")
 INTEL_GEN_LATEST = 99
 # per the hwaccel docs, gen13+ and Arc prefer qsv while older is safest on
 # vaapi, and qsv is not supported at all before gen8
 INTEL_QSV_MIN_GEN = 13
 INTEL_QSV_SUPPORTED_GEN = 8
 # decode capable detection hardware, in recommendation priority order
 DECODE_HARDWARE = (
    "onnx:nvidia",
    "tensorrt",
    "rknn",
    "openvino:GPU",
    "onnx:amd",
    RASPBERRY_PI,
 )
 class HwaccelFamily(BaseModel):
    """A kind of hardware decoding, and the presets that drive it."""
    key: str = Field(
        title="Family key",
        description="Stable identifier for this kind of hardware decoding.",
    )
    presets: dict[str, str] = Field(
        title="Presets",
        description="The ffmpeg preset for each codec this family decodes, or a single 'any' preset when it decodes every codec.",
    )
 class HwaccelRecommendation(BaseModel):
    """The hardware decoding this system can do."""
    recommended: str = Field(
        title="Recommended family",
        description="Key of the family that fits this system best, or an empty string when none does.",
    )
    available: list[HwaccelFamily] = Field(
        default_factory=list,
        title="Available families",
        description="Every family this system's hardware can use, best first.",
    )
 FAMILY_NVIDIA = HwaccelFamily(key="nvidia", presets={ANY_CODEC: FFMPEG_HWACCEL_NVIDIA})
 FAMILY_VAAPI = HwaccelFamily(key="vaapi", presets={ANY_CODEC: FFMPEG_HWACCEL_VAAPI})
 FAMILY_RKMPP = HwaccelFamily(key="rkmpp", presets={ANY_CODEC: FFMPEG_HWACCEL_RKMPP})
 FAMILY_QSV = HwaccelFamily(
    key="intel-qsv",
    presets={"h264": "preset-intel-qsv-h264", "h265": "preset-intel-qsv-h265"},
 )
 FAMILY_JETSON = HwaccelFamily(
    key="jetson",
    presets={"h264": "preset-jetson-h264", "h265": "preset-jetson-h265"},
 )
 FAMILY_RPI = HwaccelFamily(
    key="rpi",
    presets={"h264": "preset-rpi-64-h264", "h265": "preset-rpi-64-h265"},
 )
 def _read(path: str) -> str | None:
    """Read a small file, returning None if it cannot be read."""
    try:
        with open(path) as f:
            return f.read().strip()
    except OSError:
        return None
 def _intel_generation() -> int | None:
    """The Intel platform generation, or None when it cannot be determined."""
    # the xe driver only binds to the newest platforms (Arc and later iGPUs)
    if "xe" in enumerate_drm_devices().values():
        return INTEL_GEN_LATEST
    cpuinfo = _read(f"{PROC_ROOT}/cpuinfo") or ""
    for line in cpuinfo.splitlines():
        if not line.startswith("model name"):
            continue
        match = INTEL_GEN_PATTERN.search(line)
        if match:
            return int(match.group(1))
        if INTEL_ULTRA_PATTERN.search(line):
            return INTEL_GEN_LATEST
        break
    return None
 def _is_raspberry_pi() -> bool:
    compatible = _read(f"{PROC_ROOT}/device-tree/compatible") or ""
    return "raspberrypi" in compatible
 def _intel_families(generation: int | None) -> list[HwaccelFamily]:
    """vaapi drives every Intel GPU, qsv only those from gen8 on."""
    if generation is not None and generation < INTEL_QSV_SUPPORTED_GEN:
        return [FAMILY_VAAPI]
    if generation is not None and generation >= INTEL_QSV_MIN_GEN:
        return [FAMILY_QSV, FAMILY_VAAPI]
    return [FAMILY_VAAPI, FAMILY_QSV]
 def _families(key: str, generation: int | None) -> list[HwaccelFamily]:
    """Every family that can decode on this hardware, best first."""
