add test

replace the two pass layout with a single pass pixel space algorithm

.cspell/frigate-dictionary.txt

@@ -8,7 +8,6 @@ amdgpu
 analyzeduration
 Annke
 apexcharts
-Aqara
 arange
 argmax
 argmin
@@ -55,6 +54,7 @@ Dahua
 datasheet
 debconf
 deci
+deepstack
 defragment
 devcontainer
 DEVICEMAP
@@ -64,7 +64,6 @@ dsize
 dtype
 ECONNRESET
 edgetpu
-Eufy
 facenet
 fastapi
 faststart
@@ -83,7 +82,6 @@ frontdoor
 fstype
 fullchain
 fullscreen
-gatekeep
 genai
 generativeai
 genpts
@@ -164,7 +162,6 @@ mpegts
 mqtt
 mse
 msenc
-muxing
 namedtuples
 nbytes
 nchw
@@ -200,8 +197,6 @@ OWASP
 paddleocr
 paho
 passwordless
-PCMA
-PCMU
 popleft
 posthog
 postprocess
@@ -227,9 +222,7 @@ radeontop
 rawvideo
 rcond
 RDONLY
-realmonitor
 rebranded
-recvonly
 referer
 reindex
 Reolink
@@ -246,11 +239,8 @@ rocminfo
 rootfs
 rtmp
 RTSP
-rtsps
-rtspx
 ruamel
 scroller
-sendonly
 setproctitle
 setpts
 shms
@@ -261,7 +251,6 @@ SNDMORE
 socs
 sqliteq
 sqlitevecq
-Srtp
 ssdlite
 statm
 stimeout

.github/DISCUSSION_TEMPLATE/beta-support.yml

@@ -10,11 +10,7 @@ body:
 
         Before submitting, read the [beta documentation][docs].
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+        [docs]: https://deploy-preview-19787--frigate-docs.netlify.app/
-
-        [docs]: https://docs-dev.frigate.video/
-        [discussions]: https://github.com/blakeblackshear/frigate/discussions
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:
@@ -26,8 +22,8 @@ body:
     id: version
     attributes:
       label: Beta Version
-      description: Visible on the System Metrics page in the Web UI. Please include the full version including the build identifier (eg. 0.19.0-beta1, 0.19.0-8b72c7a, etc.)
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.17.0-beta1)
-      placeholder: "0.19.0-beta1"
+      placeholder: "0.17.0-beta1"
     validations:
       required: true
   - type: dropdown
@@ -75,12 +71,11 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
         - Proxmox via Docker
-        - Proxmox via installation script
+        - Proxmox via TTeck Script
-        - Proxomox via VM
         - Windows WSL2
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/camera-support.yml

@@ -8,12 +8,9 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:
@@ -90,12 +87,11 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
         - Proxmox via Docker
-        - Proxmox via installation script
+        - Proxmox via TTeck Script
-        - Proxomox via VM
         - Windows WSL2
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/config-support.yml

@@ -8,12 +8,9 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:
@@ -76,12 +73,11 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
         - Proxmox via Docker
-        - Proxmox via installation script
+        - Proxmox via TTeck Script
-        - Proxomox via VM
         - Windows WSL2
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/detector-support.yml

@@ -8,12 +8,9 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:
@@ -56,12 +53,11 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
         - Proxmox via Docker
-        - Proxmox via installation script
+        - Proxmox via TTeck Script
-        - Proxomox via VM
         - Windows WSL2
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/general-support.yml

@@ -8,12 +8,9 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:
@@ -76,12 +73,11 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
         - Proxmox via Docker
-        - Proxmox via installation script
+        - Proxmox via TTeck Script
-        - Proxmox via VM
         - Windows WSL2
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/hardware-acceleration-support.yml

@@ -8,12 +8,9 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:
@@ -72,12 +69,11 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
         - Proxmox via Docker
-        - Proxmox via installation script
+        - Proxmox via TTeck Script
-        - Proxomox via VM
         - Windows WSL2
     validations:
       required: true

.github/DISCUSSION_TEMPLATE/question.yml

@@ -10,12 +10,9 @@ body:
 
         **If you are looking for support, start a new discussion and use a support category.**
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/report-a-bug.yml

@@ -6,22 +6,17 @@ body:
       value: |
         Use this form to submit a reproducible bug in Frigate or Frigate's UI.
 
-        If you are running on Proxmox, please see the [Proxmox FAQ](https://github.com/blakeblackshear/frigate/discussions/23916) and reproduce the issue on a standard Docker install first (bare metal, or a VM running plain Debian/Ubuntu) before submitting here.
+        **⚠️ If you are running a beta version (0.17.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.**
-
-        **⚠️ If you are running a beta version (0.19.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.**
 
         Before submitting your bug report, please ask the AI with the "Ask AI" button on the [official documentation site][ai] about your issue, [search the discussions][discussions], look at recent open and closed [pull requests][prs], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your bug has already been fixed by the developers or reported by the community.
 
         **If you are unsure if your issue is actually a bug or not, please submit a support request first.**
 
-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [prs]: https://www.github.com/blakeblackshear/frigate/pulls
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
         [ai]: https://docs.frigate.video
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: checkboxes
     attributes:
       label: Checklist
@@ -121,13 +116,9 @@ body:
     attributes:
       label: Install method
       options:
-        - Home Assistant App
+        - Home Assistant Add-on
         - Docker Compose
         - Docker CLI
-        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
-        - Windows WSL2
     validations:
       required: true
   - type: dropdown

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,13 +7,6 @@ assignees: ''
 
 ---
 
-<!--
-  By posting here you agree to follow our AI policy:
-  https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
-
-  Requests that appear to be written by an AI on your behalf may be closed without a response.
--->
-
 **Describe what you are trying to accomplish and why in non technical terms**
 I want to be able to ... so that I can ... 
 

.github/copilot-instructions.md

@@ -1 +0,0 @@
-AGENTS.md

.github/copilot-instructions.md

@@ -0,0 +1,401 @@
+# GitHub Copilot Instructions for Frigate NVR
+
+This document provides coding guidelines and best practices for contributing to Frigate NVR, a complete and local NVR designed for Home Assistant with AI object detection.
+
+## Project Overview
+
+Frigate NVR is a realtime object detection system for IP cameras that uses:
+
+- **Backend**: Python 3.13+ with FastAPI, OpenCV, TensorFlow/ONNX
+- **Frontend**: React with TypeScript, Vite, TailwindCSS
+- **Architecture**: Multiprocessing design with ZMQ and MQTT communication
+- **Focus**: Minimal resource usage with maximum performance
+
+## Code Review Guidelines
+
+When reviewing code, do NOT comment on:
+
+- Missing imports - Static analysis tooling catches these
+- Code formatting - Ruff (Python) and Prettier (TypeScript/React) handle formatting
+- Minor style inconsistencies already enforced by linters
+
+## Python Backend Standards
+
+### Python Requirements
+
+- **Compatibility**: Python 3.13+
+- **Language Features**: Use modern Python features:
+  - Pattern matching
+  - Type hints (comprehensive typing preferred)
+  - f-strings (preferred over `%` or `.format()`)
+  - Dataclasses
+  - Async/await patterns
+
+### Code Quality Standards
+
+- **Formatting**: Ruff (configured in `pyproject.toml`)
+- **Linting**: Ruff with rules defined in project config
+- **Type Checking**: Use type hints consistently
+- **Testing**: unittest framework - use `python3 -u -m unittest` to run tests
+- **Language**: American English for all code, comments, and documentation
+
+### Logging Standards
+
+- **Logger Pattern**: Use module-level logger
+
+  ```python
+  import logging
+
+  logger = logging.getLogger(__name__)
+  ```
+
+- **Format Guidelines**:
+  - No periods at end of log messages
+  - No sensitive data (keys, tokens, passwords)
+  - Use lazy logging: `logger.debug("Message with %s", variable)`
+- **Log Levels**:
+  - `debug`: Development and troubleshooting information
+  - `info`: Important runtime events (startup, shutdown, state changes)
+  - `warning`: Recoverable issues that should be addressed
+  - `error`: Errors that affect functionality but don't crash the app
+  - `exception`: Use in except blocks to include traceback
+
+### Error Handling
+
+- **Exception Types**: Choose most specific exception available
+- **Try/Catch Best Practices**:
+  - Only wrap code that can throw exceptions
+  - Keep try blocks minimal - process data after the try/except
+  - Avoid bare exceptions except in background tasks
+
+  Bad pattern:
+
+  ```python
+  try:
+      data = await device.get_data()  # Can throw
+      # ❌ Don't process data inside try block
+      processed = data.get("value", 0) * 100
+      result = processed
+  except DeviceError:
+      logger.error("Failed to get data")
+  ```
+
+  Good pattern:
+
+  ```python
+  try:
+      data = await device.get_data()  # Can throw
+  except DeviceError:
+      logger.error("Failed to get data")
+      return
+
+  # ✅ Process data outside try block
+  processed = data.get("value", 0) * 100
+  result = processed
+  ```
+
+### Async Programming
+
+- **External I/O**: All external I/O operations must be async
+- **Best Practices**:
+  - Avoid sleeping in loops - use `asyncio.sleep()` not `time.sleep()`
+  - Avoid awaiting in loops - use `asyncio.gather()` instead
+  - No blocking calls in async functions
+  - Use `asyncio.create_task()` for background operations
+- **Thread Safety**: Use proper synchronization for shared state
+
+### Documentation Standards
+
+- **Module Docstrings**: Concise descriptions at top of files
+  ```python
+  """Utilities for motion detection and analysis."""
+  ```
+- **Function Docstrings**: Required for public functions and methods
+
+  ```python
+  async def process_frame(frame: ndarray, config: Config) -> Detection:
+      """Process a video frame for object detection.
+
+      Args:
+          frame: The video frame as numpy array
+          config: Detection configuration
+
+      Returns:
+          Detection results with bounding boxes
+      """
+  ```
+
+- **Comment Style**:
+  - Explain the "why" not just the "what"
+  - Keep lines under 88 characters when possible
+  - Use clear, descriptive comments
+
+### File Organization
+
+- **API Endpoints**: `frigate/api/` - FastAPI route handlers
+- **Configuration**: `frigate/config/` - Configuration parsing and validation
+- **Detectors**: `frigate/detectors/` - Object detection backends
+- **Events**: `frigate/events/` - Event management and storage
+- **Utilities**: `frigate/util/` - Shared utility functions
+
+## Frontend (React/TypeScript) Standards
+
+### Internationalization (i18n)
+
+- **CRITICAL**: Never write user-facing strings directly in components
+- **Always use react-i18next**: Import and use the `t()` function
+
+  ```tsx
+  import { useTranslation } from "react-i18next";
+
+  function MyComponent() {
+    const { t } = useTranslation(["views/live"]);
+    return <div>{t("camera_not_found")}</div>;
+  }
+  ```
+
+- **Translation Files**: Add English strings to the appropriate json files in `web/public/locales/en`
+- **Namespaces**: Organize translations by feature/view (e.g., `views/live`, `common`, `views/system`)
+
+### Code Quality
+
+- **Linting**: ESLint (see `web/.eslintrc.cjs`)
+- **Formatting**: Prettier with Tailwind CSS plugin
+- **Type Safety**: TypeScript strict mode enabled
+- **Testing**: Vitest for unit tests
+
+### Component Patterns
+
+- **UI Components**: Use Radix UI primitives (in `web/src/components/ui/`)
+- **Styling**: TailwindCSS with `cn()` utility for class merging
+- **State Management**: React hooks (useState, useEffect, useCallback, useMemo)
+- **Data Fetching**: Custom hooks with proper loading and error states
+
+### ESLint Rules
+
+Key rules enforced:
+
+- `react-hooks/rules-of-hooks`: error
+- `react-hooks/exhaustive-deps`: error
+- `no-console`: error (use proper logging or remove)
+- `@typescript-eslint/no-explicit-any`: warn (always use proper types instead of `any`)
+- Unused variables must be prefixed with `_`
+- Comma dangles required for multiline objects/arrays
+
+### File Organization
+
+- **Pages**: `web/src/pages/` - Route components
+- **Views**: `web/src/views/` - Complex view components
+- **Components**: `web/src/components/` - Reusable components
+- **Hooks**: `web/src/hooks/` - Custom React hooks
+- **API**: `web/src/api/` - API client functions
+- **Types**: `web/src/types/` - TypeScript type definitions
+
+## Testing Requirements
+
+### Backend Testing
+
+- **Framework**: Python unittest
+- **Run Command**: `python3 -u -m unittest`
+- **Location**: `frigate/test/`
+- **Coverage**: Aim for comprehensive test coverage of core functionality
+- **Pattern**: Use `TestCase` classes with descriptive test method names
+  ```python
+  class TestMotionDetection(unittest.TestCase):
+      def test_detects_motion_above_threshold(self):
+          # Test implementation
+  ```
+
+### Test Best Practices
+
+- Always have a way to test your work and confirm your changes
+- Write tests for bug fixes to prevent regressions
+- Test edge cases and error conditions
+- Mock external dependencies (cameras, APIs, hardware)
+- Use fixtures for test data
+
+## Development Commands
+
+### Python Backend
+
+```bash
+# Run all tests
+python3 -u -m unittest
+
+# Run specific test file
+python3 -u -m unittest frigate.test.test_ffmpeg_presets
+
+# Check formatting (Ruff)
+ruff format --check frigate/
+
+# Apply formatting
+ruff format frigate/
+
+# Run linter
+ruff check frigate/
+```
+
+### Frontend (from web/ directory)
+
+```bash
+# Start dev server (AI agents should never run this directly unless asked)
+npm run dev
+
+# Build for production
+npm run build
+
+# Run linter
+npm run lint
+
+# Fix linting issues
+npm run lint:fix
+
+# Format code
+npm run prettier:write
+```
+
+### Docker Development
+
+AI agents should never run these commands directly unless instructed.
+
+```bash
+# Build local image
+make local
+
+# Build debug image
+make debug
+```
+
+## Common Patterns
+
+### API Endpoint Pattern
+
+```python
+from fastapi import APIRouter, Request
+from frigate.api.defs.tags import Tags
+
+router = APIRouter(tags=[Tags.Events])
+
+@router.get("/events")
+async def get_events(request: Request, limit: int = 100):
+    """Retrieve events from the database."""
+    # Implementation
+```
+
+### Configuration Access
+
+```python
+# Access Frigate configuration
+config: FrigateConfig = request.app.frigate_config
+camera_config = config.cameras["front_door"]
+```
+
+### Database Queries
+
+```python
+from frigate.models import Event
+
+# Use Peewee ORM for database access
+events = (
+    Event.select()
+    .where(Event.camera == camera_name)
+    .order_by(Event.start_time.desc())
+    .limit(limit)
+)
+```
+
+## Common Anti-Patterns to Avoid
+
+### ❌ Avoid These
+
+```python
+# Blocking operations in async functions
+data = requests.get(url)  # ❌ Use async HTTP client
+time.sleep(5)  # ❌ Use asyncio.sleep()
+
+# Hardcoded strings in React components
+<div>Camera not found</div>  # ❌ Use t("camera_not_found")
+
+# Missing error handling
+data = await api.get_data()  # ❌ No exception handling
+
+# Bare exceptions in regular code
+try:
+    value = await sensor.read()
+except Exception:  # ❌ Too broad
+    logger.error("Failed")
+
+# Returning exceptions in JSON responses
+except ValueError as e:
+    return JSONResponse(
+        content={"success": False, "message": str(e)},
+    )
+```
+
+### ✅ Use These Instead
+
+```python
+# Async operations
+import aiohttp
+async with aiohttp.ClientSession() as session:
+    async with session.get(url) as response:
+        data = await response.json()
+
+await asyncio.sleep(5)  # ✅ Non-blocking
+
+# Translatable strings in React
+const { t } = useTranslation();
+<div>{t("camera_not_found")}</div>  # ✅ Translatable
+
+# Proper error handling
+try:
+    data = await api.get_data()
+except ApiException as err:
+    logger.error("API error: %s", err)
+    raise
+
+# Specific exceptions
+try:
+    value = await sensor.read()
+except SensorException as err:  # ✅ Specific
+    logger.exception("Failed to read sensor")
+
+# Safe error responses
+except ValueError:
+    logger.exception("Invalid parameters for API request")
+    return JSONResponse(
+        content={
+            "success": False,
+            "message": "Invalid request parameters",
+        },
+    )
+```
+
+## Project-Specific Conventions
+
+### Configuration Files
+
+- Main config: `config/config.yml`
+
+### Directory Structure
+
+- Backend code: `frigate/`
+- Frontend code: `web/`
+- Docker files: `docker/`
+- Documentation: `docs/`
+- Database migrations: `migrations/`
+
+### Code Style Conformance
+
+Always conform new and refactored code to the existing coding style in the project:
+
+- Follow established patterns in similar files
+- Match indentation and formatting of surrounding code
+- Use consistent naming conventions (snake_case for Python, camelCase for TypeScript)
+- Maintain the same level of verbosity in comments and docstrings
+
+## Additional Resources
+
+- Documentation: https://docs.frigate.video
+- Main Repository: https://github.com/blakeblackshear/frigate
+- Home Assistant Integration: https://github.com/blakeblackshear/frigate-hass-integration

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-_Please read the [contributing guidelines](https://github.com/blakeblackshear/frigate/blob/dev/CONTRIBUTING.md) and the [AI policy](https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md) before submitting a PR. Every PR must be read and submitted by a person, and PRs that appear to be unreviewed AI output will be closed without review._
+_Please read the [contributing guidelines](https://github.com/blakeblackshear/frigate/blob/dev/CONTRIBUTING.md) before submitting a PR._
 
 ## Proposed change
 
@@ -26,7 +26,7 @@ _Please read the [contributing guidelines](https://github.com/blakeblackshear/fr
 
 - This PR fixes or closes issue: fixes #
 - This PR is related to issue:
-- Link to discussion with maintainers (**required** for any large or "planned" features):
+- Link to discussion with maintainers (**required** for large/pinned features):
 