    if key == "onnx:nvidia":
        return [FAMILY_NVIDIA]
    if key == "tensorrt":
        return [FAMILY_JETSON]
    if key == "rknn":
        return [FAMILY_RKMPP]
    if key == "onnx:amd":
        return [FAMILY_VAAPI]
    if key == RASPBERRY_PI:
        return [FAMILY_RPI]
    if key == "openvino:GPU":
        return _intel_families(generation)
    return []
 def _decodes(family: HwaccelFamily, codecs: set[str]) -> bool:
    """Whether a family can decode every codec that is in use."""
    if ANY_CODEC in family.presets:
        return True
    return all(codec in family.presets for codec in codecs)
 def _decode_hardware(detector_key: str | None) -> list[str]:
    """Decode capable hardware on this system, best first.
    Args:
        detector_key: Hardware key of the detection hardware in use, whose GPU
            is preferred over any other
    Returns:
        The hardware keys that can decode video, in recommendation order
    """
    present = {found.key for found in hardware_prober.probe()}
    if _is_raspberry_pi():
        present.add(RASPBERRY_PI)
    # an Intel NPU decodes through the iGPU next to it
    if detector_key == "openvino:NPU":
        detector_key = "openvino:GPU"
    ordered = [key for key in DECODE_HARDWARE if key in present]
    if detector_key in ordered:
        ordered.remove(detector_key)
        ordered.insert(0, detector_key)
    return ordered
 def hwaccel_options(
    detector_key: str | None = None, codecs: set[str] | None = None
 ) -> tuple[str, list[HwaccelFamily]]:
    """Get the hardware decoding this system can do.
    Args:
        detector_key: Hardware key of the detection hardware in use, which
            biases the recommendation toward that hardware's GPU
        codecs: Codecs of the streams that will be decoded, used to drop
            families that cannot decode one of them
    Returns:
        The recommended family key (empty when none fits) and every usable
        family, best first
    """
    wanted = {CODEC_ALIASES.get(codec, codec) for codec in codecs or set()}
    hardware = _decode_hardware(detector_key)
    generation = _intel_generation() if "openvino:GPU" in hardware else None
    available: list[HwaccelFamily] = []
    recommended = ""
    for key in hardware:
        usable = [
            family for family in _families(key, generation) if _decodes(family, wanted)
        ]
        if usable and not recommended:
            recommended = _recommend(usable, bool(wanted))
        for family in usable:
            if family.key not in {entry.key for entry in available}:
                available.append(family)
    return recommended, available
 def _recommend(families: list[HwaccelFamily], codecs_known: bool) -> str:
    """Pick the family to default to out of the ones this hardware can use."""
    if not codecs_known:
        # a codec specific family would have to guess a codec for cameras
        # that do not exist yet
        for family in families:
            if ANY_CODEC in family.presets:
                return family.key
    return families[0].key
 def recommend_hwaccel(
    detector_key: str | None = None, codecs: set[str] | None = None
 ) -> str:
    """Recommend a hardware decoding family for this system.
    Args:
        detector_key: Hardware key of the detection hardware in use
        codecs: Codecs of the streams that will be decoded
    Returns:
        The key of the family that fits, or an empty string when none does
    """
    return hwaccel_options(detector_key, codecs)[0]
@@ -67,7 +67,7 @@ def has_better_attr(current_thumb, new_obj, attr_label) -> bool:
 def is_better_thumbnail(
-    label_attributes: list[str],
+    label: str,
    current_thumb: dict[str, Any],
    new_obj: dict[str, Any],
    frame_shape: tuple[int, int],
@@ -76,12 +76,20 @@ def is_better_thumbnail(
    # cutoff images are less ideal, but they should also be smaller?
    # better scores are obviously better too
-    for attr_label in label_attributes:
+    # check face on person
-        if has_better_attr(current_thumb, new_obj, attr_label):
+    if label == "person":
        if has_better_attr(current_thumb, new_obj, "face"):
            return True
        # if the current thumb has a face attr, dont update unless it gets better
        if any([a["label"] == "face" for a in current_thumb["attributes"]]):
            return False
-        # if the current thumb has the attr, dont update unless it gets better
+    # check license_plate on car
-        if any([a["label"] == attr_label for a in current_thumb["attributes"]]):
+    if label in ["car", "motorcycle"]:
        if has_better_attr(current_thumb, new_obj, "license_plate"):
            return True
        # if the current thumb has a license_plate attr, dont update unless it gets better
        if any([a["label"] == "license_plate" for a in current_thumb["attributes"]]):
            return False
    # if the new_thumb is on an edge, and the current thumb is not
@@ -1,6 +1,5 @@
 """Helpers for aligning created files with the non-root runtime user."""
 import functools
 import logging
 import os
 import pwd
@@ -10,15 +9,12 @@ logger = logging.getLogger(__name__)
 RUNTIME_USER = "frigate"
@functools.lru_cache(maxsize=1)
 def get_runtime_ids() -> tuple[int, int] | None:
    """Return (uid, gid) that services run as, or None when chown is not applicable.
    None when: not root (docker --user, so the host already mapped us),
    FRIGATE_RUN_AS_ROOT=true (escape hatch must not mutate ownership),
    or outside the Frigate container image (no frigate user).
    The result is cached for the process lifetime because the runtime user
    cannot change after boot.
    """
    if os.geteuid() != 0:
        return None
@@ -1,9 +1,7 @@
 """RKNN model conversion utility for Frigate."""
 import importlib
 import logging
 import os
 import site
 import subprocess
 import sys
 import time
@@ -103,41 +101,29 @@ def ensure_torch_dependencies() -> bool:
    except ImportError:
        logger.info("PyTorch not found, attempting to install...")
        result = subprocess.run(
            [
                sys.executable,
                "-m",
                "pip",
                "install",
                "--break-system-packages",
                "setuptools<81",
                "torch",
                "torchvision",
            ],
            capture_output=True,
            text=True,
        )
        if result.returncode != 0:
            logger.error("Failed to install PyTorch:\n%s", result.stderr[-4000:])
            return False
        # as an unprivileged user pip falls back to the user site, which is
        # only on sys.path at startup if it already existed
        user_site = site.getusersitepackages()
        if os.path.isdir(user_site) and user_site not in sys.path:
            site.addsitedir(user_site)
            importlib.invalidate_caches()
        try:
-            import torch  # type: ignore # noqa: F401
+            subprocess.check_call(
-        except ImportError as e:
+                [
-            logger.error(f"Failed to import PyTorch after installing it: {e}")
+                    sys.executable,
-            return False
+                    "-m",
                    "pip",
                    "install",
                    "--break-system-packages",
                    "setuptools<81",
                    "torch",
                    "torchvision",
                ],
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,
            )
-        logger.info("PyTorch installed successfully")
+            import torch  # type: ignore # noqa: F401
-        return True
+
            logger.info("PyTorch installed successfully")
            return True
        except (subprocess.CalledProcessError, ImportError) as e:
            logger.error(f"Failed to install PyTorch: {e}")
            return False
 def ensure_rknn_toolkit() -> bool:
@@ -1,545 +0,0 @@
 """Runtime installation of optional accelerator SDKs into the user site.
 Detector runtimes that are only useful with specific hardware are not shipped
 in the image. A detector declares a RuntimeManifest of pinned, checksummed
 artifacts, and ensure_installed() fetches and installs them into the runtime
 user's home (pip's --user location) the first time that detector is
 configured. Everything is derived from site.getuserbase() so the location
 follows $HOME: /config/.local for the unprivileged service, /root/.local for
 a root service, never a mix of the two.