 ## For new features
 

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     name: AMD64 Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -42,391 +42,12 @@ jobs:
           tags: ${{ steps.setup.outputs.image-name }}-amd64
           cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64
           cache-to: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64,mode=max
-  smoke_test:
-    runs-on: ubuntu-22.04
-    name: AMD64 Smoke Test
-    needs:
-      - amd64_build
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: Set up QEMU and Buildx
-        id: setup
-        uses: ./.github/actions/setup
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Start container
-        run: |
-          mkdir -p /tmp/frigate-config /tmp/frigate-media
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config/config.yml
-          # simulate a root-era install: root-owned 0600 jwt secret pre-exists
-          docker run --rm -v /tmp/frigate-config:/config --entrypoint bash \
-            ${{ steps.setup.outputs.image-name }}-amd64 \
-            -c "python3 -c 'import secrets; open(\"/config/.jwt_secret\",\"w\").write(secrets.token_hex(64))' && chmod 600 /config/.jwt_secret && chown 0:0 /config/.jwt_secret"
-          docker run -d --name frigate --shm-size 256m \
-            -v /tmp/frigate-config:/config \
-            -v /tmp/frigate-media:/media/frigate \
-            --mount type=tmpfs,target=/tmp/cache,tmpfs-size=100000000 \
-            -p 5000:5000 -p 8971:8971 \
-            ${{ steps.setup.outputs.image-name }}-amd64
-      - name: Wait for API
-        run: |
-          for i in $(seq 1 60); do
-            curl -fs http://127.0.0.1:5000/api/version && exit 0
-            sleep 5
-          done
-          echo "API never came up"; docker logs frigate; exit 1
-      - name: Assert security headers and permissions
-        run: |
-          headers=$(curl -ksI https://127.0.0.1:8971/)
-          echo "$headers"
-          echo "$headers" | grep -qi "x-content-type-options: nosniff"
-          echo "$headers" | grep -qi "referrer-policy: strict-origin-when-cross-origin"
-          # server_tokens off: Server header must not include a version.
-          # written as an if rather than "! grep", because bash exempts a
-          # negated command from set -e and the assertion would never fail
-          if echo "$headers" | grep -qiE "^server: nginx/[0-9]"; then
-            echo "Server header leaks the nginx version; server_tokens is not off"
-            exit 1
-          fi
-          # Frigate never ships frame-ancestors: HA's Webpage card and iframe
-          # panels frame it cross-origin and it would break them silently
-          if echo "$headers" | grep -qi "frame-ancestors"; then
-            echo "response carries frame-ancestors, which breaks cross-origin iframe embedding"
-            exit 1
-          fi
-          # -t as root would chown the live cache and temp dirs to the `user`
-          # directive user; stdout discarded because -t reopens the config's
-          # /dev/stdout logs and the docker exec pipe is root-owned
-          docker exec frigate /command/s6-setuidgid frigate bash -c '/usr/local/nginx/sbin/nginx -e stderr -t -c /tmp/nginx/conf/nginx.conf >/dev/null'
-          docker exec frigate stat -c %a /config/tls/privkey.pem | grep -qx 600
-          docker exec frigate stat -c %a /dev/shm/go2rtc.yaml | grep -qx 640
-      - name: Assert services run as non-root
-        run: |
-          ps_out=$(docker exec frigate ps -eo user=,comm=)
-          echo "$ps_out"
-          assert_nonroot() {
-            # the process must exist AND no instance of it may run as root
-            echo "$ps_out" | grep -qw "$1" || { echo "$1 is not running"; exit 1; }
-            if echo "$ps_out" | grep -w "$1" | grep -q '^root'; then
-              echo "$1 is running as root"; exit 1
-            fi
-          }
-          assert_nonroot python3
-          assert_nonroot go2rtc
-          assert_nonroot nginx
-          # root-era jwt secret must have been captured by the sweep and the
-          # auth stack must be functional: wrong creds => clean 401, not 500
-          docker exec frigate stat -c %u /config/.jwt_secret | grep -qx "$(docker exec frigate id -u frigate)"
-          code=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:5000/api/login \
-            -H 'content-type: application/json' -d '{"user":"admin","password":"definitely-wrong"}')
-          [ "$code" = "401" ] || { echo "login endpoint returned $code"; exit 1; }
-          # a root nginx -t above would have chowned the runtime dirs to root
-          owners=$(docker exec frigate stat -c %U /tmp/nginx /dev/shm/nginx_cache)
-          echo "$owners"
-          if echo "$owners" | grep -qvx frigate; then
-            echo "nginx runtime dirs are not owned by frigate"; exit 1
-          fi
-          # runtime user can write recordings storage
-          docker exec frigate /command/s6-setuidgid frigate touch /media/frigate/.write-probe
-          docker exec frigate rm /media/frigate/.write-probe
-          # tmpfs mount per the docs: arrives root-owned, holds the ZMQ IPC sockets
-          docker exec frigate /command/s6-setuidgid frigate touch /tmp/cache/.write-probe
-          docker exec frigate rm /tmp/cache/.write-probe
-          # models are baked in as root and archive members can carry root-only modes
-          docker exec frigate /command/s6-setuidgid frigate sh -c '
-            for f in /cpu_model.tflite /edgetpu_model.tflite /cpu_audio_model.tflite \
-                     /labelmap.txt /audio-labelmap.txt /openvino-model/*; do
-              [ -e "$f" ] || continue
-              test -r "$f" || { echo "$f is not readable by the runtime user"; exit 1; }
-            done'
-      - name: Assert device access grants
-        run: |
-          # a fake accelerator node created after boot, then the oneshot re-run.
-          # /command is on PATH only for s6-supervised services, and the
-          # with-contenv shebang resolves its execline helpers through PATH
-          docker exec frigate mknod /dev/apex_9 c 120 99
-          docker exec frigate sh -c 'export PATH=/command:$PATH; exec /etc/s6-overlay/s6-rc.d/init-devices/run'
-          acl=$(docker exec frigate getfacl -p /dev/apex_9)
-          echo "$acl"
-          echo "$acl" | grep -q "user:frigate:rw-"
-          echo "$acl" | grep -q "user:go2rtc:rw-"
-          # the usb tree gets recursive grants plus a default ACL that
-          # newly created nodes inherit (the Coral re-enumeration path)
-          docker exec frigate sh -c 'mkdir -p /dev/bus/usb/001 && mknod /dev/bus/usb/001/002 c 189 1'
-          docker exec frigate sh -c 'export PATH=/command:$PATH; exec /etc/s6-overlay/s6-rc.d/init-devices/run'
-          docker exec frigate getfacl -p /dev/bus/usb/001 | grep -q "user:frigate:rwx"
-          docker exec frigate sh -c 'mknod /dev/bus/usb/001/099 c 189 98 && chmod 664 /dev/bus/usb/001/099'
-          inherited=$(docker exec frigate getfacl -p /dev/bus/usb/001/099)
-          echo "$inherited"
-          echo "$inherited" | grep -q "user:frigate:rw-"
-          # getfacl prints granted perms even when the mask clamps them to
-          # nothing, with a trailing "#effective:" comment; a clamped ACL must
-          # fail this assertion, not sneak past it. The check is scoped to the
-          # runtime users because the inherited group:: entry is always clamped
-          # on a non-directory, so an unscoped grep could never pass.
-          if echo "$inherited" | grep -E "^user:(frigate|go2rtc):" | grep -q "effective"; then
-            echo "inherited ACL is mask-clamped and grants no real access"; exit 1
-          fi
-          # hardware that is absent must stay silent: the literal table entries
-          # are not globs, so nullglob does not drop them and only an existence
-          # check keeps them from warning on every boot
-          out=$(docker exec frigate sh -c 'export PATH=/command:$PATH; exec /etc/s6-overlay/s6-rc.d/init-devices/run')
-          echo "$out"
-          if echo "$out" | grep -q "WARN"; then
-            echo "grant warned about device nodes that do not exist"; exit 1
-          fi
-      - name: Assert escape hatch restores root
-        run: |
-          mkdir -p /tmp/frigate-config-root
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-root/config.yml
-          # pre-seed so the absence check proves the rm -f, not a vacuous pass
-          echo "2:1000:1000" > /tmp/frigate-config-root/.permissions_version
-          docker run -d --name frigate-root --shm-size 256m \
-            -e FRIGATE_RUN_AS_ROOT=true \
-            -v /tmp/frigate-config-root:/config \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-root curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "escape hatch container never healthy"; docker logs frigate-root; exit 1; fi
-          ps_out=$(docker exec frigate-root ps -eo user=,comm=)
-          echo "$ps_out"
-          echo "$ps_out" | grep -w python3 | grep -q '^root'
-          echo "$ps_out" | grep -w go2rtc  | grep -q '^root'
-          echo "$ps_out" | grep -w nginx   | grep -q '^root'
-          # an if, not ! test: bash exempts negated commands from set -e
-          if docker exec frigate-root test -f /config/.permissions_version; then
-            echo "escape hatch did not delete the sweep sentinel"; exit 1
-          fi
-          docker rm -f frigate-root
-      - name: Assert granular root services
-        run: |
-          mkdir -p /tmp/frigate-config-granular /tmp/frigate-media-granular
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-granular/config.yml
-          docker run -d --name frigate-granular --shm-size 256m \
-            -e FRIGATE_ROOT_SERVICES=frigate \
-            -v /tmp/frigate-config-granular:/config \
-            -v /tmp/frigate-media-granular:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-granular curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "granular container never became healthy"; docker logs frigate-granular; exit 1; fi
-          ps_out=$(docker exec frigate-granular ps -eo user=,comm=)
-          echo "$ps_out"
-          # the listed service runs as root
-          echo "$ps_out" | grep -w python3 | grep -q '^root'
-          # unlisted services still drop; ifs because set -e exempts negated commands
-          if echo "$ps_out" | grep -w go2rtc | grep -q '^root'; then
-            echo "go2rtc is unexpectedly running as root"; exit 1
-          fi
-          if echo "$ps_out" | grep -w nginx | grep -q '^root'; then
-            echo "nginx is unexpectedly running as root"; exit 1
-          fi
-          # the sweep still ran and the sentinel records the mode
-          docker exec frigate-granular cat /config/.permissions_version | grep -qx "2:1000:1000:frigate"
-          # the root frigate process chowns the db it creates (first-boot immediacy)
-          docker exec frigate-granular stat -c %u /config/frigate.db | grep -qx 1000
-          # plant a root-owned straggler; the per-boot sweep must reclaim it on restart
-          docker exec frigate-granular sh -c 'mkdir -p /media/frigate/clips && touch /media/frigate/clips/straggler.webp'
-          docker restart frigate-granular
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-granular curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "granular container never came back after restart"; docker logs frigate-granular; exit 1; fi
-          docker exec frigate-granular stat -c %u /media/frigate/clips/straggler.webp | grep -qx 1000
-          docker rm -f frigate-granular
-      - name: Assert unknown root service fails fast
-        run: |
-          mkdir -p /tmp/frigate-config-badsvc
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-badsvc/config.yml
-          docker run -d --name frigate-badsvc --shm-size 256m \
-            -e FRIGATE_ROOT_SERVICES=frigatee \
-            -v /tmp/frigate-config-badsvc:/config \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          found=0
-          for i in $(seq 1 12); do
-            if docker logs frigate-badsvc 2>&1 | grep -q "unknown service 'frigatee'"; then found=1; break; fi
-            sleep 5
-          done
-          if [ "$found" -ne 1 ]; then
-            echo "no fail-fast error for an unknown service name"; docker logs frigate-badsvc; exit 1
-          fi
-          # the failed oneshot blocks startup through the dependency chain
-          if docker exec frigate-badsvc curl -fs http://127.0.0.1:5000/api/version; then
-            echo "container came up despite an invalid FRIGATE_ROOT_SERVICES"; exit 1
-          fi
-          docker rm -f frigate-badsvc
-      - name: Assert PUID/PGID remapping
-        run: |
-          mkdir -p /tmp/frigate-config-puid /tmp/frigate-media-puid
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-puid/config.yml
-          docker run -d --name frigate-puid --shm-size 256m \
-            -e PUID=1500 -e PGID=1500 \
-            -v /tmp/frigate-config-puid:/config \
-            -v /tmp/frigate-media-puid:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-puid curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "PUID container never became healthy"; docker logs frigate-puid; exit 1; fi
-          docker exec frigate-puid id -u frigate | grep -qx 1500
-          docker exec frigate-puid id -g frigate | grep -qx 1500
-          docker exec frigate-puid cat /config/.permissions_version | grep -qx "2:1500:1500"
-          # second boot must skip the sweep (sentinel hit). Poll rather than
-          # sleep: the string can only come from the second boot (the first
-          # had no sentinel), so grepping the full log is unambiguous.
-          docker restart frigate-puid
-          ok=0
-          for i in $(seq 1 30); do
-            docker logs frigate-puid 2>&1 | grep -q "already applied" && ok=1 && break
-            sleep 2
-          done
-          if [ "$ok" -ne 1 ]; then echo "sentinel skip never logged"; docker logs frigate-puid; exit 1; fi
-          docker rm -f frigate-puid
-      - name: Assert read-only rootfs with --user works
-        run: |
-          mkdir -p /tmp/frigate-config-ro /tmp/frigate-media-ro
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-ro/config.yml
-          sudo chown -R 1000:1000 /tmp/frigate-config-ro /tmp/frigate-media-ro
-          # /run must allow exec: S6_READ_ONLY_ROOT has s6 copy its service
-          # scripts there and run them, and --tmpfs defaults to noexec
-          docker run -d --name frigate-ro --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000 \
-            --user 1000:1000 \
-            --security-opt no-new-privileges:true \
-            -v /tmp/frigate-config-ro:/config \
-            -v /tmp/frigate-media-ro:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-ro curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "read-only container never healthy"; docker logs frigate-ro; exit 1; fi
-          # an if, not "! grep": bash exempts a negated command from set -e and
-          # the assertion would never fail
-          if docker logs frigate-ro 2>&1 | grep -i "read-only file system"; then
-            echo "a service tried to write to the read-only rootfs"; exit 1
-          fi
-          # the self-signed cert has to land in /config, the only writable path
-          docker exec frigate-ro test -f /config/tls/privkey.pem
-          # and nginx must serve it, which is what proves the templated cert path
-          docker exec frigate-ro curl -ksSI https://127.0.0.1:8971/ >/dev/null
-          # logging must work via the s6-log fallback (no logutil-service as non-root)
-          docker exec frigate-ro test -s /dev/shm/logs/frigate/current
-          # runtime user can write recordings storage
-          docker exec frigate-ro touch /media/frigate/.write-probe
-          docker exec frigate-ro rm /media/frigate/.write-probe
-          docker rm -f frigate-ro
-      - name: Assert PUID with read-only fails fast with clear error
-        run: |
-          docker run -d --name frigate-ro-puid --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            -e PUID=1500 -e PGID=1500 \
-            -v /tmp/frigate-config-ro:/config \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          found=0
-          for i in $(seq 1 12); do
-            if docker logs frigate-ro-puid 2>&1 | grep -q "not compatible with read_only"; then found=1; break; fi
-            sleep 5
-          done
-          if [ "$found" -ne 1 ]; then
-            echo "no fail-fast error for PUID with a read-only rootfs"; docker logs frigate-ro-puid; exit 1
-          fi
-          docker rm -f frigate-ro-puid
-      - name: Assert EXTRA_GROUPS with read-only fails fast with clear error
-        run: |
-          docker run -d --name frigate-ro-groups --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            -e EXTRA_GROUPS=44 \
-            -v /tmp/frigate-config-ro:/config \
-            -v /tmp/frigate-media-ro:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          found=0
-          for i in $(seq 1 12); do
-            if docker logs frigate-ro-groups 2>&1 | grep -q "EXTRA_GROUPS needs a writable /etc"; then found=1; break; fi
-            sleep 5
-          done
-          if [ "$found" -ne 1 ]; then
-            echo "no fail-fast error for EXTRA_GROUPS with a read-only rootfs"; docker logs frigate-ro-groups; exit 1
-          fi
-          docker rm -f frigate-ro-groups
-      - name: Assert read-only rootfs in the default mode works
-        run: |
-          mkdir -p /tmp/frigate-config-rod /tmp/frigate-media-rod
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-rod/config.yml
-          docker run -d --name frigate-rod --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            --security-opt no-new-privileges:true \
-            -v /tmp/frigate-config-rod:/config \
-            -v /tmp/frigate-media-rod:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-rod curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "read-only default-mode container never healthy"; docker logs frigate-rod; exit 1; fi
-          if docker logs frigate-rod 2>&1 | grep -i "read-only file system"; then
-            echo "a service tried to write to the read-only rootfs"; exit 1
-          fi
-          # the point of this mode over docker's user:: the drop still happens
-          # and go2rtc still gets its own separate user
-          ps_out=$(docker exec frigate-rod ps -eo user=,comm=)
-          echo "$ps_out"
-          for svc in python3 nginx; do
-            if echo "$ps_out" | grep -w "$svc" | grep -q '^root'; then
-              echo "$svc is running as root"; exit 1
-            fi
-          done
-          echo "$ps_out" | grep -w go2rtc | grep -q '^go2rtc'
-          # the ownership sweep still ran and recorded itself in /config
-          docker exec frigate-rod cat /config/.permissions_version | grep -qx "2:1000:1000"
-          # setfacl under a read-only rootfs, which nothing else covers:
-          # init-devices exits early under --user, so that path is never reached
-          docker exec frigate-rod mknod /dev/apex_9 c 120 99
-          docker exec frigate-rod sh -c 'export PATH=/command:$PATH; exec /etc/s6-overlay/s6-rc.d/init-devices/run'
-          docker exec frigate-rod getfacl -p /dev/apex_9 | grep -q "user:frigate:rw-"
-          docker rm -f frigate-rod
-      - name: "Assert switching that install to user: still starts"
-        run: |
-          # the config dir above now holds a go2rtc-owned go2rtc_homekit.yml,
-          # which user: keeps readable but not writable (no supplementary groups)
-          docker run -d --name frigate-rod-user --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000 \
-            --user 1000:1000 \
-            -v /tmp/frigate-config-rod:/config \
-            -v /tmp/frigate-media-rod:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-rod-user curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "container did not survive the switch to user:"; docker logs frigate-rod-user; exit 1; fi
-          docker logs frigate-rod-user 2>&1 | grep -q "HomeKit pairing changes will not persist"
-          docker rm -f frigate-rod-user
-      - name: Teardown
-        if: always()
-        run: docker rm -f frigate || true
   arm64_build:
     runs-on: ubuntu-22.04-arm
     name: ARM Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -461,7 +82,7 @@ jobs:
     name: Jetson Jetpack 6
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -492,7 +113,7 @@ jobs:
       - amd64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -533,7 +154,7 @@ jobs:
       - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -558,7 +179,7 @@ jobs:
       - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up QEMU and Buildx
@@ -590,7 +211,7 @@ jobs:
         with:
           string: ${{ github.repository }}
       - name: Log in to the Container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/pr_template_check.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check PR description against template
-        uses: actions/github-script@v9
+        uses: actions/github-script@v7
         with:
           script: |
             const maintainers = ['blakeblackshear', 'NickM-27', 'hawkeye217', 'dependabot[bot]', 'weblate'];

.github/workflows/pull_request.yml

@@ -16,10 +16,10 @@ jobs:
     name: Web - Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - run: npm install
@@ -35,10 +35,10 @@ jobs:
     name: Web - Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - run: npm install
@@ -46,15 +46,18 @@ jobs:
       - name: Build web
         run: npm run build
         working-directory: ./web
+      # - name: Test
+      #   run: npm run test
+      #   working-directory: ./web
 
   web_e2e:
     name: Web - E2E Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - run: npm install
@@ -69,7 +72,7 @@ jobs:
         run: npm run e2e
         working-directory: ./web
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: playwright-report
@@ -83,11 +86,11 @@ jobs:
     name: Python Checks
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@v5.4.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
       - name: Install requirements
@@ -106,10 +109,10 @@ jobs:
     name: Python Tests
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - name: Install devcontainer cli
@@ -122,9 +125,5 @@ jobs:
         run: devcontainer up --workspace-folder .
       - name: Run mypy in devcontainer
         run: devcontainer exec --workspace-folder . bash -lc "python3 -u -m mypy --config-file frigate/mypy.ini frigate"
-      - name: Check API spec is up to date
-        run: devcontainer exec --workspace-folder . bash -lc "python3 generate_api_auth_spec.py --check"
-      - name: Check analytics schema is up to date
-        run: devcontainer exec --workspace-folder . bash -lc "python3 generate_analytics_schema.py --check"
       - name: Run unit tests in devcontainer
         run: devcontainer exec --workspace-folder . bash -lc "python3 -u -m unittest"

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
       - id: lowercaseRepo
@@ -18,7 +18,7 @@ jobs:
         with:
           string: ${{ github.repository }}
       - name: Log in to the Container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/stale.yml

@@ -18,9 +18,9 @@ jobs:
           close-issue-message: ""
           days-before-stale: 30
           days-before-close: 3
-          exempt-draft-pr: false
+          exempt-draft-pr: true
-          exempt-issue-labels: "planned,security"
+          exempt-issue-labels: "pinned,security"
-          exempt-pr-labels: "planned,security,dependencies"
+          exempt-pr-labels: "pinned,security,dependencies"
           operations-per-run: 120
       - name: Print outputs
         env:

.gitignore

@@ -12,7 +12,6 @@ config/*
 models
 *.mp4
 *.db
-*.db-*
 *.csv
 frigate/version.py
 web/build
@@ -23,12 +22,3 @@ core
 !/web/**/*.ts
 .idea/*
 .ipynb_checkpoints
-
-# Auto-generated Docker Compose Generator config files
-docs/src/components/DockerComposeGenerator/config/devices.ts
-docs/src/components/DockerComposeGenerator/config/hardware.ts
-docs/src/components/DockerComposeGenerator/config/ports.ts
-
-# GenAI review prompt tester local data (frames from real cameras)
-testing-scripts/genai-review-examples/*
-!testing-scripts/genai-review-examples/README.md

AGENTS.md

@@ -1,450 +0,0 @@
-# Agent Instructions for Frigate NVR
-
-This document provides coding guidelines and best practices for contributing to Frigate NVR, a complete and local NVR designed for Home Assistant with AI object detection.
-
-## Project Overview
-
-Frigate NVR is a realtime object detection system for IP cameras that uses:
-
-- **Backend**: Python 3.13+ with FastAPI, OpenCV, TensorFlow/ONNX
-- **Frontend**: React with TypeScript, Vite, TailwindCSS
-- **Architecture**: Multiprocessing design with ZMQ and MQTT communication
-- **Focus**: Minimal resource usage with maximum performance
-
-## Code Review Guidelines
-
-When reviewing code, do NOT comment on:
-
-- Missing imports - Static analysis tooling catches these
-- Code formatting - Ruff (Python) and Prettier (TypeScript/React) handle formatting
-- Minor style inconsistencies already enforced by linters
-
-## Python Backend Standards
-
-### Python Requirements
-
-- **Compatibility**: Python 3.13+
-- **Language Features**: Use modern Python features:
-  - Pattern matching
-  - Type hints (comprehensive typing preferred)
-  - f-strings (preferred over `%` or `.format()`)
-  - Dataclasses
-  - Async/await patterns
-
-### Code Quality Standards
-
-- **Formatting**: Ruff (configured in `pyproject.toml`)
-- **Linting**: Ruff with rules defined in project config
-- **Type Checking**: Use type hints consistently
-- **Testing**: unittest framework - use `python3 -u -m unittest` to run tests
-- **Language**: American English for all code, comments, and documentation
-- **Punctuation**: Do not use em dashes in documentation, comments, or strings; reword with standard punctuation (commas, colons, parentheses, or separate sentences)
-
-### Logging Standards
-
-- **Logger Pattern**: Use module-level logger
-
-  ```python
-  import logging
-
-  logger = logging.getLogger(__name__)
-  ```
-
-- **Format Guidelines**:
-  - No periods at end of log messages
-  - No sensitive data (keys, tokens, passwords)
-  - Use lazy logging: `logger.debug("Message with %s", variable)`
-- **Log Levels**:
-  - `debug`: Development and troubleshooting information
-  - `info`: Important runtime events (startup, shutdown, state changes)
-  - `warning`: Recoverable issues that should be addressed
-  - `error`: Errors that affect functionality but don't crash the app
-  - `exception`: Use in except blocks to include traceback
-
-### Error Handling
-
-- **Exception Types**: Choose most specific exception available
-- **Try/Catch Best Practices**:
-  - Only wrap code that can throw exceptions
-  - Keep try blocks minimal - process data after the try/except
-  - Avoid bare exceptions except in background tasks
-
-  Bad pattern:
-
-  ```python
-  try:
-      data = await device.get_data()  # Can throw
-      # ❌ Don't process data inside try block
-      processed = data.get("value", 0) * 100
-      result = processed
-  except DeviceError:
-      logger.error("Failed to get data")
-  ```
-
-  Good pattern:
-
-  ```python
-  try:
-      data = await device.get_data()  # Can throw
-  except DeviceError:
-      logger.error("Failed to get data")
-      return
-
-  # ✅ Process data outside try block
-  processed = data.get("value", 0) * 100
-  result = processed
-  ```
-
-### Async Programming
-
-- **External I/O**: All external I/O operations must be async
-- **Best Practices**:
-  - Avoid sleeping in loops - use `asyncio.sleep()` not `time.sleep()`
-  - Avoid awaiting in loops - use `asyncio.gather()` instead
-  - No blocking calls in async functions
-  - Use `asyncio.create_task()` for background operations
-- **Thread Safety**: Use proper synchronization for shared state
-
-### Documentation Standards
-
-- **Module Docstrings**: Concise descriptions at top of files
-  ```python
-  """Utilities for motion detection and analysis."""
-  ```
-- **Function Docstrings**: Required for public functions and methods
-
-  ```python
-  async def process_frame(frame: ndarray, config: Config) -> Detection:
-      """Process a video frame for object detection.
-
-      Args:
-          frame: The video frame as numpy array
-          config: Detection configuration
-
-      Returns:
-          Detection results with bounding boxes
-      """
-  ```
-
-- **Comment Style**:
-  - Explain the "why" not just the "what"
-  - Keep lines under 88 characters when possible
-  - Use clear, descriptive comments
-
-### File Organization
-
-- **API Endpoints**: `frigate/api/` - FastAPI route handlers
-- **Configuration**: `frigate/config/` - Configuration parsing and validation
-- **Detectors**: `frigate/detectors/` - Object detection backends
-- **Events**: `frigate/events/` - Event management and storage
-- **Utilities**: `frigate/util/` - Shared utility functions
-
-## Frontend (React/TypeScript) Standards
-
-### Internationalization (i18n)
-
-- **CRITICAL**: Never write user-facing strings directly in components
-- **Always use react-i18next**: Import and use the `t()` function
-
-  ```tsx
-  import { useTranslation } from "react-i18next";
-
-  function MyComponent() {
-    const { t } = useTranslation(["views/live"]);
-    return <div>{t("camera_not_found")}</div>;
-  }
-  ```
-
-- **Translation Files**: Add English strings to the appropriate json files in `web/public/locales/en`
-- **Namespaces**: Organize translations by feature/view (e.g., `views/live`, `common`, `views/system`)
-
-### Code Quality
-
-- **Linting**: ESLint (see `web/eslint.config.js`)
-- **Formatting**: Prettier with Tailwind CSS plugin
-- **Type Safety**: TypeScript strict mode enabled
-
-### Component Patterns
-
-- **UI Components**: Use Radix UI primitives (in `web/src/components/ui/`)
-- **Styling**: TailwindCSS with `cn()` utility for class merging
-- **State Management**: React hooks (useState, useEffect, useCallback, useMemo)
-- **Data Fetching**: Custom hooks with proper loading and error states
-
-### ESLint Rules
-
-Key rules enforced:
-
-- `react-hooks/rules-of-hooks`: error
-- `react-hooks/exhaustive-deps`: error
-- `no-console`: error (use proper logging or remove)
-- `@typescript-eslint/no-explicit-any`: warn (always use proper types instead of `any`)
-- Unused variables must be prefixed with `_`
-- Comma dangles required for multiline objects/arrays
-
-### File Organization
-
-- **Pages**: `web/src/pages/` - Route components
-- **Views**: `web/src/views/` - Complex view components
-- **Components**: `web/src/components/` - Reusable components
-- **Hooks**: `web/src/hooks/` - Custom React hooks
-- **API**: `web/src/api/` - API client functions
-- **Types**: `web/src/types/` - TypeScript type definitions
-
-## Testing Requirements
-
-### Backend Testing
-
-- **Framework**: Python unittest
-- **Run Command**: `python3 -u -m unittest`
-- **Location**: `frigate/test/`
-- **Coverage**: Aim for comprehensive test coverage of core functionality
-- **Pattern**: Use `TestCase` classes with descriptive test method names
-  ```python
-  class TestMotionDetection(unittest.TestCase):
-      def test_detects_motion_above_threshold(self):
-          # Test implementation
-  ```
-
-### Test Best Practices
-
-- Always have a way to test your work and confirm your changes
-- Write tests for bug fixes to prevent regressions
-- Test edge cases and error conditions
-- Mock external dependencies (cameras, APIs, hardware)
-- Use fixtures for test data
-
-## Development Commands
-
-### Python Backend
-
-```bash
-# Run all tests
-python3 -u -m unittest
-
-# Run specific test file
-python3 -u -m unittest frigate.test.test_ffmpeg_presets
-
-# Check formatting (Ruff)
-ruff format --check frigate/
-
-# Apply formatting
-ruff format frigate/
-
-# Run linter
-ruff check frigate/
-
-# Type check
-python3 -u -m mypy --config-file frigate/mypy.ini frigate
-
-# Regenerate the OpenAPI spec after adding, changing, or removing an API
-# endpoint or its auth dependency — outputs docs/static/frigate-api.yaml,
-# annotated with each endpoint's auth requirement (admin / any / camera /
-# public). NEVER edit that file by hand. CI runs the --check variant and fails
-# if it is out of date. (from repo root)
-python3 generate_api_auth_spec.py
-python3 generate_api_auth_spec.py --check
-```
-
-### Frontend (from web/ directory)
-
-```bash
-# Start dev server (AI agents should never run this directly unless asked)
-npm run dev
-
-# Build for production
-npm run build
-
-# Run linter
-npm run lint
-
-# Fix linting issues
-npm run lint:fix
-
-# Format code
-npm run prettier:write
-
-# E2E: first-time setup
-npm install
-npx playwright install chromium
-
-# E2E: build the app and run all tests
-npm run e2e:build && npm run e2e
-
-# E2E: interactive UI for debugging
-npm run e2e:ui
-
-# E2E: run a specific spec
-npx playwright test --config e2e/playwright.config.ts e2e/specs/live.spec.ts
-
-# E2E: filter by name, or run only desktop/mobile
-npx playwright test --config e2e/playwright.config.ts --grep="severity tab"
-npx playwright test --config e2e/playwright.config.ts --project=desktop
-
-# E2E: regenerate mock data after backend model changes (from repo root)
-PYTHONPATH=. python3 web/e2e/fixtures/mock-data/generate-mock-data.py
-
-# Regenerate config translations from Pydantic models — outputs to
-# web/public/locales/en/config/{global,cameras}.json. NEVER edit those
-# JSON files by hand; change the Pydantic field title/description and
-# re-run this script. (from repo root)
-python3 generate_config_translations.py
-
-# Extract i18n keys from source into the locale files after adding
-# new t() calls. Use the :ci variant to verify the locale files are
-# in sync with source (fails if extraction would change anything).
-npm run i18n:extract
-npm run i18n:extract:ci
-```
-
-### Docker Development
-
-AI agents should never run these commands directly unless instructed.
-
-```bash
-# Build local image
-make local
-
-# Build debug image
-make debug
-```
-
-## Common Patterns
-
-### API Endpoint Pattern
-
-```python
-from fastapi import APIRouter, Request
-from frigate.api.defs.tags import Tags
-
-router = APIRouter(tags=[Tags.Events])
-
-@router.get("/events")
-async def get_events(request: Request, limit: int = 100):
-    """Retrieve events from the database."""
-    # Implementation
-```
-
-After adding, changing, or removing an endpoint (or its auth dependency), regenerate the OpenAPI spec with `python3 generate_api_auth_spec.py` so `docs/static/frigate-api.yaml` stays in sync and the endpoint's auth requirement is documented. CI enforces this via the `--check` variant; never edit that file by hand.
-
-### Configuration Access
-
-```python
-# Access Frigate configuration
-config: FrigateConfig = request.app.frigate_config
-camera_config = config.cameras["front_door"]
-```
-
-### Database Queries
-
-```python
-from frigate.models import Event
-
-# Use Peewee ORM for database access
-events = (
-    Event.select()
-    .where(Event.camera == camera_name)
-    .order_by(Event.start_time.desc())
-    .limit(limit)
-)
-```
-
-## Common Anti-Patterns to Avoid
-
-### ❌ Avoid These
-
-```python
-# Blocking operations in async functions
-data = requests.get(url)  # ❌ Use async HTTP client
-time.sleep(5)  # ❌ Use asyncio.sleep()
-
-# Hardcoded strings in React components
-<div>Camera not found</div>  # ❌ Use t("camera_not_found")
-
-# Missing error handling
-data = await api.get_data()  # ❌ No exception handling
-
-# Bare exceptions in regular code
-try:
-    value = await sensor.read()
-except Exception:  # ❌ Too broad
-    logger.error("Failed")
-
-# Returning exceptions in JSON responses
-except ValueError as e:
-    return JSONResponse(
-        content={"success": False, "message": str(e)},
-    )
-```
-
-### ✅ Use These Instead
-
-```python
-# Async operations
-import aiohttp
-async with aiohttp.ClientSession() as session:
-    async with session.get(url) as response:
-        data = await response.json()
-
-await asyncio.sleep(5)  # ✅ Non-blocking
-
-# Translatable strings in React
-const { t } = useTranslation();
-<div>{t("camera_not_found")}</div>  # ✅ Translatable
-
-# Proper error handling
-try:
-    data = await api.get_data()
-except ApiException as err:
-    logger.error("API error: %s", err)
-    raise
-
-# Specific exceptions
-try:
-    value = await sensor.read()
-except SensorException as err:  # ✅ Specific
-    logger.exception("Failed to read sensor")
-
-# Safe error responses
-except ValueError:
-    logger.exception("Invalid parameters for API request")
-    return JSONResponse(
-        content={
-            "success": False,
-            "message": "Invalid request parameters",
-        },
-    )
-```
-
-## WebSocket Broadcasts
-
-Outbound WebSocket broadcasts go through a per-recipient classifier in `frigate/comms/ws.py` that enforces camera-level access. **The classifier is fail-closed: any topic it doesn't recognize is dropped for every client.** New outbound topics must be classified there or they'll silently disappear.
-
-## Project-Specific Conventions
-
-### Configuration Files
-
-- Main config: `config/config.yml`
-
-### Directory Structure
-
-- Backend code: `frigate/`
-- Frontend code: `web/`
-- Docker files: `docker/`
-- Documentation: `docs/`
-- Database migrations: `migrations/`
-
-### Code Style Conformance
-
-Always conform new and refactored code to the existing coding style in the project:
-
-- Follow established patterns in similar files
-- Match indentation and formatting of surrounding code
-- Use consistent naming conventions (snake_case for Python, camelCase for TypeScript)
-- Maintain the same level of verbosity in comments and docstrings
-
-## Additional Resources
-
-- Documentation: https://docs.frigate.video
-- Main Repository: https://github.com/blakeblackshear/frigate
-- Home Assistant Integration: https://github.com/blakeblackshear/frigate-hass-integration