 """
 import ctypes
 import fnmatch
 import hashlib
 import importlib
 import importlib.util
 import json
 import logging
 import os
 import platform
 import shutil
 import site
 import stat
 import subprocess
 import sys
 import tarfile
 import tempfile
 import zipfile
 from dataclasses import dataclass
 from enum import StrEnum
 from pathlib import Path
 from frigate.const import MODEL_CACHE_DIR
 from frigate.util.config import (
    frigate_service_is_granular_root,
    is_runtime_user_writable,
 )
 from frigate.util.file import FileLock
 logger = logging.getLogger(__name__)
 GITHUB_URL = "https://github.com"
 DOCS_URL = "https://docs.frigate.video/frigate/network_requirements#detector-runtimes"
 class RuntimeDependencyError(RuntimeError):
    """A runtime could not be installed or is not allowed to be used."""
 class ArtifactKind(StrEnum):
    wheel = "wheel"
    archive = "archive"
 class ArchiveDest(StrEnum):
    lib = "lib"
    bin = "bin"
    site_packages = "site_packages"
@dataclass(frozen=True)
 class ArchiveMapping:
    """Copy archive members under `prefix` into a directory of the user base.
    `include` holds optional basename globs; when set, only matching members
    are extracted. `machines` restricts the mapping to platform.machine()
    values, empty meaning all.
    """
    prefix: str
    dest: ArchiveDest
    subdir: str = ""
    include: tuple[str, ...] = ()
    machines: tuple[str, ...] = ()
@dataclass(frozen=True)
 class Artifact:
    url: str
    sha256: str
    kind: ArtifactKind
    filename: str | None = None
    mappings: tuple[ArchiveMapping, ...] = ()
    machines: tuple[str, ...] = ()
    @property
    def name(self) -> str:
        return self.filename or os.path.basename(self.url.split("?")[0])
@dataclass(frozen=True)
 class RuntimeManifest:
    """The pinned artifacts that make up one detector's runtime.
    `preload` lists shared libraries under <user base>/lib to load with
    RTLD_GLOBAL before the SDK import, in dependency order. Libraries without
    a SONAME cannot be satisfied that way and need <user base>/lib on
    LD_LIBRARY_PATH at exec time; `needs_ld_library_path` makes activate()
    warn when it is missing.
    """
    name: str
    version: str
    artifacts: tuple[Artifact, ...]
    preload: tuple[str, ...] = ()
    import_check: str = ""
    needs_ld_library_path: bool = False
    def digest(self) -> str:
        parts = [self.name, self.version, *sorted(a.sha256 for a in self.artifacts)]
        return hashlib.sha256("\n".join(parts).encode()).hexdigest()
 _loaded_libs: dict[str, ctypes.CDLL] = {}
 def user_base() -> Path:
    return Path(site.getuserbase())
 def user_site() -> Path:
    return Path(site.getusersitepackages())
 def cache_dir(name: str) -> Path:
    """The directory downloads land in, and where offline users pre-seed them."""
    return Path(MODEL_CACHE_DIR) / "runtimes" / name
 def resolve_url(url: str) -> str:
    """Apply the GITHUB_ENDPOINT mirror to GitHub release URLs."""
    if url.startswith(f"{GITHUB_URL}/"):
        endpoint = os.environ.get("GITHUB_ENDPOINT", GITHUB_URL).rstrip("/")
        return f"{endpoint}{url[len(GITHUB_URL) :]}"
    return url
 def find_tool(name: str) -> str:
    """Resolve a CLI tool, preferring the runtime-installed copy."""
    candidate = user_base() / "bin" / name
    if candidate.is_file() and os.access(candidate, os.X_OK):
        return str(candidate)
    return shutil.which(name) or name
 def sha256_of(path: Path) -> str:
    digest = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(1024 * 1024), b""):
            digest.update(chunk)
    return digest.hexdigest()
 def _usable_reason() -> str | None:
    """Why the user site must not be used, or None when it may be."""
    if not site.ENABLE_USER_SITE:
        return "the user site-packages directory is disabled for this interpreter"
    base = user_base()
    if frigate_service_is_granular_root() and is_runtime_user_writable(str(base)):
        return (
            f"{base} is writable by the unprivileged user while "
            "FRIGATE_ROOT_SERVICES runs frigate as root"
        )
    return None
 def _artifacts_for_machine(manifest: RuntimeManifest) -> list[Artifact]:
    machine = platform.machine()
    return [a for a in manifest.artifacts if not a.machines or machine in a.machines]
 def _fetch(artifact: Artifact, cache: Path) -> Path:
    """Return a verified copy of the artifact in the cache, downloading if needed."""
    path = cache / artifact.name
    if path.is_file():
        if sha256_of(path) == artifact.sha256:
            logger.info("Using pre-seeded runtime file %s", path)
            return path
        logger.warning("Checksum mismatch for %s, downloading again", path)
        path.unlink()
    # imported here so the detector API does not pull in the IPC stack
    from frigate.util.downloader import ModelDownloader
    url = resolve_url(artifact.url)
    logger.info("Downloading runtime file %s", url)
    try:
        ModelDownloader.download_from_url(url, str(path), silent=True)
    except Exception as err:
        raise RuntimeDependencyError(
            f"Unable to download {url}: {err}. Without internet access, "
            f"download it elsewhere and place it in {cache} (see {DOCS_URL})"
        ) from err
    if sha256_of(path) != artifact.sha256:
        path.unlink()
        raise RuntimeDependencyError(
            f"Checksum mismatch for {url}; the file was removed from {cache}"
        )
    return path
 def _stage(path: Path, artifact: Artifact, staging: Path) -> Path:
    """Copy into the private staging dir and verify there.
    The cache directory is writable by the runtime user, so the copy that is
    installed is the one that was verified, not whatever is in the cache at
    install time.
    """
    staged = staging / path.name
    shutil.copyfile(path, staged)
    if sha256_of(staged) != artifact.sha256:
        raise RuntimeDependencyError(f"{path} changed while being installed")
    return staged
 def _install_wheel(path: Path) -> None:
    result = subprocess.run(
        [
            sys.executable,
            "-m",
            "pip",
            "install",
            "--user",
            "--no-index",
            "--no-deps",
            "--force-reinstall",
            "--no-warn-script-location",
            str(path),
        ],
        capture_output=True,
        text=True,
        env={**os.environ, "PIP_BREAK_SYSTEM_PACKAGES": "1"},
    )
    if result.returncode != 0:
        logger.error("pip install of %s failed:\n%s", path.name, result.stderr[-4000:])
        raise RuntimeDependencyError(f"pip install of {path.name} failed")
    logger.debug("pip install of %s:\n%s", path.name, result.stdout)
 def _dest_root(mapping: ArchiveMapping) -> Path:
    if mapping.dest is ArchiveDest.site_packages:
        root = user_site()
    else:
        root = user_base() / mapping.dest.value
    return root / mapping.subdir if mapping.subdir else root
 def _mappings_for(
    member_name: str, mappings: list[ArchiveMapping]
 ) -> list[tuple[ArchiveMapping, str]]:
    """Every mapping a member falls under; prefixes may overlap."""
    matches = []
    for mapping in mappings:
        if not member_name.startswith(mapping.prefix):
            continue
        relative = member_name[len(mapping.prefix) :]
        if not relative or relative.endswith("/"):
            continue
        if mapping.include and not any(
            fnmatch.fnmatch(os.path.basename(relative), p) for p in mapping.include
        ):
            continue
        matches.append((mapping, relative))
    return matches
 def _safe_dest(root: Path, relative: str) -> Path:
    dest = root / relative
    resolved_root = os.path.realpath(root)
    if not os.path.realpath(dest).startswith(f"{resolved_root}{os.sep}"):
        raise RuntimeDependencyError(f"Archive member {relative} escapes {root}")
    return dest
 def _write_member(dest: Path, data_source, mode: int) -> None:
    dest.parent.mkdir(parents=True, exist_ok=True)
    tmp = dest.with_name(f"{dest.name}.tmp")
    with open(tmp, "wb") as f:
        shutil.copyfileobj(data_source, f)
    os.chmod(tmp, (mode & 0o777) or 0o644)
    os.replace(tmp, dest)
 def _write_symlink(dest: Path, target: str) -> None:
    # only links to a sibling file are recreated; anything else is dropped
    if "/" in target or target in ("", ".", ".."):
        raise RuntimeDependencyError(f"Archive symlink {dest.name} -> {target}")
    dest.parent.mkdir(parents=True, exist_ok=True)
    dest.unlink(missing_ok=True)
    os.symlink(target, dest)
 def _extract_archive(path: Path, artifact: Artifact) -> list[str]:
    """Extract mapped members into the user base and return their paths."""