AI_POLICY.md

@@ -1,126 +0,0 @@
-# Frigate AI Policy
-
-## TL;DR
-
-- **Use AI tools if they help you.** We do too. This is about what you post, not which tools you use to write it.
-- **A person has to read it and send it.** Don't wire a bot or an agent up to post on your behalf.
-- **Write your posts yourself.** Your own words, the template filled in, and you answering maintainers rather than your assistant.
-- **Don't paste an AI's guess at the cause as though it were a diagnosis.** Tell us what you actually observed.
-- **Read your code before you submit it.** Disclose that AI was used, and be ready to explain every line.
-- **If we misjudge something you wrote, just say so.** We'll take you at your word.
-
-The rest of this document explains each of these, and why.
-
-## Scope
-
-AI tools are a reality of modern development and we're not opposed to their use. You are responsible for anything you submit, however it was produced, and we are responsible for anything we merge and release. We hold a high bar for both.
-
-This policy applies everywhere this project is discussed: issues, discussions, pull requests, code reviews, and commit comments.
-
-## Why this exists
-
-Frigate is built and supported by a small group of maintainers and a community of volunteers who read every post and review every pull request. Nobody here is paid to do it, and time spent reading a post is time not spent fixing bugs or building features.
-
-We're not opposed to AI tools. We use them too. But content generated by an AI and submitted without review costs a real person real time, and usually gives them less to work with than a few honest sentences would have. That is the problem this policy addresses.
-
-## A person has to be in the loop
-
-Every issue, discussion, comment, and pull request here must be read and submitted by a person. Using an AI tool to help you write is fine. Wiring one up to post on your behalf is not.
-
-Specifically, do not:
-
-- Connect a bot or agent to GitHub that opens issues, discussions, or pull requests without you reading them first
-- Post output from a tool you have not read
-- Use tooling to file bulk or drive-by contributions across the repository
-
-We will close anything we believe was posted without a person reading it, and we may mark it as spam. Posts that skip the templates are the most common sign of this.
-
-## Issues, discussions, and comments
-
-We do not mind if you use AI tools to help you write. Do not have tools post unreviewed content on your behalf. We may hide any comment we believe to be unreviewed AI output.
-
-Keep posts to what is needed to communicate your point. A long, confidently written, AI-padded post is harder to help with than a short direct one, not easier, and it is usually obvious.
-
-**Describe your actual problem in your own words.** Tell us what you did, what you expected, and what actually happened. That is the information we need, and only you have it.
-
-**Do not paste an AI's guess at the cause as though it were a diagnosis.** It is frequently wrong in ways that send everyone down the wrong path, and it buries the details that would have led to the real answer. We would rather see what you observed than what a model inferred.
-
-**Fill in the template completely.** The templates ask for logs, config, version, and hardware because those are the things needed to help you. An AI cannot supply them for you, and a post missing them cannot be acted on.
-
-**Answer maintainers yourself.** If we ask you a question, we are asking _you_, not your AI assistant. These are the spaces where we build trust and understanding with the community, and that only works if we're talking to each other. Using AI to fix your grammar or clarity is fine, but the substance has to be yours.
-
-This applies to pull request descriptions and review replies as much as it does to bug reports and discussions.
-
-### Quoting AI output
-
-If you want to include something an AI told you, it must be:
-
-- In a quote block, using `>`
-- Disclosed as AI output, saying which tool it came from
-- Accompanied by your own comment explaining why you think it is relevant
-
-Keep the excerpt short. Do not paste long transcripts.
-
-### Non-native English speakers
-
-AI is genuinely useful for participating in a project that operates in English, and we would rather hear from you through a translation tool than not hear from you at all. Using AI to improve the grammar or clarity of something you wrote yourself is fine.
-
-If you are translating your posts, make sure the translation says what you meant. Including your original text in a `<details>` block helps us verify the translation if something reads oddly, and keeps the thread readable.
-
-## Code contributions
-
-We need to understand your relationship with the code you're submitting. The more AI was involved, the more important it is that you've genuinely reviewed, tested, and understood what it produced.
-
-Because of the long-term maintenance burden every merged change creates, we require a human in the loop who understands the work the AI produced. Pull requests that appear to be unreviewed AI output will be closed without review.
-
-### Requirements when AI is used
-
-If AI is used to generate any portion of the code, contributors must adhere to the following requirements:
-
-1. **Explicitly disclose the manner in which AI was employed.** The PR template asks for this. Be honest, this won't automatically disqualify your PR. We'd rather have an honest disclosure than find out later. Trust matters more than method.
-2. **Perform a comprehensive manual review prior to submitting the pull request.** Don't submit code you haven't read carefully and tested locally.
-3. **Be prepared to explain every line of code you submitted when asked about it by a maintainer.** If you can't explain why something works the way it does, you're not ready to submit it.
-4. **Check for an existing pull request addressing the same change.** If one exists, comment there and work with its author instead of opening a duplicate.
-5. **It is strictly prohibited to use AI to write your posts for you** (bug reports, feature requests, pull request descriptions, GitHub discussions, responding to humans, etc.). We need to hear from _you_, not your AI assistant. These are the spaces where we build trust and understanding with contributors, and that only works if we're talking to each other.
-
-### Established contributors
-
-Contributors with a long history of thoughtful, quality contributions to Frigate have earned trust through that track record. The level of scrutiny we apply to AI usage naturally reflects that trust. This isn't a formal exemption, it's just how trust works. If you've been around, we know how you think and how you work. If you're new, we're still getting to know you, and clear disclosure helps build that relationship.
-
-### What this means in practice
-
-We're not trying to gatekeep how you write code. Use whatever tools make you productive. But there's a difference between using AI as a tool to implement something you understand and handing a feature request to an AI and submitting whatever comes back. The former is fine. The latter creates maintenance risk for the project.
-
-Some honest context: when we review a PR, we're not just evaluating whether the code works today. We're evaluating whether we can maintain it, debug it, and extend it long-term, often without the original author's involvement. Code that the author doesn't deeply understand is code that nobody understands, and that's a liability.
-
-One more thing worth saying directly: most maintainers already have access to the same AI tools you do. A PR that's entirely AI-generated, where the author can't explain the design, debug issues independently, or engage substantively in design discussions, doesn't offer something we couldn't produce ourselves. What makes a contribution genuinely valuable is the human judgment and domain understanding behind it, as well as the engagement during review that shapes it into something we can confidently take on long-term.
-
-## Our use of AI
-
-The Frigate documentation site has an "Ask AI" search that answers questions from the docs, and we may use AI tooling to help with triage and project management. Like any automated tooling, it is not always right.
-
-If an AI tool leaves a comment on your contribution, treat it the way you would any other comment. If you think it is wrong, say so, and a brief explanation is enough. Maintainers always have the final say.
-
-## Enforcement
-
-Contributions and posts that do not follow this policy will be closed. Depending on the situation, maintainers may also:
-
-- Hide or delete comments that appear to be unreviewed AI output
-- Mark automated content as spam
-- Close an issue, discussion, or pull request without further review
-- Lock a conversation
-- Temporarily or permanently block an account from participating in the project
-
-Repeated violations may result in being blocked from contributing to Frigate.
-
-### When we get it wrong
-
-There is no reliable way to detect this, and we're not going to pretend otherwise. Whether something reads as unreviewed AI output is a judgment call, usually made quickly, by a volunteer with limited time and no way to know for certain. These calls are subjective and we won't always get them right.
-
-If it happens to you, just say so. A short reply telling us you wrote it yourself is enough, and we'll take you at your word and pick the conversation back up. We would much rather occasionally reopen something we misjudged than treat everyone who posts here as a suspect.
-
-We'd ask for some understanding in return. These calls get made quickly because the volume is real, and time spent second-guessing them is time not spent helping the person in the next thread.
-
-## Attribution
-
-Portions of this policy are adapted from the [Open Home Foundation AI Policy](https://developers.home-assistant.io/docs/ai_policy/).

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

CODEOWNERS

@@ -5,4 +5,3 @@
 /docker/rockchip/ @MarcA711
 /docker/rocm/ @harakas
 /docker/hailo8l/ @spanner3003
-/docker/deepx/ @sixfab

CONTRIBUTING.md

@@ -2,8 +2,6 @@
 
 Thank you for your interest in contributing to Frigate. This document covers the expectations and guidelines for contributions. Please read it before submitting a pull request.
 
-All participation in this project, including pull requests, issues, and discussions, is covered by our [AI policy](AI_POLICY.md).
-
 ## Before you start
 
 ### Bugfixes
@@ -12,27 +10,34 @@ If you've found a bug and want to fix it, go for it. Link to the relevant issue
 
 ### New features
 
-A pull request is more than just code — it's a request for the maintainers to review, integrate, and support the change long-term. We're selective about what we take on, and prioritize changes that align with the project's direction and can be responsibly maintained in the long term.
+Every new feature adds scope that the maintainers must test, maintain, and support long-term. Before writing code for a new feature:
 
-**Large or highly-requested features** raise the bar even higher. Popularity signals demand, but it doesn't pre-approve any particular implementation. The bigger the change, the higher the long-term cost, and the more important it is that we're aligned on scope and approach before any code is written. A large PR that lands without prior discussion is unlikely to be merged as-is, no matter how well it's implemented.
+1. **Check for existing discussion.** Search [feature requests](https://github.com/blakeblackshear/frigate/issues) and [discussions](https://github.com/blakeblackshear/frigate/discussions) to see if it's been proposed or discussed. Pinned feature requests are on our radar — we plan to get to them, but we don't maintain a public roadmap or timeline. Check in with us first if you have interest in contributing to one.
-
-Before writing code for a new feature:
-
-1. **Check for existing discussion.** Search [feature requests](https://github.com/blakeblackshear/frigate/issues) and [discussions](https://github.com/blakeblackshear/frigate/discussions) to see if it's been proposed or discussed. Feature requests tagged with "planned" are on our radar — we plan to get to them, but we don't maintain a public roadmap or timeline. Check in with us first if you have interest in contributing to one.
 2. **Start a discussion or feature request first.** This helps ensure your idea aligns with Frigate's direction before you invest time building it. Community interest in a feature request helps us gauge demand, though a great idea is a great idea even without a crowd behind it.
+3. **Be open to "no".** We try to be thoughtful about what we take on, and sometimes that means saying no to good code if the feature isn't the right fit for the project. These calls are sometimes subjective, and we won't always get them right. We're happy to discuss and reconsider.
 
 ## AI usage policy
 
-AI tools are a reality of modern development and we're not opposed to their use. But we need to understand your relationship with the code you're submitting, and we need to hear from you rather than from your AI assistant.
+AI tools are a reality of modern development and we're not opposed to their use. But we need to understand your relationship with the code you're submitting. The more AI was involved, the more important it is that you've genuinely reviewed, tested, and understood what it produced.
 
-**Read the [AI policy](AI_POLICY.md) before you open a pull request.** It is short, and it applies to everything you post here. The parts that most often catch people out:
+### Requirements when AI is used
 
-- A person has to be in the loop. Don't wire a bot or agent up to open pull requests, issues, or discussions on your behalf.
+If AI is used to generate any portion of the code, contributors must adhere to the following requirements:
-- Disclose how AI was used. The PR template asks for this. Be honest, it won't automatically disqualify your PR.
-- Review and test everything you submit, and be prepared to explain every line when asked.
-- Don't use AI to write your PR description or your replies to maintainers.
 
-Pull requests that appear to be unreviewed AI output will be closed without review.
+1. **Explicitly disclose the manner in which AI was employed.** The PR template asks for this. Be honest — this won't automatically disqualify your PR. We'd rather have an honest disclosure than find out later. Trust matters more than method.
+2. **Perform a comprehensive manual review prior to submitting the pull request.** Don't submit code you haven't read carefully and tested locally.
+3. **Be prepared to explain every line of code they submitted when asked about it by a maintainer.** If you can't explain why something works the way it does, you're not ready to submit it.
+4. **It is strictly prohibited to use AI to write your posts for you** (bug reports, feature requests, pull request descriptions, GitHub discussions, responding to humans, etc.). We need to hear from _you_, not your AI assistant. These are the spaces where we build trust and understanding with contributors, and that only works if we're talking to each other.
+
+### Established contributors
+
+Contributors with a long history of thoughtful, quality contributions to Frigate have earned trust through that track record. The level of scrutiny we apply to AI usage naturally reflects that trust. This isn't a formal exemption — it's just how trust works. If you've been around, we know how you think and how you work. If you're new, we're still getting to know you, and clear disclosure helps build that relationship.
+
+### What this means in practice
+
+We're not trying to gatekeep how you write code. Use whatever tools make you productive. But there's a difference between using AI as a tool to implement something you understand and handing a feature request to an AI and submitting whatever comes back. The former is fine. The latter creates maintenance risk for the project.
+
+Some honest context: when we review a PR, we're not just evaluating whether the code works today. We're evaluating whether we can maintain it, debug it, and extend it long-term — often without the original author's involvement. Code that the author doesn't deeply understand is code that nobody understands, and that's a liability.
 
 ## Pull request guidelines
 

Makefile

@@ -1,7 +1,7 @@
 default_target: local
 
 COMMIT_HASH := $(shell git log -1 --pretty=format:"%h"|tail -1)
-VERSION = 0.19.0
+VERSION = 0.18.0
 IMAGE_REPO ?= ghcr.io/blakeblackshear/frigate
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
 BOARDS= #Initialized empty

audio-labelmap.txt

@@ -24,7 +24,7 @@ yell
 sigh
 singing
 choir
-yodeling
+sodeling
 chant
 mantra
 child_singing

docker/deepx/user_installation.sh

@@ -1,131 +0,0 @@
-#!/bin/bash
-
-# Installs the DEEPX NPU kernel driver and the DX-RT runtime on the Docker host,
-# then enables the vendor's dxrt.service. A container cannot load kernel
-# modules, so this runs outside the image; the driver creates the /dev/dxrt*
-# nodes and the daemon multiplexes the NPU across host and container.
-#
-# Driver, runtime and firmware versions must agree or inference hangs instead
-# of failing at startup. The set this script installs is pinned in
-# driver_version, runtime_version and firmware_version below; move them
-# together, never one at a time.
-#
-# DEEPX NPU support in Frigate is maintained by Sixfab (https://sixfab.com).
-
-set -euo pipefail
-
-driver_version="v2.6.0"
-# the commit the tag resolves to, since DEEPX signs neither tags nor releases
-# and this is compiled and installed as root. Update both together
-driver_commit="7074748e7104f470b02f517583abba652b3f05fa"
-firmware_version="v2.7.4"
-
-sudo apt-get update
-sudo apt-get install -y git build-essential "linux-headers-$(uname -r)" pciutils wget
-
-if ! lspci -d 1ff4: | grep -q .; then
-    echo "No DEEPX device found on the PCIe bus (lspci -d 1ff4:)."
-    echo "Check that the module is seated correctly before continuing."
-    exit 1
-fi
-
-# fetch the pinned commit rather than cloning the tag, so a retag cannot swap
-# in different source. The build directory is reused so a second run after a
-# failure does not stop on the directory already being there
-mkdir -p dx_rt_npu_linux_driver
-cd dx_rt_npu_linux_driver
-git init -q
-git remote get-url origin > /dev/null 2>&1 ||
-    git remote add origin https://github.com/DEEPX-AI/dx_rt_npu_linux_driver.git
-git fetch --depth 1 origin "${driver_commit}"
-git checkout -q FETCH_HEAD
-
-fetched_commit=$(git rev-parse HEAD)
-if [[ "${fetched_commit}" != "${driver_commit}" ]]; then
-    echo "Fetched commit ${fetched_commit} does not match pinned driver_commit ${driver_commit}."
-    echo "Refusing to build unverified driver source."
-    exit 1
-fi
-
-cd modules
-
-sudo ./build.sh -c install --reload
-
-sudo depmod -A
-
-# dx_dma is the PCIe transport, dxrt_driver the NPU driver on top of it
-for module in dx_dma dxrt_driver; do
-    if ! sudo modprobe "${module}"; then
-        echo "Unable to load the ${module} kernel module, common reasons are:"
-        echo "- Secure Boot is enabled and is rejecting the unsigned module."
-        echo "- The running kernel does not match the installed linux-headers."
-        exit 1
-    fi
-done
-
-if ! compgen -G "/dev/dxrt*" > /dev/null; then
-    echo "Modules loaded but no /dev/dxrt* device node appeared."
-    echo "Run ./sanity_check.sh from the driver repo to diagnose."
-    exit 1
-fi
-
-runtime_version="v3.4.0"
-declare -A runtime_sha256=(
-    [amd64]="736cfef009ce9e974ab1ab610d867239d19d72a426a53e367ddcbd53297b6e20"
-    [arm64]="eb6107f5f02f2ad76ae89f414e8b5f346f34fbc6f0888236136853a26be6f6a0"
-)
-
-runtime_release="${runtime_version#v}"
-deb_arch=$(dpkg --print-architecture)
-deb_file="/tmp/libdxrt-bin_${runtime_release}_${deb_arch}.deb"
-
-wget -qO "${deb_file}" \
-    "https://raw.githubusercontent.com/DEEPX-AI/dx_rt/${runtime_version}/release/${runtime_release}/libdxrt-bin_${runtime_release}_${deb_arch}.deb"
-
-expected_sha256="${runtime_sha256[${deb_arch}]:-}"
-if [[ -z "${expected_sha256}" ]]; then
-    echo "No pinned SHA-256 for architecture ${deb_arch}; refusing to install."
-    exit 1
-fi
-if [[ "$(sha256sum "${deb_file}" | cut -d' ' -f1)" != "${expected_sha256}" ]]; then
-    echo "SHA-256 mismatch for ${deb_file}; refusing to install."
-    exit 1
-fi
-
-sudo dpkg -i "${deb_file}"
-sudo ldconfig
-rm -f "${deb_file}"
-
-sudo cp /usr/share/libdxrt-bin/service/dxrt.service /etc/systemd/system/
-
-# With an endpoint set, dxrtd binds that path only, so the socket goes in a
-# directory Frigate can mount (kept across restarts so the mount stays valid)
-# and a symlink at the default /tmp path keeps host tools that do not set the
-# variable working through their own fallback.
-sudo mkdir -p /etc/systemd/system/dxrt.service.d
-sudo tee /etc/systemd/system/dxrt.service.d/frigate.conf > /dev/null <<'UNIT'
-[Service]
-RuntimeDirectory=dxrt
-RuntimeDirectoryMode=0755
-RuntimeDirectoryPreserve=yes
-Environment=DXRT_DYNAMIC_IPC_ENDPOINT=/run/dxrt/dxrt_dynamic_ipc.sock
-ExecStartPost=/bin/ln -sfn /run/dxrt/dxrt_dynamic_ipc.sock /tmp/dxrt_dynamic_ipc.sock
-UNIT
-
-sudo systemctl daemon-reload
-sudo systemctl enable dxrt.service
-sudo systemctl restart dxrt.service
-
-if ! sudo systemctl is-active --quiet dxrt.service; then
-    echo "dxrt.service did not start. Check: sudo journalctl -u dxrt.service"
-    exit 1
-fi
-
-echo "DEEPX driver and runtime installation complete."
-echo "Driver version:   $(modinfo -F version dxrt_driver) (expected ${driver_version#v})"
-echo "Runtime version:  ${runtime_release}"
-echo "Device node(s):   $(echo /dev/dxrt*)"
-echo
-echo "This driver expects NPU firmware ${firmware_version}. Check it with:"
-echo "  dxrt-cli --status"
-echo "Update the module if it does not match before starting Frigate."

docker/main/Dockerfile

@@ -60,10 +60,10 @@ ARG DEBIAN_FRONTEND
 RUN --mount=type=bind,source=docker/main/build_intel_media_driver.sh,target=/deps/build_intel_media_driver.sh \
     /deps/build_intel_media_driver.sh
 
-FROM wget AS go2rtc
+FROM scratch AS go2rtc
 ARG TARGETARCH
-RUN --mount=type=bind,source=docker/main/install_go2rtc.sh,target=/deps/install_go2rtc.sh \
+WORKDIR /rootfs/usr/local/go2rtc/bin
-    /deps/install_go2rtc.sh
+ADD --link --chmod=755 "https://github.com/AlexxIT/go2rtc/releases/download/v1.9.13/go2rtc_linux_${TARGETARCH}" go2rtc
 
 FROM wget AS tempio
 ARG TARGETARCH
@@ -81,10 +81,10 @@ RUN --mount=type=bind,source=docker/main/install_tempio.sh,target=/deps/install_
 FROM base_host AS ov-converter
 ARG DEBIAN_FRONTEND
 
-# Install OpenVINO for model conversion
+# Install OpenVino Runtime and Dev library
 COPY docker/main/requirements-ov.txt /requirements-ov.txt
 RUN apt-get -qq update \
-    && apt-get -qq install -y wget python3 python3-distutils \
+    && apt-get -qq install -y wget python3 python3-dev python3-distutils gcc pkg-config libhdf5-dev \
     && wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
     && python3 get-pip.py "pip" \
@@ -146,8 +146,6 @@ RUN wget -q https://github.com/openvinotoolkit/open_model_zoo/raw/master/data/da
 RUN wget -qO - https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download | tar xvz && mv 1.tflite cpu_audio_model.tflite
 COPY audio-labelmap.txt .
 
-RUN chmod -R a+rX /rootfs
-
 
 FROM wget AS s6-overlay
 ARG TARGETARCH
@@ -202,6 +200,10 @@ RUN pip3 wheel --wheel-dir=/wheels -r /requirements-wheels.txt && \
         pip3 wheel --wheel-dir=/wheels -r /requirements-dev.txt; \
     fi
 
+# Install HailoRT & Wheels
+RUN --mount=type=bind,source=docker/main/install_hailort.sh,target=/deps/install_hailort.sh \
+    /deps/install_hailort.sh
+
 # Collect deps in a single layer
 FROM scratch AS deps-rootfs
 COPY --from=nginx /usr/local/nginx/ /usr/local/nginx/
@@ -212,6 +214,7 @@ COPY --from=libusb-build /usr/local/lib /usr/local/lib
 COPY --from=tempio /rootfs/ /
 COPY --from=s6-overlay /rootfs/ /
 COPY --from=models /rootfs/ /
+COPY --from=wheels /rootfs/ /
 COPY docker/main/rootfs/ /
 
 
@@ -262,25 +265,8 @@ ENV PATH="/usr/local/go2rtc/bin:/usr/local/tempio/bin:/usr/local/nginx/sbin:${PA
 RUN --mount=type=bind,source=docker/main/install_deps.sh,target=/deps/install_deps.sh \
     /deps/install_deps.sh
 
-# Runtime users. frigate may be remapped at start via PUID/PGID (init-usermod)
+ENV DEFAULT_FFMPEG_VERSION="7.0"
-# or replaced entirely with docker's --user. go2rtc is intentionally separate
+ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:5.0"
-# and more restricted. frigate-data is the shared group for /config access.
-# -o tolerates variant base images that already contain uid/gid 1000.
-RUN groupadd -o --gid 1000 frigate \
-    && useradd -o --uid 1000 --gid frigate --no-create-home --shell /usr/sbin/nologin frigate \
-    && groupadd --system go2rtc \
-    && useradd --system --gid go2rtc --no-create-home --shell /usr/sbin/nologin go2rtc \
-    && groupadd --system frigate-data \
-    && usermod -aG frigate-data frigate \
-    && usermod -aG frigate-data go2rtc \
-    && for grp in video render plugdev audio; do \
-         if getent group "$grp" >/dev/null; then \
-           usermod -aG "$grp" frigate && usermod -aG "$grp" go2rtc; \
-         fi; \
-       done
-
-ENV DEFAULT_FFMPEG_VERSION="8.0"
-ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:7.0:5.0"
 
 RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
@@ -289,12 +275,16 @@ RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
 RUN --mount=type=bind,from=wheels,source=/wheels,target=/deps/wheels \
     pip3 install -U /deps/wheels/*.whl
 
-# The Hailo, MemryX, and Axera runtimes are installed at first start by
+# Install Axera Engine
-# frigate/util/runtime_deps.py, only when that detector is configured.
+RUN pip3 install https://github.com/AXERA-TECH/pyaxengine/releases/download/0.1.3-frigate/axengine-0.1.3-py3-none-any.whl
-# Axera's native libraries are bind mounted from the host.
+
 ENV PATH="${PATH}:/usr/bin/axcl"
 ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/usr/lib/axcl"
 
+# Install MemryX runtime (requires libgomp (OpenMP) in the final docker image)
+RUN --mount=type=bind,source=docker/main/install_memryx.sh,target=/deps/install_memryx.sh \
+    bash -c "bash /deps/install_memryx.sh"
+
 COPY --from=deps-rootfs / /
 
 RUN ldconfig
@@ -307,9 +297,6 @@ EXPOSE 8555/tcp 8555/udp
 ENV S6_LOGGING_SCRIPT="T 1 n0 s10000000 T"
 # Do not fail on long-running download scripts
 ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
-# Allow running with a read-only root filesystem: s6 copies its scan dir into
-# /run and executes service scripts from there, so /run must allow exec
-ENV S6_READ_ONLY_ROOT=1
 
 ENTRYPOINT ["/init"]
 CMD []
@@ -320,11 +307,6 @@ HEALTHCHECK --start-period=300s --start-interval=5s --interval=15s --timeout=5s
 # Frigate deps with Node.js and NPM for devcontainer
 FROM deps AS devcontainer
 
-# /config here is the developer's bind-mounted checkout, not a data volume, so
-# the prepare ownership sweep must not run: it would chown the source tree to
-# the runtime uid and lock out any container user that isn't 1000.
-ENV FRIGATE_RUN_AS_ROOT=true
-
 # Do not start the actual Frigate service on devcontainer as it will be started by VS Code
 # But start a fake service for simulating the logs
 COPY docker/main/fake_frigate_run /etc/s6-overlay/s6-rc.d/frigate/run
@@ -381,8 +363,3 @@ FROM deps AS frigate
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=standard
-
-# Pre-compile bytecode so a read-only rootfs doesn't force re-parsing the
-# source tree on every boot (pip-installed packages are already compiled)
-RUN python3 -m compileall -q -j0 /opt/frigate/frigate

docker/main/build_nginx.sh

@@ -3,7 +3,7 @@
 set -euxo pipefail
 
 NGINX_VERSION="1.27.4"
-VOD_MODULE_VERSION="v1.9.1"
+VOD_MODULE_VERSION="1.31"
 SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
@@ -31,24 +31,24 @@ wget -nv https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
 tar -zxf nginx-${NGINX_VERSION}.tar.gz -C /tmp/nginx --strip-components=1
 rm nginx-${NGINX_VERSION}.tar.gz
 mkdir /tmp/nginx-vod-module
-wget -nv https://github.com/dio-az/nginx-vod-module/archive/refs/tags/${VOD_MODULE_VERSION}.tar.gz
+wget -nv https://github.com/kaltura/nginx-vod-module/archive/refs/tags/${VOD_MODULE_VERSION}.tar.gz
 tar -zxf ${VOD_MODULE_VERSION}.tar.gz -C /tmp/nginx-vod-module --strip-components=1
 rm ${VOD_MODULE_VERSION}.tar.gz
     # Patch MAX_CLIPS to allow more clips to be added than the default 128
 sed -i 's/MAX_CLIPS (128)/MAX_CLIPS (1080)/g' /tmp/nginx-vod-module/vod/media_set.h
 patch -d /tmp/nginx-vod-module/ -p1 << 'EOF'
---- a/vod/avc_hevc_parser.c
+--- a/vod/avc_hevc_parser.c       2022-06-27 11:38:10.000000000 +0000
-+++ b/vod/avc_hevc_parser.c
++++ b/vod/avc_hevc_parser.c       2023-01-16 11:25:10.900521298 +0000
-@@ -2,6 +2,9 @@
+@@ -3,6 +3,9 @@
-
  bool_t
- avc_hevc_parser_rbsp_trailing_bits(bit_reader_state_t* reader) {
+ avc_hevc_parser_rbsp_trailing_bits(bit_reader_state_t* reader)
+ {
 +	// https://github.com/blakeblackshear/frigate/issues/4572
 +	return TRUE;
 +
  	uint32_t one_bit;
 
- 	if (reader->stream.eof_reached) {
+ 	if (reader->stream.eof_reached)
 EOF
 
 

docker/main/build_ov_model.py

@@ -1,106 +1,11 @@
-"""Convert the default SSDLite MobileNet v2 model to OpenVINO IR.
-
-Replaces the legacy openvino-dev Model Optimizer conversion. The TensorFlow
-frontend translates the Object Detection API pre and post processors literally,
-producing per-class NonMaxSuppression, NonZero ops and map loops with data
-dependent shapes that the GPU plugin handles very badly. Both are cut out the
-way ssd_v2_support.json used to do it: the preprocessor is an identity at the
-native 300x300 input, and the postprocessor becomes a single fused
-DetectionOutput. The result is the [1, 1, 100, 7] tensor that Frigate's
-OpenVINO detector expects, with the input flipped to BGR to match the legacy
-reverse_input_channels behavior.
-"""
-
-import numpy as np
 import openvino as ov
-from openvino import opset8 as ops
+from openvino.tools import mo
-from openvino.preprocess import PrePostProcessor
 
-MODEL_DIR = "/models/ssdlite_mobilenet_v2_coco_2018_05_09"
+ov_model = mo.convert_model(
-OUTPUT_PATH = "/models/ssdlite_mobilenet_v2.xml"
+    "/models/ssdlite_mobilenet_v2_coco_2018_05_09/frozen_inference_graph.pb",
-INPUT_SHAPE = [1, 300, 300, 3]
+    compress_to_fp16=True,
-
+    transformations_config="/usr/local/lib/python3.11/dist-packages/openvino/tools/mo/front/tf/ssd_v2_support.json",
-# faster_rcnn_box_coder divides the deltas by pipeline.config's y/x/height/width
+    tensorflow_object_detection_api_pipeline_config="/models/ssdlite_mobilenet_v2_coco_2018_05_09/pipeline.config",
-# scales of 10/10/5/5, which DetectionOutput expresses as per-prior variances.
+    reverse_input_channels=True,
-BOX_VARIANCES = np.float32([0.1, 0.1, 0.2, 0.2])
-
-model = ov.convert_model(
-    f"{MODEL_DIR}/frozen_inference_graph.pb",
-    input=[("image_tensor:0", INPUT_SHAPE)],
 )
-
+ov.save_model(ov_model, "/models/ssdlite_mobilenet_v2.xml")
-nodes = {op.get_friendly_name(): op for op in model.get_ordered_ops()}
-parameter = model.get_parameters()[0]
-
-preprocessor = nodes["Preprocessor/map/TensorArrayStack/TensorArrayGatherV3"]
-box_deltas = nodes["Postprocessor/Reshape_1"].output(0)
-class_scores = nodes["Postprocessor/convert_scores"].output(0)
-anchors_output = nodes["Postprocessor/Reshape"].output(0)
-
-# The anchors only depend on the static input shape, so fold them into a
-# constant and drop the generator subgraph with the rest of the postprocessor.
-probe = ov.Core().compile_model(
-    ov.Model([anchors_output, preprocessor.output(0)], [parameter], "probe"), "CPU"
-)
-probe_input = np.random.default_rng(0).integers(0, 255, INPUT_SHAPE, dtype=np.uint8)
-anchors, resized = (out.copy() for out in probe([probe_input]).values())
-
-assert np.allclose(resized, probe_input, atol=1e-3), (
-    "preprocessor is not an identity at 300x300, it cannot be bypassed"
-)
-
-image = ops.convert(parameter, "f32")
-
-for consumer in list(preprocessor.output(0).get_target_inputs()):
-    consumer.replace_source_output(image.output(0))
-
-# (ymin, xmin, ymax, xmax) -> (xmin, ymin, xmax, ymax)
-priors = anchors[:, [1, 0, 3, 2]].astype(np.float32).reshape(-1)
-variances = np.tile(BOX_VARIANCES, len(anchors))
-proposals = ops.constant(np.stack([priors, variances])[np.newaxis])
-
-# (ty, tx, th, tw) -> (dx, dy, dw, dh) for the CENTER_SIZE decode
-box_logits = ops.reshape(ops.gather(box_deltas, [1, 0, 3, 2], 1), [1, -1], False)
-class_preds = ops.reshape(class_scores, [1, -1], False)
-
-detections = ops.detection_output(
-    box_logits,
-    class_preds,
-    proposals,
-    {
-        "background_label_id": 0,
-        "top_k": 100,
-        "keep_top_k": [100],
-        "nms_threshold": 0.6,
-        "confidence_threshold": 0.3,
-        "code_type": "caffe.PriorBoxParameter.CENTER_SIZE",
-        "share_location": True,
-        "variance_encoded_in_target": False,
-        "normalized": True,
-        "clip_before_nms": False,
-        "clip_after_nms": True,
-        "decrease_label_id": False,
-    },
-)
-detections.output(0).get_tensor().set_names({"detection_out"})
-
-model = ov.Model([detections], [parameter], "ssdlite_mobilenet_v2")
-
-ppp = PrePostProcessor(model)
-ppp.input().tensor().set_layout(ov.Layout("NHWC"))
-ppp.input().preprocess().reverse_channels()
-model = ppp.build()
-
-# Fail the build rather than silently ship the dynamically shaped graph again.
-op_types = [op.get_type_name() for op in model.get_ordered_ops()]
-assert op_types.count("DetectionOutput") == 1, "postprocessor was not fused"
-
-for dynamic_op in ("NonMaxSuppression", "NonZero", "Loop", "TensorIterator"):
-    assert dynamic_op not in op_types, f"{dynamic_op} left in the graph"
-
-output_shape = model.outputs[0].get_partial_shape()
-assert output_shape.is_static and list(output_shape) == [1, 1, 100, 7], (
-    f"unexpected detector output shape {output_shape}"
-)
-
-ov.save_model(model, OUTPUT_PATH, compress_to_fp16=True)

docker/main/build_sqlite_vec.sh

@@ -2,7 +2,7 @@
 
 set -euxo pipefail
 
-SQLITE_VEC_VERSION="0.1.9"
+SQLITE_VEC_VERSION="0.1.3"
 
 source /etc/os-release
 

docker/main/install_deps.sh

@@ -10,7 +10,7 @@ apt-get -qq install --no-install-recommends -y \
     gnupg \
     wget \
     lbzip2 \
-    procps vainfo acl \
+    procps vainfo \
     unzip locales tzdata libxml2 xz-utils \
     python3.11 \
     curl \
@@ -28,13 +28,7 @@ update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
 mkdir -p -m 600 /root/.gnupg
 
 # install coral runtime
-# sha256 digests of the release debs; update when bumping the libedgetpu release.
-declare -A edgetpu_checksums=(
-    ["amd64"]="63fd00989d29160fa9894e115156a9abe456e88751fc9be89d26e4696200441b"
-    ["arm64"]="eab8aa4576b4dbf738135d8094f32270b24117f77147d25cbe0f49d0144d85f2"
-)
 wget -q -O /tmp/libedgetpu1-max.deb "https://github.com/feranick/libedgetpu/releases/download/16.0TF2.17.1-1/libedgetpu1-max_16.0tf2.17.1-1.bookworm_${TARGETARCH}.deb"
-echo "${edgetpu_checksums[${TARGETARCH}]}  /tmp/libedgetpu1-max.deb" | sha256sum -c -
 unset DEBIAN_FRONTEND
 yes | dpkg -i /tmp/libedgetpu1-max.deb && export DEBIAN_FRONTEND=noninteractive
 rm /tmp/libedgetpu1-max.deb
@@ -51,41 +45,28 @@ if [[ "${TARGETARCH}" == "arm64" ]]; then
     fi
 fi
 
-# sha256 digests of the ffmpeg builds, keyed "<install dir>-<arch>".
-# Upstream publishes no checksums; these come from a one-time fetch and guard
-# against later substitution. Update when bumping a build URL.
-declare -A ffmpeg_checksums=(
-    ["5.0-amd64"]="377abec133f9d9e8014dee1b91c9684ac8bb0b5b7d80100a57116ff837c4c0d4"
-    ["7.0-amd64"]="e13860eb90409c8218319c928067834ce450128e86f24cfed5cfe91ce6e31037"
-    ["8.0-amd64"]="9bac85054d351cdc89c0a4f45c8ea5c44df94009aabd964b719bbadd56aedae9"
-    ["5.0-arm64"]="57ee475407bad49910ba9b946428396e30cf075ea28a7912fbe1aa2578085af0"
-    ["7.0-arm64"]="16c8b04e9d0ea9c769ad964c4c453fcf05121a1947237329d2e9d8a5e43e2a3c"
-    ["8.0-arm64"]="cd91948468d0f11ce795a2cdaa0c69911bd1db313b49bb19c22512beb88cde69"
-)
-
-# the tarballs nest their binaries under a directory named for the arch, which
-# matches TARGETARCH for both builds we consume
-install_ffmpeg() {
-    local dir="$1" url="$2"
-    mkdir -p "/usr/lib/ffmpeg/${dir}"
-    wget -qO ffmpeg.tar.xz "${url}"
-    echo "${ffmpeg_checksums[${dir}-${TARGETARCH}]}  ffmpeg.tar.xz" | sha256sum -c -
-    tar -xf ffmpeg.tar.xz -C "/usr/lib/ffmpeg/${dir}" --strip-components 1 "${TARGETARCH}/bin/ffmpeg" "${TARGETARCH}/bin/ffprobe"
-    rm -f ffmpeg.tar.xz
-}
-
 # ffmpeg -> amd64
 if [[ "${TARGETARCH}" == "amd64" ]]; then
-    install_ffmpeg 5.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
+    mkdir -p /usr/lib/ffmpeg/5.0
-    install_ffmpeg 7.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linux64-gpl-7.0.tar.xz"
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
-    install_ffmpeg 8.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linux64-gpl-8.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
+    rm -rf ffmpeg.tar.xz
+    mkdir -p /usr/lib/ffmpeg/7.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-03-19-13-03/ffmpeg-n7.1.3-43-g5a1f107b4c-linux64-gpl-7.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
+    rm -rf ffmpeg.tar.xz
 fi
 
 # ffmpeg -> arm64
 if [[ "${TARGETARCH}" == "arm64" ]]; then
-    install_ffmpeg 5.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
+    mkdir -p /usr/lib/ffmpeg/5.0
-    install_ffmpeg 7.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linuxarm64-gpl-7.0.tar.xz"
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
-    install_ffmpeg 8.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linuxarm64-gpl-8.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
+    rm -f ffmpeg.tar.xz
+    mkdir -p /usr/lib/ffmpeg/7.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-03-19-13-03/ffmpeg-n7.1.3-43-g5a1f107b4c-linuxarm64-gpl-7.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
+    rm -f ffmpeg.tar.xz
 fi
 
 # arch specific packages
@@ -106,89 +87,49 @@ if [[ "${TARGETARCH}" == "amd64" ]]; then
     # intel packages use zst compression so we need to update dpkg
     apt-get install -y dpkg
 
-    # use intel apt repo for libmfx1 (legacy QSV, pre-Gen12)
+    # use intel apt intel packages
     wget -qO - https://repositories.intel.com/gpu/intel-graphics.key | gpg --yes --dearmor --output /usr/share/keyrings/intel-graphics.gpg
     echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu jammy client" | tee /etc/apt/sources.list.d/intel-gpu-jammy.list
     apt-get -qq update
-
     # intel-media-va-driver-non-free is built from source in the
     # intel-media-driver Dockerfile stage for Battlemage (Xe2) support
     apt-get -qq install --no-install-recommends --no-install-suggests -y \
-        libmfx1
+        libmfx1 libmfxgen1 libvpl2
-    rm -f /usr/share/keyrings/intel-graphics.gpg
-    rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list
 
-    # upgrade libva2, oneVPL runtime, and libvpl2 from trixie for Battlemage support
-    echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/trixie.list
-    apt-get -qq update
-    apt-get -qq install -y -t trixie libva2 libva-drm2 libzstd1
-    apt-get -qq install -y -t trixie libmfx-gen1.2 libvpl2
-    rm -f /etc/apt/sources.list.d/trixie.list
-    apt-get -qq update
     apt-get -qq install -y ocl-icd-libopencl1
 
     # install libtbb12 for NPU support
     apt-get -qq install -y libtbb12
 
-    # install legacy and standard intel compute packages
+    rm -f /usr/share/keyrings/intel-graphics.gpg
-    # sha256 digests of the driver debs, taken from the ww<week>.sum asset
+    rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list
-    # compute-runtime ships per release and the checksum.sha256 on npu-driver
-    # v1.19.0; intel-graphics-compiler and level-zero publish none, so those
-    # five are hash-what-you-get. Refresh after a version bump with
-    # `curl -sL <url> | sha256sum`, cross-checking upstream's sum where the
-    # release still has one. npu-driver stopped publishing them after v1.19.0.
-    declare -A intel_checksums=(
-        ["libigdgmm12_22.9.0_amd64.deb"]="9d712f71c18baee076de9961dda71e8089291e1bd0deb5d649ab5ba5de114f97"
-        ["intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb"]="bbe71e4f414259e06a10cde72c29a2bd78d41b2bb2f6f8463b1806797fe66e85"
-        ["intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb"]="40dfbd15ab62de036a00824b304a2aa1fa2d81ad60ef83da09cfe3c5a80c429f"
-        ["intel-igc-opencl_1.0.17537.24_amd64.deb"]="dd016400f87fa2b6a9fa9fbcca7eb4a2629174a29de679709f9bec5cede88b0e"
-        ["intel-igc-core_1.0.17537.24_amd64.deb"]="c1e1ecdfe2064c047c552651cfdcdafc504f2033afafba65654338b880048b67"
-        ["intel-opencl-icd_26.14.37833.4-0_amd64.deb"]="2e15eeb4fe9c1bba467a655967373eec6a20dd04cc7159de53c359f17ab53e41"
-        ["libze-intel-gpu1_26.14.37833.4-0_amd64.deb"]="34ce5791160d87ce6d54edb558a4030858ee1dad2afb067b9c5c58d4cde774c6"
-        ["intel-igc-opencl-2_2.32.7+21184_amd64.deb"]="3c9bddbfe558279402bbeaabcf9c63b8de46b956b0ad9625415fd35dda53ad52"
-        ["intel-igc-core-2_2.32.7+21184_amd64.deb"]="64e5230788e3a31e611e8d815a141b1facb91e5f0ef239233ef3f0614bfe3fd6"
-        ["level-zero_1.28.2+u22.04_amd64.deb"]="9015a579abef960166f8e943858d5c81fd4199a960f07260c1da66038257effb"
-        ["intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="8087bfcc0872d7976d0163203c7c783a4176f813c473766587e86c7b34135dff"
-        ["intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="740219c03495f8812c03ab74baf8199acf17d13929001105418d4ba226ba2290"
-        ["intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="f4f5eb97aa7da52c7fec97e4ddfb43aae01703bbadc767bae1f2d4faf342ba42"
-    )
-
-    fetch_intel_deb() {
-        local url="$1" name
-        name=$(basename "$url")
-        wget -q "$url"
-        echo "${intel_checksums[${name}]}  ${name}" | sha256sum -c -
-    }
 
+    # install legacy and standard intel icd and level-zero-gpu
     # see https://github.com/intel/compute-runtime/blob/master/LEGACY_PLATFORMS.md for more info
     # needed core package
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libigdgmm12_22.9.0_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/25.13.33276.19/libigdgmm12_22.7.0_amd64.deb
-    dpkg -i libigdgmm12_22.9.0_amd64.deb
+    dpkg -i libigdgmm12_22.7.0_amd64.deb
-    rm libigdgmm12_22.9.0_amd64.deb
+    rm libigdgmm12_22.7.0_amd64.deb
 
-    # legacy compute-runtime packages
+    # legacy packages
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
-    # standard compute-runtime packages
+    # standard packages
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/intel-opencl-icd_26.14.37833.4-0_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/25.13.33276.19/intel-opencl-icd_25.13.33276.19_amd64.deb
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libze-intel-gpu1_26.14.37833.4-0_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/25.13.33276.19/intel-level-zero-gpu_1.6.33276.19_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-opencl-2_2.32.7+21184_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.10.10/intel-igc-opencl-2_2.10.10+18926_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-core-2_2.32.7+21184_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.10.10/intel-igc-core-2_2.10.10+18926_amd64.deb
     # npu packages
-    fetch_intel_deb https://github.com/oneapi-src/level-zero/releases/download/v1.28.2/level-zero_1.28.2+u22.04_amd64.deb
+    wget https://github.com/oneapi-src/level-zero/releases/download/v1.28.2/level-zero_1.28.2+u22.04_amd64.deb
-    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
-    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
-    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
 
     dpkg -i *.deb
     rm *.deb
     apt-get -qq install -f -y
-
-    # Battlemage uses the xe kernel driver, but the VA-API driver is still iHD.
-    # The oneVPL runtime may look for a driver named after the kernel module.
-    ln -sf /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so /usr/lib/x86_64-linux-gnu/dri/xe_drv_video.so
 fi
 
 if [[ "${TARGETARCH}" == "arm64" ]]; then

docker/main/install_go2rtc.sh

@@ -1,19 +0,0 @@
-#!/bin/bash
-
-set -euxo pipefail
-
-go2rtc_version="1.9.14"
-
-# sha256 digests of the release binaries; update when bumping go2rtc_version.
-declare -A go2rtc_checksums=(
-    ["amd64"]="32d616af226bd731678ffde328b94cfb94e30339bfefc469cfb76323144615a6"
-    ["arm64"]="359fabade8a7a51e81a55fe6df6b0ef81764a5e1d63179577534eaaa71904b50"
-)
-
-dest_dir="/rootfs/usr/local/go2rtc/bin"
-mkdir -p "${dest_dir}"
-
-wget -qO "${dest_dir}/go2rtc" \
-    "https://github.com/AlexxIT/go2rtc/releases/download/v${go2rtc_version}/go2rtc_linux_${TARGETARCH}"
-echo "${go2rtc_checksums[${TARGETARCH}]}  ${dest_dir}/go2rtc" | sha256sum -c -
-chmod 755 "${dest_dir}/go2rtc"

docker/main/install_hailort.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+hailo_version="4.21.0"
+
+if [[ "${TARGETARCH}" == "amd64" ]]; then
+    arch="x86_64"
+elif [[ "${TARGETARCH}" == "arm64" ]]; then
+    arch="aarch64"
+fi
+
+wget -qO- "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-debian12-${TARGETARCH}.tar.gz" | tar -C / -xzf -
+wget -P /wheels/ "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"

docker/main/install_memryx.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+set -e
+
+# Download the MxAccl for Frigate github release
+wget https://github.com/memryx/mx_accl_frigate/archive/refs/tags/v2.1.0.zip -O /tmp/mxaccl.zip
+unzip /tmp/mxaccl.zip -d /tmp
+mv /tmp/mx_accl_frigate-2.1.0 /opt/mx_accl_frigate
+rm /tmp/mxaccl.zip
+
+# Install Python dependencies
+pip3 install -r /opt/mx_accl_frigate/freeze
+
+# Link the Python package dynamically
+SITE_PACKAGES=$(python3 -c "import site; print(site.getsitepackages()[0])")
+ln -s /opt/mx_accl_frigate/memryx "$SITE_PACKAGES/memryx"
+
+# Copy architecture-specific shared libraries
+ARCH=$(uname -m)
+if [[ "$ARCH" == "x86_64" ]]; then
+    cp /opt/mx_accl_frigate/memryx/x86/libmemx.so* /usr/lib/x86_64-linux-gnu/
+    cp /opt/mx_accl_frigate/memryx/x86/libmx_accl.so* /usr/lib/x86_64-linux-gnu/
+elif [[ "$ARCH" == "aarch64" ]]; then
+    cp /opt/mx_accl_frigate/memryx/arm/libmemx.so* /usr/lib/aarch64-linux-gnu/
+    cp /opt/mx_accl_frigate/memryx/arm/libmx_accl.so* /usr/lib/aarch64-linux-gnu/
+else
+    echo "Unsupported architecture: $ARCH"
+    exit 1
+fi
+
+# Refresh linker cache
+ldconfig

docker/main/install_s6_overlay.sh

@@ -4,15 +4,6 @@ set -euxo pipefail
 
 s6_version="3.2.1.0"
 