    machine = platform.machine()
    mappings = [m for m in artifact.mappings if not m.machines or machine in m.machines]
    written: list[str] = []
    if path.name.endswith(".zip"):
        with zipfile.ZipFile(path) as archive:
            for info in archive.infolist():
                if info.is_dir():
                    continue
                mode = info.external_attr >> 16
                for mapping, relative in _mappings_for(info.filename, mappings):
                    dest = _safe_dest(_dest_root(mapping), relative)
                    if stat.S_ISLNK(mode):
                        _write_symlink(dest, archive.read(info).decode())
                    else:
                        with archive.open(info) as source:
                            _write_member(dest, source, mode)
                    written.append(str(dest))
    else:
        with tarfile.open(path, "r:*") as archive:
            for member in archive:
                if not (member.isfile() or member.issym()):
                    continue
                for mapping, relative in _mappings_for(member.name, mappings):
                    dest = _safe_dest(_dest_root(mapping), relative)
                    if member.issym():
                        _write_symlink(dest, member.linkname)
                    else:
                        source = archive.extractfile(member)
                        assert source is not None
                        with source:
                            _write_member(dest, source, member.mode)
                    written.append(str(dest))
    if not written:
        raise RuntimeDependencyError(f"{path.name} contained no expected files")
    return written
 def _stamp_path(name: str) -> Path:
    return user_base() / "share" / "frigate" / "runtimes" / f"{name}.json"
 def _read_stamp(name: str) -> dict | None:
    try:
        with open(_stamp_path(name)) as f:
            stamp = json.load(f)
    except (OSError, ValueError):
        return None
    return stamp if isinstance(stamp, dict) else None
 def _write_stamp(manifest: RuntimeManifest, files: list[str]) -> None:
    path = _stamp_path(manifest.name)
    path.parent.mkdir(parents=True, exist_ok=True)
    with open(path, "w") as f:
        json.dump(
            {
                "version": manifest.version,
                "digest": manifest.digest(),
                "files": files,
            },
            f,
            indent=2,
        )
 def _remove_stamped_files(stamp: dict | None) -> None:
    for file in (stamp or {}).get("files", []):
        Path(file).unlink(missing_ok=True)
 def _is_current(manifest: RuntimeManifest, stamp: dict | None) -> bool:
    if (
        stamp is None
        or stamp.get("version") != manifest.version
        or stamp.get("digest") != manifest.digest()
    ):
        return False
    if not all(os.path.lexists(f) for f in stamp.get("files", [])):
        return False
    if manifest.import_check:
        _add_user_site()
        return importlib.util.find_spec(manifest.import_check) is not None
    return True
 def _add_user_site() -> None:
    """Put the user site on sys.path the way interpreter startup would.
    site.addsitedir() appends, but at startup the user site precedes the
    system site-packages, so the entry is moved ahead of them to keep that
    precedence.
    """
    path = str(user_site())
    if path in sys.path or not os.path.isdir(path):
        return
    site.addsitedir(path)
    importlib.invalidate_caches()
    system_sites = [
        i
        for i, p in enumerate(sys.path)
        if p.endswith(("site-packages", "dist-packages")) and p != path
    ]
    if system_sites:
        sys.path.remove(path)
        sys.path.insert(system_sites[0], path)
 def activate(manifest: RuntimeManifest) -> None:
    """Make an installed runtime importable in the current process.
    Idempotent, and safe to call when nothing is installed; the SDK import
    then fails with its own error.