-# sha256 digests of the release artifacts, from the .sha256 files published at
-# https://github.com/just-containers/s6-overlay/releases/tag/v3.2.1.0
-# Update these when bumping s6_version.
-declare -A s6_checksums=(
-    ["noarch"]="42e038a9a00fc0fef70bf0bc42f625a9c14f8ecdfe77d4ad93281edf717e10c5"
-    ["x86_64"]="8bcbc2cada58426f976b159dcc4e06cbb1454d5f39252b3bb0c778ccf71c9435"
-    ["aarch64"]="c8fd6b1f0380d399422fc986a1e6799f6a287e2cfa24813ad0b6a4fb4fa755cc"
-)
-
 if [[ "${TARGETARCH}" == "amd64" ]]; then
     s6_arch="x86_64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -21,15 +12,8 @@ fi
 
 mkdir -p /rootfs/
 
-download_and_extract() {
+wget -qO- "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-noarch.tar.xz" |
-    local arch="$1"
+    tar -C /rootfs/ -Jxpf -
-    local tarball="/tmp/s6-overlay-${arch}.tar.xz"
-    wget -qO "${tarball}" \
-        "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-${arch}.tar.xz"
-    echo "${s6_checksums[${arch}]}  ${tarball}" | sha256sum -c -
-    tar -C /rootfs/ -Jxpf "${tarball}"
-    rm -f "${tarball}"
-}
 
-download_and_extract "noarch"
+wget -qO- "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-${s6_arch}.tar.xz" |
-download_and_extract "${s6_arch}"
+    tar -C /rootfs/ -Jxpf -

docker/main/install_tempio.sh

@@ -4,14 +4,6 @@ set -euxo pipefail
 
 tempio_version="2021.09.0"
 
-# sha256 digests of the release binaries; update when bumping tempio_version.
-# Upstream publishes no checksums, so these come from a one-time fetch and
-# guard against later substitution rather than the original download.
-declare -A tempio_checksums=(
-    ["amd64"]="b7b93ebfd24c1161cec7aecfad62ab51f2241149358cef354b86cdbc6a60546f"
-    ["aarch64"]="3a5c32981ba68b75ed9b28497429e5a5cecbeb74c3b821b035a48b37609bb895"
-)
-
 if [[ "${TARGETARCH}" == "amd64" ]]; then
     arch="amd64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -21,5 +13,4 @@ fi
 mkdir -p /rootfs/usr/local/tempio/bin
 
 wget -q -O /rootfs/usr/local/tempio/bin/tempio "https://github.com/home-assistant/tempio/releases/download/${tempio_version}/tempio_${arch}"
-echo "${tempio_checksums[${arch}]}  /rootfs/usr/local/tempio/bin/tempio" | sha256sum -c -
 chmod 755 /rootfs/usr/local/tempio/bin/tempio

docker/main/requirements-dev.txt

@@ -1,4 +1,4 @@
-ruff == 0.15.20
+ruff
 
 # types
-types-peewee == 4.0.*
+types-peewee == 3.17.*

docker/main/requirements-ov.txt

@@ -1,2 +1,3 @@
 numpy
-openvino >= 2026.2.0
+tensorflow
+openvino-dev>=2024.0.0

docker/main/requirements-wheels.txt

@@ -1,17 +1,17 @@
-aiofiles == 25.1.*
+aiofiles == 24.1.*
-click == 8.5.*
+click == 8.1.*
 # FastAPI
 aiohttp == 3.12.*
 starlette == 0.47.*
-starlette-context == 0.5.*
+starlette-context == 0.4.*
 fastapi[standard-no-fastapi-cloud-cli] == 0.116.*
-uvicorn == 0.52.*
+uvicorn == 0.35.*
 slowapi == 0.1.*
-joserfc == 1.6.*
+joserfc == 1.2.*
-cryptography == 46.0.*
+cryptography == 44.0.*
 pathvalidate == 3.3.*
 markupsafe == 3.0.*
-python-multipart == 0.0.31
+python-multipart == 0.0.20
 # Classification Model Training
 tensorflow == 2.19.* ; platform_machine == 'aarch64'
 tensorflow-cpu == 2.19.* ; platform_machine == 'x86_64'
@@ -26,15 +26,15 @@ psutil == 7.1.*
 pydantic == 2.10.*
 git+https://github.com/fbcotter/py3nvml#egg=py3nvml
 pytz == 2025.*
-pyzmq == 27.1.*
+pyzmq == 26.2.*
 ruamel.yaml == 0.18.*
 tzlocal == 5.2
-requests == 2.33.*
+requests == 2.32.*
 types-requests == 2.32.*
 norfair == 2.3.*
 setproctitle == 1.3.*
 ws4py == 0.5.*
-unidecode == 1.4.*
+unidecode == 1.3.*
 titlecase == 2.4.*
 # Image Manipulation
 numpy == 1.26.*
@@ -42,7 +42,7 @@ opencv-python-headless == 4.11.0.*
 opencv-contrib-python == 4.11.0.*
 scipy == 1.16.*
 # OpenVino & ONNX
-openvino == 2025.4.*
+openvino == 2025.3.*
 onnxruntime == 1.22.*
 # Embeddings
 transformers == 4.45.*
@@ -51,26 +51,35 @@ google-genai == 1.58.*
 ollama == 0.6.*
 openai == 1.65.*
 # push notifications
-py-vapid == 1.9.4
+py-vapid == 1.9.*
 pywebpush == 2.0.*
 # alpr
-pyclipper == 1.4.*
+pyclipper == 1.3.*
 shapely == 2.0.*
 rapidfuzz==3.12.*
-# HailoRT
+# HailoRT Wheels
+appdirs==1.4.*
 argcomplete==2.0.*
 contextlib2==0.6.*
+distlib==0.3.*
+filelock==3.8.*
 future==0.18.*
-netaddr==1.3.*
+importlib-metadata==5.1.*
+importlib-resources==5.1.*
+netaddr==0.8.*
 netifaces==0.10.*
-prometheus-client == 0.26.*
+verboselogs==1.7.*
+virtualenv==20.17.*
+prometheus-client == 0.21.*
 # TFLite
 tflite_runtime @ https://github.com/frigate-nvr/TFlite-builds/releases/download/v2.17.1/tflite_runtime-2.17.1-cp311-cp311-linux_x86_64.whl; platform_machine == 'x86_64'
 tflite_runtime @ https://github.com/feranick/TFlite-builds/releases/download/v2.17.1/tflite_runtime-2.17.1-cp311-cp311-linux_aarch64.whl; platform_machine == 'aarch64'
 # audio transcription
-sherpa-onnx==1.13.*
+sherpa-onnx==1.12.*
-faster-whisper==1.2.*
+faster-whisper==1.1.*
 librosa==0.11.*
 soundfile==0.13.*
+# DeGirum detector
+degirum == 0.16.*
 # Memory profiling
-memray == 1.20.*
+memray == 1.15.*

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/run

@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-if [[ "$(id -u)" -eq 0 ]]; then
+exec logutil-service /dev/shm/logs/certsync
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/certsync
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/certsync

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/run

@@ -6,35 +6,9 @@ set -o errexit -o nounset -o pipefail
 
 # Logs should be sent to stdout so that s6 can collect them
 
-# Not `nginx -s reload`: that has root parse /tmp/nginx/conf, which the
-# unprivileged nginx user can rewrite, and nginx chowns path directives on load.
-function reload_nginx() {
-    local pid
-
-    if ! pid=$(cat /tmp/nginx/nginx.pid 2>/dev/null); then
-        echo "[ERROR] No nginx pid file found, not reloading"
-        return 0
-    fi
-
-    if [[ ! "$pid" =~ ^[0-9]+$ ]] || [[ "$(cat "/proc/${pid}/comm" 2>/dev/null)" != "nginx" ]]; then
-        echo "[ERROR] nginx pid file does not name a running nginx process, not reloading"
-        return 0
-    fi
-
-    kill -HUP "$pid"
-}
-
 echo "[INFO] Starting certsync..."
 
-# Resolved once, and the condition must stay identical to the nginx run
+lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
-# script's. Testing only fullchain.pem here would pick the mounted cert on a
-# half-populated mount that nginx rejected, and the two fingerprints would then
-# never agree, reloading nginx every cycle forever.
-if [ -f /etc/letsencrypt/live/frigate/privkey.pem ] && [ -f /etc/letsencrypt/live/frigate/fullchain.pem ]; then
-    lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
-else
-    lefile="/config/tls/fullchain.pem"
-fi
 
 tls_enabled=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .tls.enabled`
 listen_external_port=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .listen.external_port`
@@ -75,7 +49,7 @@ do
     then
         echo "[INFO] Reloading nginx to refresh TLS certificate"
         echo "$lefile: $leprint"
-        reload_nginx
+        /usr/local/nginx/sbin/nginx -s reload
     fi
 
     sleep 60

docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate-log/run

@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-if [[ "$(id -u)" -eq 0 ]]; then
+exec logutil-service /dev/shm/logs/frigate
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/frigate
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/frigate

docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run

@@ -4,24 +4,6 @@
 
 set -o errexit -o nounset -o pipefail
 
-runs_as_root=0
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root frigate; then
-        runs_as_root=1
-    fi
-fi
-
-# /root survives s6-setuidgid and breaks cache writes after the drop; set
-# before opt_in_out so the opt-out marker lands where the service will look
-if [[ "$runs_as_root" -eq 0 ]]; then
-    export HOME=/config
-fi
-
-# detector runtimes installed at first start (pip install --user) live under
-# $HOME/.local; the dynamic loader only reads LD_LIBRARY_PATH at exec time
-export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+${LD_LIBRARY_PATH}:}${HOME}/.local/lib"
-export PATH="${PATH}:${HOME}/.local/bin"
-
 # opt out of openvino telemetry
 if [ -e /usr/local/bin/opt_in_out ]; then
   /usr/local/bin/opt_in_out --opt_out > /dev/null 2>&1
@@ -48,8 +30,4 @@ cd /opt/frigate || echo "[ERROR] Failed to change working directory to /opt/frig
 
 # Replace the bash process with the Frigate process, redirecting stderr to stdout
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
+exec python3 -u -m frigate
-    exec python3 -u -m frigate
-else
-    exec s6-setuidgid frigate python3 -u -m frigate
-fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc-log/run

@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-if [[ "$(id -u)" -eq 0 ]]; then
+exec logutil-service /dev/shm/logs/go2rtc
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/go2rtc
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/go2rtc

docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run

@@ -4,20 +4,6 @@
 
 set -o errexit -o nounset -o pipefail
 
-runs_as_root=0
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root go2rtc; then
-        runs_as_root=1
-    fi
-fi
-
-# Root via FRIGATE_ROOT_SERVICES only; the escape hatch sweeps nothing and
-# leaves no unprivileged service, so /config/go2rtc stays as safe as pre-drop.
-granular_root=0
-if [[ "$runs_as_root" -eq 1 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-    granular_root=1
-fi
-
 # Logs should be sent to stdout so that s6 can collect them
 
 function get_ip_and_port_from_supervisor() {
@@ -64,6 +50,42 @@ function set_libva_version() {
     export LIBAVFORMAT_VERSION_MAJOR
 }
 
+function setup_homekit_config() {
+    local config_path="$1"
+
+    if [[ ! -f "${config_path}" ]]; then
+        echo "[INFO] Creating empty config file for HomeKit..."
+        : > "${config_path}"
+    fi
+
+    # Convert YAML to JSON for jq processing
+    local temp_json="/tmp/cache/homekit_config.json"
+    yq eval -o=json "${config_path}" > "${temp_json}" 2>/dev/null || {
+        echo "[WARNING] Failed to convert HomeKit config to JSON, skipping cleanup"
+        return 0
+    }
+
+    # Use jq to extract the homekit section, if it exists
+    local homekit_json
+    homekit_json=$(jq '
+        if has("homekit") then {homekit: .homekit} else null end
+    ' "${temp_json}" 2>/dev/null) || homekit_json="null"
+
+    # If no homekit section, write an empty config file
+    if [[ "${homekit_json}" == "null" ]]; then
+        : > "${config_path}"
+    else
+        # Convert homekit JSON back to YAML and write to the config file
+        echo "${homekit_json}" | yq eval -P - > "${config_path}" 2>/dev/null || {
+            echo "[WARNING] Failed to convert cleaned config to YAML, creating minimal config"
+            : > "${config_path}"
+        }
+    fi
+
+    # Clean up temp files
+    rm -f "${temp_json}"
+}
+
 set_libva_version
 
 if [[ -f "/dev/shm/go2rtc.yaml" ]]; then
@@ -84,23 +106,13 @@ else
     echo "[WARNING] Unable to remove existing go2rtc config. Changes made to your frigate config file may not be recognized. Please remove the /dev/shm/go2rtc.yaml from your docker host manually."
 fi
 
-# HomeKit persistence. The helper is symlink-safe; hand off to go2rtc only when dropping.
+# HomeKit configuration persistence setup
 readonly homekit_config_path="/config/go2rtc_homekit.yml"
-if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
+setup_homekit_config "${homekit_config_path}"
-    python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}" --chown
-    chown go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
-else
-    python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}"
-fi
 
 readonly config_path="/config"
 
-# the sweep hands /config to uid 1000, so a root service must not exec from it
+if [[ -x "${config_path}/go2rtc" ]]; then
-if [[ "$granular_root" -eq 1 && -x "${config_path}/go2rtc" ]]; then
-  echo "[WARN] Ignoring '${config_path}/go2rtc' because FRIGATE_ROOT_SERVICES runs this service as root and /config is owned by the runtime user; using the embedded binary"
-  echo "[WARN] Use FRIGATE_RUN_AS_ROOT=true instead if you need both a custom go2rtc build and root"
-  readonly binary_path="/usr/local/go2rtc/bin/go2rtc"
-elif [[ -x "${config_path}/go2rtc" ]]; then
   readonly binary_path="${config_path}/go2rtc"
   echo "[WARN] Using go2rtc binary from '${binary_path}' instead of the embedded one"
 else
@@ -113,8 +125,4 @@ echo "[INFO] Starting go2rtc..."
 # Use HomeKit config as the primary config so writebacks go there
 # The main config from Frigate will be loaded as a secondary config
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
+exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
-    exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
-else
-    exec s6-setuidgid go2rtc "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
-fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run

@@ -1,105 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-# Grant the runtime users access to mapped-in device nodes with POSIX ACLs,
-# so --device works without host-side group or udev setup.
-# No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
-# or FRIGATE_DEVICE_ACLS=false.
-
-set -o errexit -o nounset -o pipefail
-
-if [[ "$(id -u)" -ne 0 ]]; then
-    exit 0
-fi
-
-if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
-    exit 0
-fi
-
-if [[ "${FRIGATE_DEVICE_ACLS:-true}" == "false" ]]; then
-    echo "[INFO] FRIGATE_DEVICE_ACLS=false: skipping device access grants"
-    exit 0
-fi
-
-shopt -s nullglob
-
-device_globs=(
-    "/dev/dri/*"
-    "/dev/accel/*"
-    "/dev/apex_*"
-    "/dev/hailo*"
-    "/dev/video*"
-    "/dev/kfd"
-    "/dev/rknpu*"
-    "/dev/mpp_service"
-    "/dev/rga"
-    "/dev/dma_heap/*"
-    "/dev/nvhost*"
-    "/dev/nvmap"
-    "/dev/nvidia*"
-    "/dev/memx*"
-    "/dev/dxrt*"
-)
-
-IFS=',' read -ra extra_globs <<< "${DEVICE_ACL_PATHS:-}"
-for extra in "${extra_globs[@]}"; do
-    extra="${extra//[[:space:]]/}"
-    if [[ -z "$extra" ]]; then
-        continue
-    fi
-    if [[ "$extra" != /dev/* || "$extra" == *..* ]]; then
-        echo "[ERROR] DEVICE_ACL_PATHS entries must be under /dev, got '${extra}'" >&2
-        exit 1
-    fi
-    device_globs+=("$extra")
-done
-
-granted=0
-failed=0
-
-grant() {
-    local node="$1"
-    # nullglob only drops patterns that hold a metacharacter, so a literal
-    # table entry for absent hardware arrives here verbatim. Warn only about
-    # nodes that exist and could not be granted.
-    if [[ ! -e "$node" ]]; then
-        return 0
-    fi
-    local spec="u:frigate:rw,u:go2rtc:rw"
-    # directories need traverse or nothing under them is reachable
-    if [[ -d "$node" ]]; then
-        spec="u:frigate:rwx,u:go2rtc:rwx"
-    fi
-    if setfacl -m "$spec" "$node" 2>/dev/null; then
-        granted=$((granted + 1))
-    else
-        failed=$((failed + 1))
-        echo "[WARN] could not grant device access on ${node}; see EXTRA_GROUPS in the non-root docs for the fallback"
-    fi
-}
-
-for glob in "${device_globs[@]}"; do
-    # shellcheck disable=SC2231
-    for node in $glob; do
-        grant "$node"
-    done
-done
-
-# USB devices re-enumerate (the Coral uploads firmware and reattaches as a new
-# node), so the directories also get a default ACL new nodes inherit. The
-# inherited grant is clamped by the creating mode's group bits, which is rw on
-# udev hosts (0664) and nothing on raw devtmpfs (0600); hardware-verified.
-if [[ -d /dev/bus/usb ]]; then
-    while IFS= read -r -d '' node; do
-        grant "$node"
-    done < <(find /dev/bus/usb -mindepth 1 -print0)
-    while IFS= read -r -d '' dir; do
-        setfacl -d -m "u:frigate:rw,u:go2rtc:rw" "$dir" 2>/dev/null || \
-            echo "[WARN] could not set a default ACL on ${dir}; a re-enumerating USB device may lose access"
-    done < <(find /dev/bus/usb -type d -print0)
-fi
-
-if [[ "$failed" -gt 0 ]]; then
-    echo "[INFO] device access: granted ${granted} node(s), ${failed} failed"
-elif [[ "$granted" -gt 0 ]]; then
-    echo "[INFO] device access: granted ${granted} node(s) to the runtime users"
-fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/type

@@ -1 +0,0 @@
-oneshot

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-devices/run

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run

@@ -1,104 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-# Remap the frigate user to PUID/PGID and register EXTRA_GROUPS.
-# No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
-# or PUID/PGID already match. FRIGATE_ROOT_SERVICES is validated here too.
-
-set -o errexit -o nounset -o pipefail
-
-if [[ "$(id -u)" -ne 0 ]]; then
-    # Started with docker --user; the host owns UID mapping entirely.
-    exit 0
-fi
-
-if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
-    if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
-        echo "[INFO] FRIGATE_RUN_AS_ROOT=true: ignoring FRIGATE_ROOT_SERVICES"
-    fi
-    echo "[INFO] FRIGATE_RUN_AS_ROOT=true: skipping user remapping"
-    exit 0
-fi
-
-# a typo must fail the boot, not silently drop a service to non-root
-if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
-    IFS=',' read -ra root_services <<< "${FRIGATE_ROOT_SERVICES}"
-    for entry in "${root_services[@]}"; do
-        entry="${entry//[[:space:]]/}"
-        if [[ -z "$entry" ]]; then
-            continue
-        fi
-        case "$entry" in
-            frigate|go2rtc|nginx) ;;
-            *)
-                echo "[ERROR] FRIGATE_ROOT_SERVICES contains unknown service '${entry}'; valid names are frigate, go2rtc, nginx" >&2
-                exit 1
-                ;;
-        esac
-    done
-fi
-
-puid="${PUID:-1000}"
-pgid="${PGID:-1000}"
-
-if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
-    echo "[ERROR] PUID and PGID must be numeric, got '${puid}' and '${pgid}'" >&2
-    exit 1
-fi
-
-# Remapping to 0 would make the frigate user root, so every service would keep
-# full privilege while reporting a successful migration.
-if [[ "$puid" -eq 0 || "$pgid" -eq 0 ]]; then
-    echo "[ERROR] PUID/PGID 0 would run the services as root and defeat the privilege separation." >&2
-    echo "[ERROR] Set FRIGATE_RUN_AS_ROOT=true if you want to keep running as root." >&2
-    exit 1
-fi
-
-# Colliding with the go2rtc ids would merge the two users and collapse the
-# separation between the main process and the network-facing restreamer.
-go2rtc_uid="$(id -u go2rtc)"
-go2rtc_gid="$(id -g go2rtc)"
-if [[ "$puid" -eq "$go2rtc_uid" || "$pgid" -eq "$go2rtc_gid" ]]; then
-    echo "[ERROR] PUID/PGID must not equal the go2rtc service ids (${go2rtc_uid}:${go2rtc_gid})." >&2
-    exit 1
-fi
-
-current_uid="$(id -u frigate)"
-current_gid="$(id -g frigate)"
-
-if [[ "$puid" != "$current_uid" || "$pgid" != "$current_gid" ]]; then
-    if [[ ! -w /etc/passwd ]]; then
-        echo "[ERROR] PUID/PGID remapping needs a writable /etc and is not compatible with read_only: true." >&2
-        echo "[ERROR] Either remove read_only and keep PUID, or drop PUID/PGID and use docker's user: ${puid}:${pgid} instead." >&2
-        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
-        exit 1
-    fi
-    echo "[INFO] Remapping frigate user to ${puid}:${pgid}"
-    groupmod -o -g "$pgid" frigate
-    usermod -o -u "$puid" frigate
-fi
-
-# EXTRA_GROUPS: numeric host GIDs granting device access (e.g. host render/video)
-if [[ -n "${EXTRA_GROUPS:-}" ]]; then
-    # groupadd and usermod -aG both write /etc/group. Checked up front so a
-    # read-only rootfs reports the real problem instead of dying mid-loop.
-    if [[ ! -w /etc/group ]]; then
-        echo "[ERROR] EXTRA_GROUPS needs a writable /etc and is not compatible with read_only: true." >&2
-        echo "[ERROR] Use docker's group_add: with the same GIDs instead; it needs no writes inside the container." >&2
-        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
-        exit 1
-    fi
-
-    for gid in ${EXTRA_GROUPS//,/ }; do
-        if ! [[ "$gid" =~ ^[0-9]+$ ]] || [[ "$gid" -eq 0 ]]; then
-            echo "[ERROR] EXTRA_GROUPS must be nonzero numeric GIDs, got '${gid}'" >&2
-            exit 1
-        fi
-        if ! getent group "$gid" >/dev/null; then
-            groupadd -o -g "$gid" "frigate-extra-${gid}"
-        fi
-        group_name="$(getent group "$gid" | cut -d: -f1)"
-        usermod -aG "$group_name" frigate
-        usermod -aG "$group_name" go2rtc
-        echo "[INFO] Added frigate and go2rtc to supplementary group ${group_name} (gid ${gid})"
-    done
-fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/type

@@ -1 +0,0 @@
-oneshot

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-usermod/run

docker/main/rootfs/etc/s6-overlay/s6-rc.d/log-prepare/run

@@ -7,12 +7,5 @@ set -o errexit -o nounset -o pipefail
 dirs=(/dev/shm/logs/frigate /dev/shm/logs/go2rtc /dev/shm/logs/nginx /dev/shm/logs/certsync)
 
 mkdir -p "${dirs[@]}"
-
+chown nobody:nogroup "${dirs[@]}"
-# logutil-service drops s6-log to nobody, so the dirs must stay nobody-owned
-# in root mode. Under docker --user we are already the (only) target user,
-# chown would fail, and the plain s6-log fallback in the *-log services
-# writes as us (the mkdir above is sufficient, /dev/shm is 1777).
-if [[ "$(id -u)" -eq 0 ]]; then
-    chown nobody:nogroup "${dirs[@]}"
-fi
 chmod 02755 "${dirs[@]}"

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx-log/run

@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-if [[ "$(id -u)" -eq 0 ]]; then
+exec logutil-service /dev/shm/logs/nginx
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/nginx
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/nginx

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/data/check

@@ -2,4 +2,4 @@
 set -e
 
 # Wait for PID file to exist.
-while ! test -f /tmp/nginx/nginx.pid; do sleep 1; done
+while ! test -f /run/nginx.pid; do sleep 1; done

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -4,13 +4,6 @@
 
 set -o errexit -o nounset -o pipefail
 
-runs_as_root=0
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
-        runs_as_root=1
-    fi
-fi
-
 # Logs should be sent to stdout so that s6 can collect them
 
 echo "[INFO] Starting NGINX..."
@@ -66,105 +59,38 @@ function set_worker_processes() {
         cpus=4
     fi
 
-    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
+    # we need to catch any errors because sed will fail if user has bind mounted a custom nginx file
+    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /usr/local/nginx/conf/nginx.conf || true
 }
 
-# Rebuilt root-owned every start: a symlink planted by the previously
-# unprivileged nginx would redirect the root cp/tempio writes below onto any
-# root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
-rm -rf /tmp/nginx
-mkdir /tmp/nginx
-mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
-         /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
-cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
-
 set_worker_processes
 
-# TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
+# ensure the directory for ACME challenges exists
-# contract) always win; otherwise fall back to a self-signed cert persisted in
+mkdir -p /etc/letsencrypt/www
-# /config/tls, which stays writable under a read-only root filesystem.
+
+# Create self signed certs if needed
 letsencrypt_path=/etc/letsencrypt/live/frigate
-selfsigned_path=/config/tls
+mkdir -p $letsencrypt_path
 
-if [ -f "$letsencrypt_path/privkey.pem" ] && [ -f "$letsencrypt_path/fullchain.pem" ]; then
+if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
-    cert_path="$letsencrypt_path"
+    echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
-else
+    openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
-    cert_path="$selfsigned_path"
+        -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
-
+        -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
-    # Root writing into /config follows any symlink planted there, and /config
-    # is owned by whoever the host mount says, not by root. Generate as the
-    # runtime user wherever we are going to drop to it; the escape hatch keeps
-    # root all the way through, so that path is refused rather than dropped.
-    gen=()
-    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-        gen=(s6-setuidgid frigate)
-    elif [[ "$(id -u)" -eq 0 ]]; then
-        for link in "$cert_path" "$cert_path/privkey.pem" "$cert_path/fullchain.pem"; do
-            if [[ -L "$link" ]]; then
-                echo "[ERROR] ${link} is a symlink; refusing to write TLS material through it as root" >&2
-                exit 1
-            fi
-        done
-    fi
-
-    "${gen[@]}" mkdir -p "$cert_path"
-
-    if [ ! \( -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" \) ]; then
-        echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
-        "${gen[@]}" openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
-            -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
-            -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" 2>/dev/null
-        "${gen[@]}" chmod 600 "$cert_path/privkey.pem"
-        "${gen[@]}" chmod 644 "$cert_path/fullchain.pem"
-    fi
 fi
 
-# ACME challenges are only served from a writable rootfs; skipping the mkdir
-# under read_only leaves the location 404ing, which is the same as unused
-mkdir -p /etc/letsencrypt/www 2>/dev/null || true
-
-# nginx settings are read once; both templates consume them
-nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)
-
 # build templates for optional FRIGATE_BASE_PATH environment variable
-echo "$nginx_settings" | \
+python3 /usr/local/nginx/get_nginx_settings.py | \
     tempio -template /usr/local/nginx/templates/base_path.gotmpl \
-           -out /tmp/nginx/conf/base_path.conf
+           -out /usr/local/nginx/conf/base_path.conf
 
-# build templates for additional network settings; listen.conf is the only
+# build templates for additional network settings
-# template that needs the resolved cert directory
+python3 /usr/local/nginx/get_nginx_settings.py | \
-echo "$nginx_settings" | \
-    jq --arg p "$cert_path" '.tls.cert_path = $p' | \
     tempio -template /usr/local/nginx/templates/listen.gotmpl \
-           -out /tmp/nginx/conf/listen.conf
+           -out /usr/local/nginx/conf/listen.conf
-
-if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
-    chown -R frigate:frigate /tmp/nginx
-    # heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
-    if [ -d /dev/shm/nginx_cache ]; then
-        chown -R frigate:frigate /dev/shm/nginx_cache
-    fi
-    # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
-    # root-owned 0600; without this the non-root master exits EACCES
-    chown frigate /dev/stdout
-    # Only mounted certs need handing over; the self-signed pair is already
-    # owned by the runtime user that generated it. Never chown the /config copy:
-    # chown follows symlinks, so it would retarget onto any root file the
-    # runtime user pointed it at. Tolerant because mounted certs may be :ro.
-    if [ "$cert_path" = "$letsencrypt_path" ] && [ -f "$cert_path/privkey.pem" ]; then
-        chown frigate:frigate "$cert_path/privkey.pem" "$cert_path/fullchain.pem" 2>/dev/null || true
-    fi
-fi
 
 # Replace the bash process with the NGINX process, redirecting stderr to stdout
 exec 2>&1
-# -e stderr: the compiled-in error log path is not writable by the runtime user
+exec \
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
+    s6-notifyoncheck -t 30000 -n 1 \
-    exec \
+    nginx
-        s6-notifyoncheck -t 30000 -n 1 \
-        nginx -e stderr -c /tmp/nginx/conf/nginx.conf
-else
-    exec \
-        s6-notifyoncheck -t 30000 -n 1 \
-        s6-setuidgid frigate nginx -e stderr -c /tmp/nginx/conf/nginx.conf
-fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run

@@ -144,66 +144,3 @@ rm -f /dev/shm/.frigate-is-stopping
 
 migrate_addon_config_dir
 migrate_db_from_media_to_config
-
-# Align volume ownership with the runtime user (one sweep per PUID/schema
-# change, guarded by the sentinel; see fix-ownership). The escape hatch
-# deletes the sentinel instead: ownership is never mutated while it is on,
-# so the next non-root boot must re-sweep whatever root created meanwhile.
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
-        rm -f /config/.permissions_version
-    else
-        # Only when a mount backs /media/frigate itself: under a parent /media
-        # mount, a dedicated volume added later would be shadowed and skipped
-        sentinel_args=(--sentinel /config/.permissions_version)
-        root_services_mode=""
-        if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
-            # || true: an all-empty list (",") fails grep -v and errexit would kill the boot
-            root_services_mode=$(tr ',' '\n' <<< "${FRIGATE_ROOT_SERVICES//[[:space:]]/}" | grep -v '^$' | sort -u | paste -sd, - || true)
-            if [[ -n "$root_services_mode" ]]; then
-                sentinel_args+=(--mode "$root_services_mode")
-            fi
-        fi
-        if ! awk '$2 == "/media/frigate" || $2 ~ /^\/media\/frigate\//' /proc/mounts | grep -q .; then
-            sentinel_args=()
-        fi
-        /usr/local/bin/fix-ownership "${sentinel_args[@]}" \
-            "${PUID:-1000}" "${PGID:-1000}" /config /media/frigate
-
-        # Root services write clips stragglers and caches mid-run; realign the
-        # small trees every boot. Recordings are chowned at create instead.
-        if [[ -n "$root_services_mode" ]]; then
-            # only sweep what exists; clips and exports appear after the first run
-            boot_sweep_paths=(/config)
-            for extra in /media/frigate/clips /media/frigate/exports; do
-                if [[ -d "$extra" ]]; then
-                    boot_sweep_paths+=("$extra")
-                fi
-            done
-            /usr/local/bin/fix-ownership \
-                "${PUID:-1000}" "${PGID:-1000}" "${boot_sweep_paths[@]}"
-        fi
-    fi
-fi
-
-# Must stay after the sweep, which reads an absent /media/frigate as an
-# unmounted volume rather than a swept one
-if [[ "$(id -u)" -eq 0 && ! -d /media/frigate ]]; then
-    # The image does not ship this directory, so on a read-only rootfs it can
-    # only come from a mount. Report that rather than failing under errexit.
-    if ! mkdir -p /media/frigate 2>/dev/null; then
-        echo "[ERROR] /media/frigate does not exist and could not be created, which is what happens with read_only: true and no recordings volume." >&2
-        echo "[ERROR] Mount a volume at /media/frigate." >&2
-        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
-        exit 1
-    fi
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-        chown "${PUID:-1000}:${PGID:-1000}" /media/frigate
-    fi
-fi
-
-# usually a tmpfs mount: root-owned on arrival and outside the swept volumes
-if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-    mkdir -p /tmp/cache
-    chown "${PUID:-1000}:${PGID:-1000}" /tmp/cache
-fi

docker/main/rootfs/usr/local/bin/fix-ownership

@@ -1,194 +0,0 @@
-#!/bin/bash
-# Single source of truth for aligning volume ownership with the runtime user.
-#
-# Usage: fix-ownership [--dry-run] [--sentinel FILE] [--mode STRING] UID GID PATH [PATH...]
-#
-#   --dry-run    report what would change, touch nothing
-#   --sentinel   skip entirely when FILE already records "SCHEMA:UID:GID";
-#                write it after a successful run (used by the boot path so
-#                multi-TB volumes are swept once per UID/schema change, not
-#                on every boot)
-#   --mode       append STRING to the sentinel, so changing it re-sweeps once
-#
-# Only files whose uid OR gid differs are touched, so re-runs are cheap.
-# lost+found is skipped: fsck fills it with root-only recovered fragments.
-# Top-level /config additionally grants group frigate-data TRAVERSE ONLY
-# (g+rx) so the separate go2rtc user can reach its pre-created HomeKit file
-# on hosts where /config is mounted 0700. Never g+w: directory write means
-# unlink rights over frigate.db/config.yml, and would let a compromised
-# go2rtc plant /config/go2rtc, which the go2rtc run script executes
-# preferentially, as root under the escape hatch.
-
-set -o errexit -o nounset -o pipefail
-
-# Permissions-layout epoch. Bump to force a one-time re-sweep on upgrade
-# (e.g. when the privilege-drop release must capture files created as root
-# since the previous sweep).
-schema=2
-
-dry_run=0
-sentinel=""
-mode=""
-
-while [[ "${1:-}" == --* ]]; do
-    case "$1" in
-        --dry-run) dry_run=1; shift ;;
-        --sentinel)
-            if [[ -z "${2:-}" ]]; then
-                echo "[ERROR] fix-ownership: --sentinel requires a file argument" >&2
-                exit 2
-            fi
-            sentinel="$2"; shift 2 ;;
-        --mode)
-            if [[ -z "${2:-}" ]]; then
-                echo "[ERROR] fix-ownership: --mode requires a value" >&2
-                exit 2
-            fi
-            mode="$2"; shift 2 ;;
-        *) echo "[ERROR] fix-ownership: unknown option $1" >&2; exit 2 ;;
-    esac
-done
-
-if [[ $# -lt 3 ]]; then
-    echo "Usage: fix-ownership [--dry-run] [--sentinel FILE] [--mode STRING] UID GID PATH..." >&2
-    exit 2
-fi
-
-target_uid="$1"
-target_gid="$2"
-shift 2
-
-if [[ "$(id -u)" -ne 0 ]]; then
-    echo "[INFO] fix-ownership: not running as root, skipping (ownership is managed by the host in --user mode)"
-    exit 0
-fi
-
-# The list folds into the sentinel so entering or leaving a granular root mode
-# re-sweeps once, catching whatever the other ownership mechanisms missed.
-sentinel_content="${schema}:${target_uid}:${target_gid}"
-if [[ -n "$mode" ]]; then
-    sentinel_content="${sentinel_content}:${mode}"
-fi
-
-# safe-sentinel reports only a root-owned regular file, so a forged or
-# symlinked sentinel in the runtime-user-owned /config can't suppress the sweep
-if [[ "$dry_run" -eq 0 && -n "$sentinel" ]]; then
-    if existing=$(/usr/local/bin/safe-sentinel read "$sentinel" 2>/dev/null) && \
-        [[ "$existing" == "$sentinel_content" ]]; then
-        echo "[INFO] fix-ownership: ${target_uid}:${target_gid} (schema ${schema}) already applied, skipping"
-        exit 0
-    fi
-fi
-
-# A sweep that could not chown everything must not be recorded as complete:
-# the sentinel would make every later boot skip it and the entries would stay
-# unreachable once services run unprivileged.
-swept_clean=1
-
-# Entries another mechanism deliberately owns. Chowning them undoes that work
-# and leaves the same "mismatch" waiting for the next boot, so /config could
-# never report itself clean: /config is chgrp'd to frigate-data below so go2rtc
-# can traverse it, and the HomeKit file is handed to the go2rtc user by the
-# go2rtc service. Only the GROUP on /config is exempt; a root-owned /config
-# must still be chowned or the runtime user cannot write there at all.
-# Shared by the counting and the chowning walk so the two cannot disagree.
-mismatch_expr=(
-    "(" -not -uid "$target_uid"
-        -o "(" -not -gid "$target_gid" -a ! -path /config ")"
-    ")"
-    -a ! -path /config/go2rtc_homekit.yml
-)
-if [[ -n "$sentinel" ]]; then
-    # safe-sentinel keeps the sentinel root-owned on purpose and rejects one
-    # owned by anybody else, so chowning it here would suppress the skip and
-    # make every boot re-sweep. Only the trailing write puts it back today.
-    mismatch_expr+=(-a ! -path "$sentinel")
-fi
-
-for path in "$@"; do
-    # An absent root is an incomplete sweep, not a finished one: /media/frigate
-    # is not in the image, so a boot before the volume is mounted would
-    # otherwise record success and the volume would never be swept once added.
-    if [[ ! -d "$path" ]]; then
-        swept_clean=0
-        echo "[WARN] fix-ownership: $path does not exist, skipping; will retry on next boot"
-        continue
-    fi
-
-    echo "[INFO] fix-ownership: scanning ${path} for ownership mismatches; this may take a while on large filesystems"
-
-    # find may fail mid-walk on a live volume (file deleted under it) or on a
-    # stale mount. Tolerate it rather than aborting under errexit, but never
-    # read a failed scan as "nothing to do": that would record the sweep as
-    # complete without having looked.
-    if ! count=$(find "$path" -name lost+found -prune -o "${mismatch_expr[@]}" -printf '.' 2>/dev/null | wc -c); then
-        swept_clean=0
-        echo "[WARN] fix-ownership: could not scan ${path}; will retry on next boot"
-        continue
-    fi
-
-    if [[ "$count" -eq 0 ]]; then
-        echo "[INFO] fix-ownership: $path already owned by ${target_uid}:${target_gid}, nothing to do"
-        continue
-    fi
-
-    # find does not descend symlinks and chown -h retargets the link itself, so
-    # anything behind a symlinked directory is outside this sweep. Following
-    # them is not an option: a link could walk the chown out of the volume.
-    if [[ -n "$(find "$path" -type l -xtype d -print -quit 2>/dev/null)" ]]; then
-        echo "[WARN] fix-ownership: ${path} contains symlinked directories; ownership behind them is not managed and must be aligned by hand"
-    fi
-
-    echo "[WARN] fix-ownership: adjusting ownership of ${count} entries under ${path}"
-    if [[ "$dry_run" -eq 1 ]]; then
-        echo "[INFO] fix-ownership: dry run, not changing ${path}"
-        continue
-    fi
-
-    # -execdir chowns from the entry's own directory, so a parent swapped for a
-    # symlink mid-walk can't redirect the chown out of the volume
-    started=$SECONDS
-    if find "$path" -name lost+found -prune -o "${mismatch_expr[@]}" \
-        -print -execdir chown -h "${target_uid}:${target_gid}" {} + \
-        | awk -v total="$count" -v path="$path" '
-            BEGIN { next_pct = 5 }
-            {
-                pct = int(NR * 100 / total)
-                if (pct > 100) pct = 100
-                if (pct >= next_pct) {
-                    printf "[INFO] fix-ownership: %s %d%% (%d/%d entries)\n", path, pct, NR, total
-                    # mawk block-buffers to a pipe; without fflush the whole
-                    # progress log arrives at once
-                    fflush()
-                    while (next_pct <= pct) next_pct += 5
-                }
-            }'; then
-        elapsed=$((SECONDS - started))
-        if [[ "$elapsed" -ge 60 ]]; then
-            elapsed="$((elapsed / 60))m $((elapsed % 60))s"
-        else
-            elapsed="${elapsed}s"
-        fi
-        echo "[INFO] fix-ownership: finished ${path} in ${elapsed}"
-    else
-        swept_clean=0
-        echo "[WARN] fix-ownership: some entries under ${path} could not be updated (deleted mid-sweep or chown denied); will retry on next mismatch"
-    fi
-done
-
-# go2rtc (separate user) must be able to REACH its HomeKit state in /config.
-# Write access is per-file, not per-directory: go2rtc's PatchConfig rewrites
-# the first -config file via os.WriteFile (in-place truncate, no rename,
-# verified against go2rtc v1.9.14 internal/app/config.go), and the file is
-# always pre-created by setup_homekit_config before go2rtc starts, so
-# O_CREATE never needs directory write. See header comment for why g+w is
-# forbidden here.
-if [[ "$dry_run" -eq 0 && -d /config ]]; then
-    chgrp frigate-data /config 2>/dev/null || true
-    chmod g+rx /config 2>/dev/null || true
-fi
-
-if [[ "$dry_run" -eq 0 && -n "$sentinel" && "$swept_clean" -eq 1 ]]; then
-    /usr/local/bin/safe-sentinel write "$sentinel" "$sentinel_content" || \
-        echo "[WARN] fix-ownership: could not write ${sentinel}; the sweep will run again on next boot"
-fi

docker/main/rootfs/usr/local/bin/safe-sentinel

@@ -1,74 +0,0 @@
-#!/usr/bin/env python3
-"""Read or write the ownership sweep sentinel without following symlinks.
-
-The sentinel lives in /config, which the unprivileged runtime user owns, so it
-can be swapped for a symlink. read trusts only a root-owned regular file; write
-never follows a symlink or fifo onto another file.
-
-Usage:
-  safe-sentinel read PATH            print content, exit 0 only if root-owned regular file
-  safe-sentinel write PATH CONTENT   write CONTENT to a regular file at PATH
-"""
-
-import errno
-import os
-import stat
-import sys
-
-MODE = 0o644
-
-
-def do_read(path: str) -> int:
-    try:
-        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
-    except OSError:
-        return 1
-    try:
-        st = os.fstat(fd)
-        if not stat.S_ISREG(st.st_mode) or st.st_uid != 0:
-            return 1
-        sys.stdout.buffer.write(os.read(fd, 4096))
-    finally:
-        os.close(fd)
-    return 0
-
-
-def do_write(path: str, content: str) -> int:
-    # O_NONBLOCK so a fifo fails fast (ENXIO) instead of blocking the open.
-    flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK
-    replace = (errno.ELOOP, errno.ENXIO)
-    try:
-        fd = os.open(path, flags, MODE)
-        if not stat.S_ISREG(os.fstat(fd).st_mode):
-            os.close(fd)
-            raise OSError(errno.ELOOP, "not a regular file")
-    except OSError as err:
-        if err.errno not in replace:
-            raise
-        os.unlink(path)
-        fd = os.open(path, flags | os.O_EXCL, MODE)
-    try:
-        os.ftruncate(fd, 0)
-        os.write(fd, content.encode())
-        # keep it root-owned so a later sweep that chowned the old sentinel to
-        # the runtime user can't make the next read reject and re-sweep
-        os.fchown(fd, 0, 0)
-    finally:
-        os.close(fd)
-    return 0
-
-
-def main(argv: list[str]) -> int:
-    if len(argv) == 3 and argv[1] == "read":
-        return do_read(argv[2])
-    if len(argv) == 4 and argv[1] == "write":
-        try:
-            return do_write(argv[2], argv[3])
-        except OSError:
-            return 1
-    print("usage: safe-sentinel read PATH | write PATH CONTENT", file=sys.stderr)
-    return 2
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv))

docker/main/rootfs/usr/local/bin/service-runs-as-root

@@ -1,18 +0,0 @@
-#!/bin/bash
-# Exit 0 when FRIGATE_ROOT_SERVICES names the given service. Membership only:
-# the euid and FRIGATE_RUN_AS_ROOT checks stay in the callers.
-#
-# Usage: service-runs-as-root SERVICE
-
-set -o nounset
-
-service="${1:?usage: service-runs-as-root SERVICE}"
-
-IFS=',' read -ra entries <<< "${FRIGATE_ROOT_SERVICES:-}"
-for entry in "${entries[@]}"; do
-    entry="${entry//[[:space:]]/}"
-    if [[ "$entry" == "$service" ]]; then
-        exit 0
-    fi
-done
-exit 1

docker/main/rootfs/usr/local/ffmpeg/get_ffmpeg_path.py

@@ -5,7 +5,11 @@ from typing import Any
 from ruamel.yaml import YAML
 
 sys.path.insert(0, "/opt/frigate")
-from frigate.util.config import find_config_file, resolve_ffmpeg_path
+from frigate.const import (
+    DEFAULT_FFMPEG_VERSION,
+    INCLUDED_FFMPEG_VERSIONS,
+)
+from frigate.util.config import find_config_file
 
 sys.path.remove("/opt/frigate")
 
@@ -25,4 +29,9 @@ except FileNotFoundError:
     config: dict[str, Any] = {}
 
 path = config.get("ffmpeg", {}).get("path", "default")
-print(resolve_ffmpeg_path(path, "ffmpeg"))
+if path == "default":
+    print(f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg")
+elif path in INCLUDED_FFMPEG_VERSIONS:
+    print(f"/usr/lib/ffmpeg/{path}/bin/ffmpeg")
+else:
+    print(f"{path}/bin/ffmpeg")

docker/main/rootfs/usr/local/go2rtc/create_config.py

@@ -3,27 +3,52 @@
 import json
 import os
 import sys
+from pathlib import Path
 from typing import Any
 
 from ruamel.yaml import YAML
 
 sys.path.insert(0, "/opt/frigate")
-from frigate.config.env import apply_config_env_vars, substitute_frigate_vars
+from frigate.config.env import substitute_frigate_vars
 from frigate.const import (
     BIRDSEYE_PIPE,
+    DEFAULT_FFMPEG_VERSION,
+    INCLUDED_FFMPEG_VERSIONS,
     LIBAVFORMAT_VERSION_MAJOR,
 )
 from frigate.ffmpeg_presets import parse_preset_hardware_acceleration_encode
-from frigate.util.config import find_config_file, resolve_ffmpeg_path
+from frigate.util.config import find_config_file
-from frigate.util.services import (
-    is_go2rtc_arbitrary_exec_allowed,
-    is_restricted_go2rtc_source,
-)
 
 sys.path.remove("/opt/frigate")
 
 yaml = YAML()
 
+# Check if arbitrary exec sources are allowed (defaults to False for security)
+allow_arbitrary_exec = None
+if "GO2RTC_ALLOW_ARBITRARY_EXEC" in os.environ:
+    allow_arbitrary_exec = os.environ.get("GO2RTC_ALLOW_ARBITRARY_EXEC")
+elif (
+    os.path.isdir("/run/secrets")
+    and os.access("/run/secrets", os.R_OK)
+    and "GO2RTC_ALLOW_ARBITRARY_EXEC" in os.listdir("/run/secrets")
+):
+    allow_arbitrary_exec = (
+        Path(os.path.join("/run/secrets", "GO2RTC_ALLOW_ARBITRARY_EXEC"))
+        .read_text()
+        .strip()
+    )
+# check for the add-on options file
+elif os.path.isfile("/data/options.json"):
+    with open("/data/options.json") as f:
+        raw_options = f.read()
+    options = json.loads(raw_options)
+    allow_arbitrary_exec = options.get("go2rtc_allow_arbitrary_exec")
+
+ALLOW_ARBITRARY_EXEC = allow_arbitrary_exec is not None and str(
+    allow_arbitrary_exec
+).lower() in ("true", "1", "yes")
+
+
 config_file = find_config_file()
 
 try:
@@ -37,20 +62,6 @@ try:
 except FileNotFoundError:
     config: dict[str, Any] = {}
 
-# No validator runs here, so install environment_vars ourselves. FRIGATE_
-# names only: anything else lands in os.environ, where the exec gate reads
-# GO2RTC_ALLOW_ARBITRARY_EXEC.
-config_env_vars = config.get("environment_vars")
-apply_config_env_vars(
-    {
-        key: value
-        for key, value in config_env_vars.items()
-        if str(key).startswith("FRIGATE_")
-    }
-    if isinstance(config_env_vars, dict)
-    else {}
-)
-
 go2rtc_config: dict[str, Any] = config.get("go2rtc", {})
 
 # Need to enable CORS for go2rtc so the frigate integration / card work automatically
@@ -96,7 +107,12 @@ if go2rtc_config.get("rtsp", {}).get("password") is not None:
 
 # ensure ffmpeg path is set correctly
 path = config.get("ffmpeg", {}).get("path", "default")
-ffmpeg_path = resolve_ffmpeg_path(path, "ffmpeg")
+if path == "default":
+    ffmpeg_path = f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg"
+elif path in INCLUDED_FFMPEG_VERSIONS:
+    ffmpeg_path = f"/usr/lib/ffmpeg/{path}/bin/ffmpeg"
+else:
+    ffmpeg_path = f"{path}/bin/ffmpeg"
 
 if go2rtc_config.get("ffmpeg") is None:
     go2rtc_config["ffmpeg"] = {"bin": ffmpeg_path}
@@ -112,13 +128,18 @@ if LIBAVFORMAT_VERSION_MAJOR < 59:
         go2rtc_config["ffmpeg"]["rtsp"] = rtsp_args
 
 
+def is_restricted_source(stream_source: str) -> bool:
+    """Check if a stream source is restricted (echo, expr, or exec)."""
+    return stream_source.strip().startswith(("echo:", "expr:", "exec:"))
+
+
 for name in list(go2rtc_config.get("streams", {})):
     stream = go2rtc_config["streams"][name]
 
     if isinstance(stream, str):
         try:
             formatted_stream = substitute_frigate_vars(stream)
-            if is_restricted_go2rtc_source(formatted_stream):
+            if not ALLOW_ARBITRARY_EXEC and is_restricted_source(formatted_stream):
                 print(
                     f"[ERROR] Stream '{name}' uses a restricted source (echo/expr/exec) which is disabled by default for security. "
                     f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
@@ -126,7 +147,7 @@ for name in list(go2rtc_config.get("streams", {})):
                 del go2rtc_config["streams"][name]
                 continue
             go2rtc_config["streams"][name] = formatted_stream
-        except ValueError as e:
+        except KeyError as e:
             print(
                 "[ERROR] Invalid substitution found, see https://docs.frigate.video/configuration/restream#advanced-restream-configurations for more info."
             )
@@ -137,7 +158,7 @@ for name in list(go2rtc_config.get("streams", {})):
         for i, stream_item in enumerate(stream):
             try:
                 formatted_stream = substitute_frigate_vars(stream_item)
-                if is_restricted_go2rtc_source(formatted_stream):
+                if not ALLOW_ARBITRARY_EXEC and is_restricted_source(formatted_stream):
                     print(
                         f"[ERROR] Stream '{name}' item {i + 1} uses a restricted source (echo/expr/exec) which is disabled by default for security. "
                         f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
@@ -145,7 +166,7 @@ for name in list(go2rtc_config.get("streams", {})):
                     continue
 
                 filtered_streams.append(formatted_stream)
-            except ValueError as e:
+            except KeyError as e:
                 print(
                     "[ERROR] Invalid substitution found, see https://docs.frigate.video/configuration/restream#advanced-restream-configurations for more info."
                 )
@@ -160,20 +181,6 @@ for name in list(go2rtc_config.get("streams", {})):
             )
             del go2rtc_config["streams"][name]
 
-    elif isinstance(stream, dict):
-        # The map form ({"url": ...}) lets go2rtc resolve the source
-        # recursively, so it is effectively a dynamic way to generate the URL
-        # for a stream. That can only be backed by an exec source, so it cannot
-        # be allowed unless arbitrary exec is explicitly enabled. When it is
-        # enabled, leave the map untouched for go2rtc to resolve.
-        if not is_go2rtc_arbitrary_exec_allowed():
-            print(
-                f"[ERROR] Stream '{name}' uses a dynamic source format which is disabled by default for security. "
-                f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
-            )
-            del go2rtc_config["streams"][name]
-            continue
-
 # add birdseye restream stream if enabled
 if config.get("birdseye", {}).get("restream", False):
     birdseye: dict[str, Any] = config.get("birdseye")
@@ -189,6 +196,3 @@ if config.get("birdseye", {}).get("restream", False):
 # Write go2rtc_config to /dev/shm/go2rtc.yaml
 with open("/dev/shm/go2rtc.yaml", "w") as f:
     yaml.dump(go2rtc_config, f)
-
-# config contains camera credentials; do not leave it world-readable
-os.chmod("/dev/shm/go2rtc.yaml", 0o640)

docker/main/rootfs/usr/local/go2rtc/prepare_homekit.py

@@ -1,107 +0,0 @@
-"""Normalize the go2rtc HomeKit file and hand it to go2rtc, as root.
-
-Runs before the drop. The file is in the runtime-user-owned /config, so a
-planted symlink could redirect the root write or chown onto another file;
-every operation goes through an O_NOFOLLOW fd to prevent that.
-
-Usage: prepare_homekit.py PATH [--chown]
-"""
-
-import errno
-import grp
-import io
-import os
-import pwd
-import stat
-import sys
-
-from ruamel.yaml import YAML
-
-RUNTIME_OWNER = "go2rtc"
-SHARED_GROUP = "frigate-data"
-MODE = 0o664
-MAX_BYTES = 10 * 1024 * 1024
-
-
-def open_nofollow(path: str) -> int:
-    """Return an fd to a regular file at path, never following a symlink."""
-    flags = os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW
-    try:
-        fd = os.open(path, flags, MODE)
-    except OSError as err:
-        if err.errno != errno.ELOOP:
-            raise
-        os.unlink(path)
-        return os.open(path, flags | os.O_EXCL, MODE)
-
-    # A fifo or other non-regular file would hang or misbehave on read; replace it.
-    if not stat.S_ISREG(os.fstat(fd).st_mode):
-        os.close(fd)
-        os.unlink(path)
-        return os.open(path, flags | os.O_EXCL, MODE)
-    return fd
-
-
-def normalize(content: str) -> str:
-    """Keep only the homekit section, matching the previous yq/jq behavior."""
-    yaml = YAML(typ="safe")
-    try:
-        data = yaml.load(content)
-    except Exception:
-        return ""
-
-    if not isinstance(data, dict) or "homekit" not in data:
-        return ""
-
-    buf = io.StringIO()
-    yaml.dump({"homekit": data["homekit"]}, buf)
-    return buf.getvalue()
-
-
-def main() -> int:
-    if len(sys.argv) < 2:
-        print("[ERROR] prepare_homekit: PATH is required", file=sys.stderr)
-        return 2
-
-    path = sys.argv[1]
-    do_chown = "--chown" in sys.argv[2:]
-
-    try:
-        fd = open_nofollow(path)
-    except PermissionError:
-        print(
-            f"[WARN] {path} is not writable by uid {os.geteuid()}, so HomeKit "
-            "pairing changes will not persist. It is owned by the go2rtc user "
-            "from an earlier run in the default mode. To fix, on the host run: "
-            f"chown {os.geteuid()}:{os.getegid()} <your config dir>/{os.path.basename(path)}"
-        )
-        return 0
-
-    try:
-        content = os.read(fd, MAX_BYTES).decode("utf-8", "replace")
-        normalized = normalize(content)
-        os.ftruncate(fd, 0)
-        os.lseek(fd, 0, os.SEEK_SET)
-        os.write(fd, normalized.encode("utf-8"))
-
-        if do_chown:
-            # tolerate a chown-refusing mount (NFS root_squash): pairing
-            # persistence degrades, the service does not
-            try:
-                uid = pwd.getpwnam(RUNTIME_OWNER).pw_uid
-                gid = grp.getgrnam(SHARED_GROUP).gr_gid
-                os.fchown(fd, uid, gid)
-                os.fchmod(fd, MODE)
-            except (KeyError, OSError):
-                print(
-                    f"[WARN] Could not hand {path} to the go2rtc user; "
-                    "HomeKit pairing changes may not persist"
-                )
-    finally:
-        os.close(fd)
-
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -1,13 +1,9 @@
-# Loaded with -c from the /tmp/nginx/conf copy: relative includes follow the -c
-# file, all other path directives follow --prefix and must stay absolute.
-
 daemon off;
-# ignored by a non-root master; keeps workers root under FRIGATE_RUN_AS_ROOT
 user root;
 worker_processes auto;
 
 error_log /dev/stdout warn;
-pid /tmp/nginx/nginx.pid;
+pid /var/run/nginx.pid;
 
 events {
     worker_connections 1024;
@@ -15,13 +11,6 @@ events {
 
 http {
     map_hash_bucket_size 256;
-    server_tokens off;
-
-    client_body_temp_path /tmp/nginx/client_body;
-    proxy_temp_path /tmp/nginx/proxy;
-    fastcgi_temp_path /tmp/nginx/fastcgi;
-    uwsgi_temp_path /tmp/nginx/uwsgi;
-    scgi_temp_path /tmp/nginx/scgi;
 
     include mime.types;
     default_type application/octet-stream;
@@ -73,7 +62,6 @@ http {
 
     server {
         include listen.conf;
-        include security_headers.conf;
 
         # enable HTTP/2 for TLS connections to eliminate browser 6-connection limit
         http2 on;
@@ -87,12 +75,6 @@ http {
         vod_align_segments_to_key_frames on;
         vod_manifest_segment_durations_mode accurate;
         vod_ignore_edit_list on;
-        # short leading segments at each playlist start; sources start at
-        # the seek target, so the ladder applies to every seek. Only
-        # effective when clips declare real keyFrameDurations
-        vod_bootstrap_segment_durations 1000;
-        vod_bootstrap_segment_durations 2000;
-        vod_bootstrap_segment_durations 4000;
         vod_segment_duration 10000;
 
         # MPEG-TS settings (not used when fMP4 is enabled, kept for reference)
@@ -132,23 +114,25 @@ http {
             # Smaller segments, faster generation, better browser compatibility
             vod_hls_container_format fmp4;
 
-            # fMP4 playlists use EXT-X-MAP, which requires HLS protocol
-            # version 6 (RFC 8216 section 7); the module default is 4
-            vod_hls_version 6;
-
             secure_token $args;
             secure_token_types application/vnd.apple.mpegurl;
 
-            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
 
             keepalive_disable safari;
+
+            # vod module returns 502 for non-existent media
+            # https://github.com/kaltura/nginx-vod-module/issues/468
+            error_page 502 =404 /vod-not-found;
+        }
+
+        location = /vod-not-found {
+            return 404;
         }
 
         location /stream/ {
             include auth_request.conf;
-            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
 
@@ -166,13 +150,10 @@ http {
             include auth_request.conf;
             types {
                 video/mp4 mp4;
-                image/jpeg jpg jpeg;
+                image/jpeg jpg;
-                image/png png;
-                image/webp webp;
             }
 
             expires 7d;
-            include security_headers.conf;
             add_header Cache-Control "public";
             autoindex on;
             root /media/frigate;
@@ -265,14 +246,12 @@ http {
 
         location /api/ {
             include auth_request.conf;
-            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
             proxy_pass http://frigate_api/;
             include proxy.conf;
 
             proxy_cache api_cache;
-            proxy_cache_key "$scheme$proxy_host$request_uri|$role|$groups|$user";
             proxy_cache_lock on;
             proxy_cache_use_stale updating;
             proxy_cache_valid 200 5s;
@@ -294,13 +273,6 @@ http {
                 include proxy.conf;
             }
 
-            location /api/logout {
-                auth_request off;
-                rewrite ^/api(/.*)$ $1 break;
-                proxy_pass http://frigate_api;
-                include proxy.conf;
-            }
-
             # Allow unauthenticated access to the first_time_login endpoint
             # so the login page can load help text before authentication.
             location /api/auth/first_time_login {
@@ -332,27 +304,29 @@ http {
 
         location / {
             # do not require auth for static assets
-            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
 
             location /assets/ {
                 access_log off;
                 expires 1y;
-                include security_headers.conf;
+                add_header Cache-Control "public";
+            }
+
+            location /fonts/ {
+                access_log off;
+                expires 1y;
                 add_header Cache-Control "public";
             }
 
             location /locales/ {
                 access_log off;
-                include security_headers.conf;
                 add_header Cache-Control "public";
             }
 
             location ~ ^/.*-([A-Za-z0-9]+)\.webmanifest$ {
                 access_log off;
                 expires 1y;
-                include security_headers.conf;
                 add_header Cache-Control "public";
                 default_type application/json;
                 proxy_set_header Accept-Encoding "";
@@ -369,7 +343,7 @@ http {
             sub_filter '"/BASE_PATH/assets/' '"$http_x_ingress_path/assets/';
             sub_filter '"/BASE_PATH/locales/' '"$http_x_ingress_path/locales/';
             sub_filter '"/BASE_PATH/monacoeditorwork/' '"$http_x_ingress_path/assets/';
-            sub_filter 'return`/BASE_PATH/`' 'return window.baseUrl';
+            sub_filter 'return"/BASE_PATH/"' 'return window.baseUrl';
             sub_filter '<body>' '<body><script>window.baseUrl="$http_x_ingress_path/";</script>';
             sub_filter_types text/css application/javascript;
             sub_filter_once off;

docker/main/rootfs/usr/local/nginx/conf/security_headers.conf

@@ -1,5 +0,0 @@
-# Deliberately no X-Frame-Options or CSP frame-ancestors: HA's Webpage card and
-# iframe panels frame Frigate cross-origin, and either would break them
-# silently. Bind-mount this file to add your own.
-add_header X-Content-Type-Options "nosniff" always;
-add_header Referrer-Policy "strict-origin-when-cross-origin" always;

docker/main/rootfs/usr/local/nginx/templates/listen.gotmpl

@@ -8,8 +8,8 @@ listen {{ .listen.internal }};
     listen {{ .listen.external }} ssl;
     {{ if .ipv6.enabled }}listen [::]:{{ .listen.external_port }} ssl;{{ end }}
 
-    ssl_certificate {{ .tls.cert_path }}/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
-    ssl_certificate_key {{ .tls.cert_path }}/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;
 
     # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
     # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7

docker/migration/fix-permissions.sh

@@ -1,55 +0,0 @@
-#!/bin/bash
-# Ahead-of-time volume ownership migration for switching Frigate to non-root.
-# Run from the host BEFORE enabling PUID/PGID or --user:
-#
-#   ./fix-permissions.sh [--dry-run] <config_dir> <media_dir> [PUID] [PGID]
-#
-# Wraps the image's fix-ownership helper so there is exactly one
-# implementation of the chown logic. Requires an image that contains the
-# helper (any release that includes non-root support).
-
-set -o errexit -o nounset -o pipefail
-
-IMAGE="${FRIGATE_IMAGE:-ghcr.io/blakeblackshear/frigate:stable}"
-
-dry_run_flag=""
-if [[ "${1:-}" == "--dry-run" ]]; then
-    dry_run_flag="--dry-run"
-    shift
-fi
-
-if [[ $# -lt 2 ]]; then
-    echo "Usage: $0 [--dry-run] <config_dir> <media_dir> [PUID] [PGID]" >&2
-    exit 2
-fi
-
-config_dir="$1"
-media_dir="$2"
-puid="${3:-1000}"
-pgid="${4:-1000}"
-
-# The ids are interpolated into the container's bash -c source below, so
-# anything but digits would be reparsed as shell rather than passed through
-if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
-    echo "[ERROR] PUID and PGID must be numeric, got '${puid}' and '${pgid}'" >&2
-    exit 2
-fi
-
-echo "[INFO] Using image ${IMAGE} (override with FRIGATE_IMAGE=...)"
-if ! docker image inspect "${IMAGE}" >/dev/null 2>&1; then
-    echo "[INFO] ${IMAGE} is not present locally and has to be pulled first; this may take a while"
-fi
-
-if [[ -n "$dry_run_flag" ]]; then
-    echo "[INFO] Dry run: reporting what would change under ${config_dir} and ${media_dir}, changing nothing"
-else
-    echo "[INFO] Aligning ${config_dir} and ${media_dir} to ${puid}:${pgid}; this may take a while on large filesystems"
-fi
-
-# shellcheck disable=SC2086
-docker run --rm \
-    -v "${config_dir}:/config" \
-    -v "${media_dir}:/media/frigate" \
-    --entrypoint bash \
-    "${IMAGE}" \
-    -c "command -v fix-ownership >/dev/null || { echo '[ERROR] this Frigate image predates non-root support; set FRIGATE_IMAGE to a release that includes it' >&2; exit 1; }; exec fix-ownership ${dry_run_flag} ${puid} ${pgid} /config /media/frigate"

docker/rockchip/Dockerfile

@@ -25,7 +25,6 @@ RUN --mount=type=bind,from=rk-wheels,source=/rk-wheels,target=/deps/rk-wheels \
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=rk
 COPY docker/rockchip/COCO /COCO
 COPY docker/rockchip/conv2rknn.py /opt/conv2rknn.py
 

docker/rockchip/conv2rknn.py

@@ -11,10 +11,10 @@ except FileNotFoundError:
     pass
 
 try:
-    with open("/config/conv2rknn.yaml") as config_file:
+    with open("/config/conv2rknn.yaml", "r") as config_file:
         configuration = yaml.safe_load(config_file)
 except FileNotFoundError:
-    raise Exception("Please place a config file at /config/conv2rknn.yaml") from None
+    raise Exception("Please place a config file at /config/conv2rknn.yaml")
 
 if configuration["config"] != None:
     rknn_config = configuration["config"]
@@ -31,7 +31,7 @@ if "soc" not in configuration:
         with open("/proc/device-tree/compatible") as file:
             soc = file.read().split(",")[-1].strip("\x00")
     except FileNotFoundError:
-        raise Exception("Make sure to run docker in privileged mode.") from None
+        raise Exception("Make sure to run docker in privileged mode.")
 
     configuration["soc"] = [
         soc,

docker/rocm/Dockerfile

@@ -13,7 +13,7 @@ ARG ROCM
 
 RUN apt update -qq && \
     apt install -y wget gpg && \
-    wget -O rocm.deb https://repo.radeon.com/amdgpu-install/7.2.3/ubuntu/jammy/amdgpu-install_7.2.3.70203-1_all.deb && \
+    wget -O rocm.deb https://repo.radeon.com/amdgpu-install/7.2/ubuntu/jammy/amdgpu-install_7.2.70200-1_all.deb && \
     apt install -y ./rocm.deb && \
     apt update && \
     apt install -qq -y rocm
@@ -32,19 +32,15 @@ RUN echo /opt/rocm/lib|tee /opt/rocm-dist/etc/ld.so.conf.d/rocm.conf
 FROM deps AS deps-prelim
 
 COPY docker/rocm/debian-backports.sources /etc/apt/sources.list.d/debian-backports.sources
-# install_deps.sh upgraded libstdc++6 from trixie for Battlemage; the matching
+RUN apt-get update && \
-# -dev package must also come from trixie or apt refuses to satisfy it.
-RUN echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/trixie.list && \
-    apt-get update && \
     apt-get install -y libnuma1 && \
     apt-get install -qq -y -t bookworm-backports mesa-va-drivers mesa-vulkan-drivers && \
-    apt-get install -qq -y -t trixie libstdc++-14-dev && \
+    # Install C++ standard library headers for HIPRTC kernel compilation fallback
-    rm -f /etc/apt/sources.list.d/trixie.list && \
+    apt-get install -qq -y libstdc++-12-dev && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /opt/frigate
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=rocm
 
 RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
@@ -79,10 +75,6 @@ ENV MIGRAPHX_DISABLE_MIOPEN_FUSION=1
 ENV MIGRAPHX_DISABLE_SCHEDULE_PASS=1
 ENV MIGRAPHX_DISABLE_REDUCE_FUSION=1
 ENV MIGRAPHX_ENABLE_HIPRTC_WORKAROUNDS=1
-ENV MIOPEN_CUSTOM_CACHE_DIR=/config/model_cache/migraphx
-ENV MIOPEN_USER_DB_PATH=/config/model_cache/migraphx
-ENV AMD_COMGR_CACHE=1
-ENV AMD_COMGR_CACHE_DIR=/config/model_cache/migraphx
 
 COPY --from=rocm-dist / /
 

docker/rocm/requirements-wheels-rocm.txt

@@ -1 +1 @@
-onnxruntime-migraphx @ https://github.com/NickM-27/frigate-onnxruntime-rocm/releases/download/v7.2.3-1/onnxruntime_migraphx-1.24.4-cp311-cp311-linux_x86_64.whl
+onnxruntime-migraphx @ https://github.com/NickM-27/frigate-onnxruntime-rocm/releases/download/v7.2.0/onnxruntime_migraphx-1.23.1-cp311-cp311-linux_x86_64.whl

docker/rocm/rocm.hcl

@@ -1,5 +1,5 @@
 variable "ROCM" {
-  default = "7.2.3"
+  default = "7.2.0"
 }
 variable "HSA_OVERRIDE_GFX_VERSION" {
   default = ""

docker/rpi/Dockerfile

@@ -15,4 +15,3 @@ ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:${INCLUDED_FFMPEG_VERSIO
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=rpi

docker/synaptics/Dockerfile

@@ -22,7 +22,6 @@ pip3 install --no-deps -U /deps/synap-wheels/*.whl
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=synaptics
 
 COPY --from=synap1680-wheels /rootfs/usr/local/lib/*.so /usr/lib
 

docker/tensorrt/Dockerfile.amd64

@@ -25,7 +25,6 @@ RUN --mount=type=bind,from=trt-wheels,source=/trt-wheels,target=/deps/trt-wheels
     && pip3 install -U /deps/trt-wheels/*.whl
 
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=tensorrt
 COPY docker/tensorrt/detector/rootfs/etc/ld.so.conf.d /etc/ld.so.conf.d
 RUN ldconfig
 

docker/tensorrt/Dockerfile.arm64

@@ -151,7 +151,6 @@ RUN --mount=type=bind,from=trt-wheels,source=/trt-wheels,target=/deps/trt-wheels
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
-ENV FRIGATE_IMAGE_VARIANT=tensorrt-jp6
 
 # Fixes "Error importing detector runtime: /usr/lib/aarch64-linux-gnu/libstdc++.so.6: cannot allocate memory in static TLS block"
 ENV LD_PRELOAD /usr/lib/aarch64-linux-gnu/libstdc++.so.6

docker/tensorrt/detector/rootfs/etc/s6-overlay/s6-rc.d/trt-model-prepare/run

@@ -13,16 +13,6 @@ TRT_VER=${TRT_VER:-$(cat /etc/TENSORRT_VER)}
 OUTPUT_FOLDER="${MODEL_CACHE_DIR}/${TRT_VER}"
 YOLO_MODELS=${YOLO_MODELS:-""}
 
-# This runs as root after prepare's sentinel-guarded sweep, so the dirs and
-# engines it creates below are the runtime user's to fix up, on every exit path
-function hand_off_ownership() {
-    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-        /usr/local/bin/fix-ownership "${PUID:-1000}" "${PGID:-1000}" \
-            /config/model_cache "${MODEL_CACHE_DIR}"
-    fi
-}
-trap hand_off_ownership EXIT
-
 # Create output folder
 mkdir -p ${OUTPUT_FOLDER}
 

docker/tensorrt/requirements-amd64.txt

@@ -1,5 +1,6 @@
 # Nvidia ONNX Runtime GPU Support
 --extra-index-url 'https://pypi.nvidia.com'
+cython==3.0.*; platform_machine == 'x86_64'
 nvidia-cuda-cupti-cu12==12.8.90; platform_machine == 'x86_64'
 nvidia-cublas-cu12==12.8.4.1; platform_machine == 'x86_64'
 nvidia-cudnn-cu12==9.8.0.87; platform_machine == 'x86_64'

docs/docs/configuration/advanced.md

@@ -1,6 +1,7 @@
 ---
-id: system
+id: advanced
-title: System
+title: Advanced Options
+sidebar_label: Advanced Options
 ---
 
 import ConfigTabs from "@site/src/components/ConfigTabs";
@@ -63,28 +64,34 @@ go2rtc:
 
 ### `environment_vars`
 
-This section sets environment variables in the Frigate process for those unable to modify the environment of the container, like within Home Assistant OS. It's meant for process settings such as `LIBVA_DRIVER_NAME` or the TensorFlow thread counts below. Docker users should set environment variables in their `docker run` command (`-e LIBVA_DRIVER_NAME=i965`) or `docker-compose.yml` file (`environment:` section) instead. Values set here are stored in plain text in your config file, so credentials belong in `secrets.yaml`, Docker environment variables, or Docker secrets instead.
+This section can be used to set environment variables for those unable to modify the environment of the container, like within Home Assistant OS. Docker users should set environment variables in their `docker run` command (`-e FRIGATE_MQTT_PASSWORD=secret`) or `docker-compose.yml` file (`environment:` section) instead. Note that values set here are stored in plain text in your config file, so if the goal is to keep credentials out of your configuration, use Docker environment variables or Docker secrets instead.
 
-Names prefixed with `FRIGATE_` set here also take part in `{FRIGATE_VARIABLE_NAME}` substitution (see [below](#substitution-sources-and-precedence)), but `secrets.yaml` is the better home for them.
+Variables prefixed with `FRIGATE_` can be referenced in config fields that support environment variable substitution (such as MQTT host and credentials, camera stream URLs, and ONVIF host and credentials) using the `{FRIGATE_VARIABLE_NAME}` syntax.
 
 <ConfigTabs>
 <TabItem value="ui">
 
 Navigate to <NavPath path="Settings > System > Environment variables" /> to add or edit environment variables.
 