    """
    reason = _usable_reason()
    if reason is not None:
        logger.warning("Ignoring the %s runtime because %s", manifest.name, reason)
        return
    _add_user_site()
    lib_dir = user_base() / "lib"
    if manifest.needs_ld_library_path and str(lib_dir) not in os.environ.get(
        "LD_LIBRARY_PATH", ""
    ).split(":"):
        logger.warning(
            "%s is not on LD_LIBRARY_PATH; the %s runtime may fail to load",
            lib_dir,
            manifest.name,
        )
    for soname in manifest.preload:
        path = str(lib_dir / soname)
        if path in _loaded_libs:
            continue
        if not os.path.exists(path):
            logger.debug("Runtime library %s is not installed", path)
            continue
        try:
            _loaded_libs[path] = ctypes.CDLL(path, mode=ctypes.RTLD_GLOBAL)
        except OSError as err:
            logger.warning("Unable to preload %s: %s", path, err)
 def ensure_installed(manifest: RuntimeManifest) -> None:
    """Install the manifest into the user site unless it already is.
    Meant to run once in the main process before detector processes start,
    so sys.path is inherited by them. Raises RuntimeDependencyError when the
    runtime cannot be installed or must not be used.
    """
    reason = _usable_reason()
    if reason is not None:
        raise RuntimeDependencyError(
            f"Refusing to install the {manifest.name} runtime because {reason}"
        )
    cache = cache_dir(manifest.name)
    cache.mkdir(parents=True, exist_ok=True)
    with FileLock(cache / ".install.lock", timeout=600):
        stamp = _read_stamp(manifest.name)
        if _is_current(manifest, stamp):
            logger.debug(
                "%s runtime %s is already installed", manifest.name, manifest.version
            )
            activate(manifest)
            return
        logger.info("Installing the %s runtime %s", manifest.name, manifest.version)
        _remove_stamped_files(stamp)
        staging = Path(tempfile.mkdtemp(prefix=f"frigate-{manifest.name}-"))
        files: list[str] = []
        try:
            for artifact in _artifacts_for_machine(manifest):
                staged = _stage(_fetch(artifact, cache), artifact, staging)
                if artifact.kind is ArtifactKind.wheel:
                    _install_wheel(staged)
                else:
                    files.extend(_extract_archive(staged, artifact))
        except (OSError, tarfile.TarError, zipfile.BadZipFile) as err:
            raise RuntimeDependencyError(
                f"Unable to install the {manifest.name} runtime: {err}"
            ) from err
        finally:
            shutil.rmtree(staging, ignore_errors=True)
        _write_stamp(manifest, files)
    activate(manifest)
    logger.info(
        "Installed the %s runtime %s into %s",
        manifest.name,
        manifest.version,
        user_base(),
    )
@@ -187,23 +187,8 @@ def get_physical_interfaces(interfaces) -> list:
    return physical_interfaces
 _bandwidth_warning_logged = False
 def get_bandwidth_stats(config) -> dict[str, dict]:
    """Get bandwidth usages for each ffmpeg process id"""
    global _bandwidth_warning_logged
    if os.geteuid() != 0:
        if not _bandwidth_warning_logged:
            logger.warning(
                "Network bandwidth stats require root (nethogs needs CAP_NET_ADMIN/CAP_NET_RAW) "
                "and are disabled; set FRIGATE_ROOT_SERVICES=frigate (or FRIGATE_RUN_AS_ROOT=true) "
                "or disable telemetry.stats.network_bandwidth to silence this warning"
            )
            _bandwidth_warning_logged = True
        return {}
    usages = {}
    top_command = ["nethogs", "-t", "-v0", "-c5", "-d1"] + get_physical_interfaces(
        config.telemetry.network_interfaces
@@ -911,8 +896,8 @@ def get_nvidia_gpu_stats() -> dict[int, dict]:
        return results
-def get_jetson_stats() -> dict[str, str] | None:
+def get_jetson_stats() -> dict[int, dict] | None:
-    results: dict[str, str] = {}
+    results = {}
    try:
        results["mem"] = "-"  # no discrete gpu memory
--- a/Show More
+++ b/Show More