-| Field             | Description                                               |
+| Field     | Description                                               |
-| ----------------- | --------------------------------------------------------- |
+| --------- | --------------------------------------------------------- |
-| **Variable name** | The environment variable name (e.g., `LIBVA_DRIVER_NAME`) |
+| **Key**   | The environment variable name (e.g., `FRIGATE_MQTT_USER`) |
-| **Value**         | The value for the variable                                |
+| **Value** | The value for the variable                                |
 
-Names prefixed with `FRIGATE_` can also be referenced elsewhere in your configuration using the `{FRIGATE_VARIABLE_NAME}` syntax.
+Variables defined here can be referenced elsewhere in your configuration using the `{FRIGATE_VARIABLE_NAME}` syntax.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
 environment_vars:
-  LIBVA_DRIVER_NAME: i965
+  FRIGATE_MQTT_USER: my_mqtt_user
+  FRIGATE_MQTT_PASSWORD: my_mqtt_password
+
+mqtt:
+  host: "{FRIGATE_MQTT_HOST}"
+  user: "{FRIGATE_MQTT_USER}"
+  password: "{FRIGATE_MQTT_PASSWORD}"
 ```
 
 </TabItem>
@@ -118,51 +125,6 @@ environment_vars:
 </TabItem>
 </ConfigTabs>
 
-### `secrets.yaml`
-
-A `secrets.yaml` file next to your `config.yml` is an additional source of `FRIGATE_` variables, for installs that can't set container environment variables or mount Docker secrets. It's a flat map of names to values, and it is never read or written by the Frigate UI:
-
-```yaml
-FRIGATE_CAM_USER: viewer
-FRIGATE_CAM_PASS: "p@ss w0rd"
-FRIGATE_MQTT_HOST: mqtt.internal.example
-```
-
-For Docker this is `/config/secrets.yaml` inside the container, so it lives in whatever host directory you mounted at `/config`. For the Home Assistant App it's `/addon_configs/<addon_directory>/secrets.yaml`, in the same folder as your `config.yml`; see [the App config directory](../config.md#accessing-app-config-dir) for the directory name for your variant.
-
-Names must start with `FRIGATE_`, and nesting is not supported. `secrets.yaml` feeds `{FRIGATE_VARIABLE_NAME}` substitution, so the handful of variables Frigate reads straight from the process environment, such as `FRIGATE_JWT_SECRET`, still need a container environment variable or a Docker secret.
-
-### Substitution sources and precedence
-
-The same `{FRIGATE_VARIABLE_NAME}` placeholder resolves from four sources. When a name is defined in more than one, the higher one wins and a warning at startup names which source was used.
-
-| Priority    | Source                | Where it's set                                                             | Who can use it                 |
-| ----------- | --------------------- | -------------------------------------------------------------------------- | ------------------------------ |
-| 1 (highest) | Docker secrets        | Files in `/run/secrets`, or the directory named by `CREDENTIALS_DIRECTORY` | Docker, systemd                |
-| 2           | Container environment | `docker run -e`, the `environment:` section of `docker-compose.yml`        | Docker                         |
-| 3           | `secrets.yaml`        | Next to `config.yml`, see above                                            | Everyone, including the HA App |
-| 4 (lowest)  | `environment_vars`    | The block in `config.yml` described above                                  | Everyone, including the HA App |
-
-For example, with this `secrets.yaml`:
-
-```yaml
-FRIGATE_MQTT_PASSWORD: from_secrets
-```
-
-and this `config.yml`:
-
-```yaml
-environment_vars:
-  FRIGATE_MQTT_PASSWORD: from_config
-
-mqtt:
-  password: "{FRIGATE_MQTT_PASSWORD}"
-```
-
-the password resolves to `from_secrets`, and the log shows `FRIGATE_MQTT_PASSWORD is defined in more than one place, using the value from secrets.yaml`. Add `-e FRIGATE_MQTT_PASSWORD=from_env` to the container and it resolves to `from_env` instead.
-
-Referencing a name that no source defines is a config validation error naming the field.
-
 ### `database`
 
 Tracked object and recording information is managed in a sqlite database at `/config/frigate.db`. If that database is deleted, recordings will be orphaned and will need to be cleaned up manually. They also won't show up in the Media Browser within Home Assistant.
@@ -210,7 +172,7 @@ Custom models may also require different input tensor formats. The colorspace co
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detection models" /> and, on the model you want to change, open the **Custom Model** tab to configure the model path, dimensions, and input format.
+Navigate to <NavPath path="Settings > System > Detection model" /> to configure the model path, dimensions, and input format.
 
 | Field                                         | Description                          |
 | --------------------------------------------- | ------------------------------------ |
@@ -225,14 +187,12 @@ Navigate to <NavPath path="Settings > System > Detection models" /> and, on the
 
 ```yaml
 # Optional: model config
-models:
+model:
-  - devices:
+  path: /path/to/model
-      - openvino:GPU
+  width: 320
-    path: /path/to/model
+  height: 320
-    width: 320
+  input_tensor: "nhwc"
-    height: 320
+  input_pixel_format: "bgr"
-    input_tensor: "nhwc"
-    input_pixel_format: "bgr"
 ```
 
 </TabItem>
@@ -242,22 +202,22 @@ models:
 
 :::warning
 
-If the labelmap is customized then the labels used for alerts will need to be adjusted as well. See [alert labels](../review.md#restricting-alerts-to-specific-labels) for more info.
+If the labelmap is customized then the labels used for alerts will need to be adjusted as well. See [alert labels](../configuration/review.md#restricting-alerts-to-specific-labels) for more info.
 
 :::
 
 The labelmap can be customized to your needs. A common reason to do this is to combine multiple object types that are easily confused when you don't need to be as granular such as car/truck. By default, truck is renamed to car because they are often confused. You cannot add new object types, but you can change the names of existing objects in the model.
 
 ```yaml
-models:
+model:
-  - labelmap:
+  labelmap:
-      2: vehicle
+    2: vehicle
-      3: vehicle
+    3: vehicle
-      5: vehicle
+    5: vehicle
-      7: vehicle
+    7: vehicle
-      15: animal
+    15: animal
-      16: animal
+    16: animal
-      17: animal
+    17: animal
 ```
 
 Note that if you rename objects in the labelmap, you will also need to update your `objects -> track` list as well.
@@ -274,16 +234,26 @@ Some labels have special handling and modifications can disable functionality.
 
 ## Network Configuration
 
-Frigate exposes a few networking options. IPv6 and the listen ports are set in the `networking` configuration (or from the Settings UI); more advanced changes require [customizing the bundled Nginx configuration](#customizing-the-nginx-configuration).
+Changes to Frigate's internal network configuration can be made by bind mounting nginx.conf into the container. For example:
+
+```yaml
+services:
+  frigate:
+    container_name: frigate
+    ...
+    volumes:
+      ...
+      - /path/to/your/nginx.conf:/usr/local/nginx/conf/nginx.conf
+```
 
 ### Enabling IPv6
 
-By default Frigate listens on IPv4 only. To also listen on IPv6 (on port `5000`, and on `8971` when TLS is configured), enable it in the `networking` configuration.
+IPv6 is disabled by default. Enable it in the Frigate configuration.
 
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Networking" /> and enable **IPv6**.
+Navigate to <NavPath path="Settings > System > Networking" /> and expand **IPv6 configuration**, then enable **Enable IPv6**.
 
 </TabItem>
 <TabItem value="yaml">
@@ -291,7 +261,7 @@ Navigate to <NavPath path="Settings > System > Networking" /> and enable **IPv6*
 ```yaml
 networking:
   ipv6:
-    enabled: true
+    enabled: True
 ```
 
 </TabItem>
@@ -328,26 +298,8 @@ networking:
 
 This setting is for advanced users. For the majority of use cases it's recommended to change the `ports` section of your Docker compose file or use the Docker `run` `--publish` option instead, e.g. `-p 443:8971`. Changing Frigate's ports may break some integrations.
 
-The internal and external ports must be different port numbers, and Frigate will refuse to start otherwise. Requests arriving on the internal port are treated as authenticated admins, so pointing both at the same port would remove authentication from the external one.
-
-Nginx binds these ports when it starts, so port changes only take effect after Frigate restarts.
-
 :::
 
-### Customizing the Nginx configuration
-
-More advanced changes to Frigate's internal network configuration can be made by bind mounting your own `nginx.conf` into the container. For example:
-
-```yaml
-services:
-  frigate:
-    container_name: frigate
-    ...
-    volumes:
-      ...
-      - /path/to/your/nginx.conf:/usr/local/nginx/conf/nginx.conf
-```
-
 ## Base path
 
 By default, Frigate runs at the root path (`/`). However some setups require to run Frigate under a custom path prefix (e.g. `/frigate`), especially when Frigate is located behind a reverse proxy that requires path-based routing.
@@ -374,7 +326,7 @@ For example:
 ```
 services:
   frigate:
-    image: ghcr.io/blakeblackshear/frigate:stable
+    image: blakeblackshear/frigate:latest
     environment:
       - FRIGATE_BASE_PATH=/frigate
 ```
@@ -397,23 +349,17 @@ To do this:
 2. Update the `ffmpeg.path` in your Frigate config to `/config/custom-ffmpeg`.
 3. Restart Frigate and the custom version will be used if the steps above were done correctly.
 
-Both binaries have to be executable by Frigate's unprivileged runtime user, so `chmod 755` them after extracting. The startup ownership sweep runs only once, so anything you add to `/config` later keeps whatever ownership and mode you gave it.
-
-There is one exception, and it only affects [`FRIGATE_ROOT_SERVICES`](/configuration/non_root#keeping-individual-services-root) listing `frigate`. That mode runs Frigate as root while still handing `/config` to the unprivileged runtime user, so anything running as that user could swap the binary and gain root. A build inside any of Frigate's writable volumes (`/config`, `/media/frigate`, the cache and shm dirs) is ignored there and the bundled one is used, with a warning in the log. Keep the build somewhere root-owned (any absolute `ffmpeg.path` works, so a read-only bind mount such as `/opt/custom-ffmpeg` is enough) if you need both. The default mode and `FRIGATE_RUN_AS_ROOT=true` are unaffected and behave exactly as they always have.
-
 ### Custom go2rtc version
 
-Frigate currently includes go2rtc v1.9.14, there may be certain cases where you want to run a different version of go2rtc.
+Frigate currently includes go2rtc v1.9.13, there may be certain cases where you want to run a different version of go2rtc.
 
 To do this:
 
 1. Download the go2rtc build to the `/config` folder.
 2. Rename the build to `go2rtc`.
-3. Give `go2rtc` execute permission for all users (`chmod 755`). It runs as its own `go2rtc` user, which doesn't own the file, so owner-only execute permission isn't enough.
+3. Give `go2rtc` execute permission.
 4. Restart Frigate and the custom version will be used, you can verify by checking go2rtc logs.
 
-The same exception applies, and again only to [`FRIGATE_ROOT_SERVICES`](/configuration/non_root#keeping-individual-services-root) listing `go2rtc`: the binary is ignored there and the embedded one is used, with a warning in the log. Unlike `ffmpeg.path`, the go2rtc binary location is not configurable, so there is no outside-`/config` alternative. Use `FRIGATE_RUN_AS_ROOT=true` instead if you need both a custom go2rtc build and root. The default mode and the escape hatch both honor `/config/go2rtc` exactly as they always have.
-
 ## Validating your config.yml file updates
 
 When frigate starts up, it checks whether your config file is valid, and if it is not, the process exits. To minimize interruptions when updating your config, you have three options -- you can edit the config via the WebUI which has built in validation, use the config API, or you can validate on the command line using the frigate docker container.

docs/docs/configuration/advanced/analytics.md

@@ -1,41 +0,0 @@
----
-id: analytics
-title: Anonymous Analytics
----
-
-import AnalyticsFields from "@site/src/components/AnalyticsFields";
-import NavPath from "@site/src/components/NavPath";
-
-Frigate can send one anonymous usage report a day. The reports show the maintainers which hardware to support, which features people use, and how releases perform. Sharing is off until you turn it on.
-
-## Turning it on
-
-Enable **Share anonymous analytics** at <NavPath path="Settings > System > Telemetry" />, or set it in your config:
-
-```yaml
-telemetry:
-  analytics: true
-```
-
-The same page has a **Preview the report** button that shows exactly what the next report contains.
-
-## How it's sent
-
-- Once a day, as a JSON POST to `https://analytics.frigate.video/report`
-- The server looks up your country and region from your IP address and never stores the address
-- Raw reports are kept for 60 days; only aggregate totals are published
-- A random install ID, stored in `/config/.analytics.json`, keeps your install from being counted twice. Turning sharing off deletes it
-
-## What's never sent
-
-- Camera, zone, group, profile, or user names
-- Object labels, face names, or license plate text
-- IP addresses, hostnames, URLs, or stream paths
-- Credentials or API keys
-- Events, recordings, or anything from them
-
-## Every field
-
-Fields marked public appear in the published totals. The machine-readable schema is [frigate-analytics-schema.json](pathname:///frigate-analytics-schema.json).
-
-<AnalyticsFields />

docs/docs/configuration/audio_detectors.md

@@ -54,7 +54,7 @@ The ffmpeg process for capturing audio will be a separate connection to the came
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > Camera configuration > Streams (FFmpeg)" /> and add an input with the `audio` role pointing to a stream that includes audio.
+Navigate to <NavPath path="Settings > Camera configuration > FFmpeg" /> and add an input with the `audio` role pointing to a stream that includes audio.
 
 </TabItem>
 <TabItem value="yaml">
@@ -78,7 +78,7 @@ cameras:
 
 ### Configuring Minimum Volume
 
-The audio detector uses volume levels in the same way that motion in a camera feed is used for object detection. This means that Frigate will not run audio detection unless the audio volume is above the configured level in order to reduce resource usage. Audio levels can vary widely between camera models so it is important to run tests to see what volume levels are. The [Debug view](/usage/live#the-single-camera-view) in the Frigate UI has an Audio tab for cameras that have the `audio` role assigned where a graph and the current levels are displayed. The `min_volume` parameter should be set to the minimum the `RMS` level required to run audio detection.
+The audio detector uses volume levels in the same way that motion in a camera feed is used for object detection. This means that Frigate will not run audio detection unless the audio volume is above the configured level in order to reduce resource usage. Audio levels can vary widely between camera models so it is important to run tests to see what volume levels are. The Debug view in the Frigate UI has an Audio tab for cameras that have the `audio` role assigned where a graph and the current levels are is displayed. The `min_volume` parameter should be set to the minimum the `RMS` level required to run audio detection.
 
 :::tip
 
@@ -88,7 +88,7 @@ Volume is considered motion for recordings, this means when the `record -> retai
 
 ### Configuring Audio Events
 
-The included audio model has over [500 different types](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt) of audio that can be detected, many of which are not practical. By default `bark`, `fire_alarm`, `speech`, and `yell` are enabled but these can be customized.
+The included audio model has over [500 different types](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt) of audio that can be detected, many of which are not practical. By default `bark`, `fire_alarm`, `scream`, `speech`, and `yell` are enabled but these can be customized.
 
 <ConfigTabs>
 <TabItem value="ui">
@@ -107,6 +107,7 @@ audio:
   listen:
     - bark
     - fire_alarm
+    - scream
     - speech
     - yell
 ```
@@ -114,97 +115,9 @@ audio:
 </TabItem>
 </ConfigTabs>
 
-#### Grouping Audio Labels
-
-Related audio classes can be grouped under one label by mapping their numeric
-class IDs to the same name. Add the grouped name to `listen` and use it for any
-corresponding filter:
-
-```yaml
-audio:
-  listen:
-    - dogs
-  labelmap:
-    69: dogs # dog
-    70: dogs # bark
-    75: dogs # whimper_dog
-  filters:
-    dogs:
-      threshold: 0.8
-```
-
-Class IDs are zero-based indices in
-[`audio-labelmap.txt`](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt),
-so each ID is one less than the displayed file line number.
-Audio label mappings are separate from the object detector's `model.labelmap`.
-
-### Common Audio Labels
-
-The labelmap includes hundreds of sound types. The labels below are the ones most users may find practical, grouped by what they're typically used for. Use the exact label string from the left column in your `listen` config, or search for the label in the Frigate UI directly.
-
-Some labels cover several related sounds: `yell` is triggered by shouting, yelling, children shouting, and screaming; `crying` covers baby cries, sobbing, and whimpering; and `speech` covers ordinary talking and conversation.
-
-**Safety and security**
-
-| Label            | Detects                            |
-| ---------------- | ---------------------------------- |
-| `yell`           | Shouting, yelling, screaming       |
-| `fire_alarm`     | Fire and smoke alarm sirens        |
-| `smoke_detector` | Smoke detector beeps               |
-| `alarm`          | General alarm sounds               |
-| `car_alarm`      | Car alarms                         |
-| `siren`          | Emergency vehicle and civil sirens |
-| `glass`          | Glass clinking                     |
-| `shatter`        | Breaking glass                     |
-| `breaking`       | Something breaking                 |
-| `gunshot`        | Gunshots                           |
-| `explosion`      | Explosions                         |
-
-**People and activity**
-
-| Label       | Detects                  |
-| ----------- | ------------------------ |
-| `speech`    | Talking and conversation |
-| `laughter`  | Laughing                 |
-| `crying`    | Baby crying and sobbing  |
-| `cough`     | Coughing                 |
-| `footsteps` | Footsteps and walking    |
-| `knock`     | Knocking on a door       |
-| `doorbell`  | Doorbell                 |
-| `ding-dong` | Doorbell chime           |
-
-**Pets and animals**
-
-| Label      | Detects          |
-| ---------- | ---------------- |
-| `bark`     | Dog barking      |
-| `dog`      | Other dog sounds |
-| `howl`     | Howling          |
-| `growling` | Growling         |
-| `meow`     | Cat meowing      |
-| `cat`      | Other cat sounds |
-| `hiss`     | Hissing          |
-
-**Vehicles and driveway**
-
-| Label             | Detects              |
-| ----------------- | -------------------- |
-| `car`             | Passing cars         |
-| `honk`            | Car horns            |
-| `truck`           | Trucks               |
-| `reversing_beeps` | Vehicle backup beeps |
-| `motorcycle`      | Motorcycles          |
-| `engine_starting` | Engines starting     |
-
-:::tip
-
-Frequently-heard labels like `speech` can generate a lot of events, and each event could save a snapshot and recording based on your configuration, so start with a focused set and expand from there. The defaults (`bark`, `fire_alarm`, `speech`, `yell`) plus a few of the safety labels above cover most needs. See the [full audio labelmap](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt) or the Frigate UI for every available type.
-
-:::
-
 ### Audio Transcription
 
-Frigate supports fully local audio transcription using either `sherpa-onnx` or OpenAI's open-source Whisper models via `faster-whisper`, and can alternatively offload transcription to a [GenAI provider](#genai-provider). The goal of this feature is to support Semantic Search for `speech` audio events. Frigate is not intended to act as a continuous, fully-automatic speech transcription service. Automatically transcribing all speech (or queuing many audio events for transcription) requires substantial CPU (or GPU) resources and is impractical on most systems. For this reason, transcriptions for events are initiated manually from the UI or the API rather than being run continuously in the background.
+Frigate supports fully local audio transcription using either `sherpa-onnx` or OpenAI's open-source Whisper models via `faster-whisper`. The goal of this feature is to support Semantic Search for `speech` audio events. Frigate is not intended to act as a continuous, fully-automatic speech transcription service — automatically transcribing all speech (or queuing many audio events for transcription) requires substantial CPU (or GPU) resources and is impractical on most systems. For this reason, transcriptions for events are initiated manually from the UI or the API rather than being run continuously in the background.
 
 :::info
 
@@ -224,7 +137,6 @@ To enable transcription, configure it globally and optionally disable for specif
 **Global:** Navigate to <NavPath path="Settings > Enrichments > Audio transcription" />.
 
 - Set **Enable audio transcription** to on
-- Set **Audio transcription model or GenAI provider name** to `whisper` for Frigate's built-in local models, or to the name of a GenAI provider
 - Set **Transcription device** to the desired device
 - Set **Model size** to the desired size
 
@@ -236,7 +148,6 @@ To enable transcription, configure it globally and optionally disable for specif
 ```yaml
 audio_transcription:
   enabled: True
-  model: whisper
   device: ...
   model_size: ...
 ```
@@ -265,92 +176,24 @@ The optional config parameters that can be set at the global level include:
 - **`enabled`**: Enable or disable the audio transcription feature.
   - Default: `False`
   - It is recommended to only configure the features at the global level, and enable it at the individual camera level.
-- **`model`**: The transcription backend.
-  - Default: `whisper`
-  - `whisper` uses Frigate's built-in local models, described by `device` and `model_size` below.
-  - Any other value must name a key in your `genai` config whose entry has `transcribe` in its `roles`. See [GenAI Provider](#genai-provider).
 - **`device`**: Device to use to run transcription and translation models.
   - Default: `CPU`
   - This can be `CPU` or `GPU`. The `sherpa-onnx` models are lightweight and run on the CPU only. The `whisper` models can run on GPU but are only supported on CUDA hardware.
-  - Ignored when `model` names a GenAI provider.
 - **`model_size`**: The size of the model used for live transcription.
   - Default: `small`
   - This can be `small` or `large`. The `small` setting uses `sherpa-onnx` models that are fast, lightweight, and always run on the CPU but are not as accurate as the `whisper` model.
-  - This config option applies to **live transcription only**. With `model: whisper`, recorded `speech` events always use a different `whisper` model (and can be accelerated for CUDA hardware if available with `device: GPU`).
+  - This config option applies to **live transcription only**. Recorded `speech` events will always use a different `whisper` model (and can be accelerated for CUDA hardware if available with `device: GPU`).
-  - Ignored when `model` names a GenAI provider.
+- **`language`**: Defines the language used by `whisper` to translate `speech` audio events (and live audio only if using the `large` model).
-- **`language`**: Defines the language used to transcribe and translate `speech` audio events (and live audio only if using the `large` model or a GenAI provider).
+  - Default: `en`
-  - Default: `auto`
+  - You must use a valid [language code](https://github.com/openai/whisper/blob/main/whisper/tokenizer.py#L10).
-  - `auto` lets the model detect the language itself, which most models do well. Set an explicit language only if detection is picking the wrong one.
-  - Otherwise you must use a valid [language code](https://github.com/openai/whisper/blob/main/whisper/tokenizer.py#L10).
   - Transcriptions for `speech` events are translated.
   - Live audio is translated only if you are using the `large` model. The `small` `sherpa-onnx` model is English-only.
 
-The only field that is valid at the camera level is `enabled`. In particular `model` is global only: the transcription backend is a process-wide resource shared by every camera.
+The only field that is valid at the camera level is `enabled`.
-
-#### GenAI Provider
-
-Frigate can send audio to a GenAI provider for transcription when that provider has the `transcribe` role. This is useful if you already run a GenAI provider, or if you do not have the CPU/GPU headroom for a local whisper model. Supported providers are **OpenAI**, **Azure OpenAI**, **Gemini**, and **llama.cpp** with an audio-capable model (a dedicated ASR model such as Qwen3-ASR, or a general multimodal model that accepts audio). Ollama is not supported as it has no audio input.
-
-To use a GenAI provider for audio transcription:
-
-1. Configure a GenAI provider with `transcribe` in its `roles`.
-2. Set the audio transcription model to that GenAI config key (e.g. `whisper_cloud`).
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Enrichments > Audio transcription" />.
-
-| Field                                                | Description                                                                                              |
-| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
-| **Audio transcription model or GenAI provider name** | Set to the GenAI config key (e.g. `whisper_cloud`) to use a configured GenAI provider for transcription |
-
-The GenAI provider must also be configured with the `transcribe` role under <NavPath path="Settings > Enrichments > Generative AI" />.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-genai:
-  whisper_cloud:
-    provider: openai
-    api_key: your-api-key
-    model: gpt-transcribe
-    roles:
-      - transcribe
-
-audio_transcription:
-  enabled: True
-  model: whisper_cloud
-  language: en
-```
-
-</TabItem>
-</ConfigTabs>
-
-:::warning
-
-**Give `transcribe` its own `genai` entry.** A `genai` entry has a single `model` string that is shared by every role it holds, so `roles: [descriptions, transcribe]` would send the same model name to both the chat endpoint and the transcription endpoint. Transcription models and chat models are almost never the same model, so define a dedicated entry as shown above.
-
-:::
-
-:::warning
-
-**Live transcription against a metered provider is billed continuously.** In live mode Frigate uploads an overlapping ~2 second window of audio roughly once per second, per camera, for as long as audio stays above that camera's `audio.min_volume`. Windows below that threshold are never uploaded, which is what keeps a quiet camera near zero requests, but a camera pointed at a busy street will keep sending.
-
-Three things keep this opt-in: `transcribe` is not one of the default roles, live transcription is off by default, and the volume gate suppresses silence. Transcription of recorded `speech` events is unaffected - it remains a manual, one-request-per-event action.
-
-:::
-
-`device` and `model_size` have no effect on this path and no local model is ever downloaded.
-
-`language` defaults to `auto`, which sends no language hint and lets the model detect it. Most audio models detect language well, so leave it on `auto` unless detection is picking the wrong one.
-
-When set explicitly, it is sent as the transcription endpoint's native `language` parameter for OpenAI, Azure, and llama.cpp, and as part of the prompt for Gemini. This matters for dedicated ASR models such as Qwen3-ASR: they read the prompt as contextual biasing rather than as an instruction, so a language named in the prompt is ignored, while the endpoint parameter is honored.
 
 #### Live transcription
 
-The single camera Live view in the Frigate UI supports live transcription of audio for streams defined with the `audio` role. Use the Enable/Disable Live Audio Transcription button/switch to toggle transcription processing, or toggle it outside of the UI with the [`frigate/<camera_name>/audio_transcription/set`](/integrations/mqtt#frigatecamera_nameaudio_transcriptionset) MQTT topic or the HTTP API. When speech is heard, the UI will display a black box over the top of the camera stream with text. The MQTT topic `frigate/<camera_name>/audio/transcription` will also be updated in real-time with transcribed text.
+The single camera Live view in the Frigate UI supports live transcription of audio for streams defined with the `audio` role. Use the Enable/Disable Live Audio Transcription button/switch to toggle transcription processing. When speech is heard, the UI will display a black box over the top of the camera stream with text. The MQTT topic `frigate/<camera_name>/audio/transcription` will also be updated in real-time with transcribed text.
 
 Results can be error-prone due to a number of factors, including:
 
@@ -362,13 +205,11 @@ Results can be error-prone due to a number of factors, including:
 
 For speech sources close to the camera with minimal background noise, use the `small` model.
 
-A [GenAI provider](#genai-provider) is generally the most accurate option for live transcription, at the cost of a network round trip per window. That round trip has to stay under about a second to keep up with the audio; if it does not, Frigate drops the oldest buffered audio rather than letting the backlog grow.
-
 If you have CUDA hardware, you can experiment with the `large` `whisper` model on GPU. Performance is not quite as fast as the `sherpa-onnx` `small` model, but live transcription is far more accurate. Using the `large` model with CPU will likely be too slow for real-time transcription.
 
 #### Transcription and translation of `speech` audio events
 
-Any `speech` events in Explore can be transcribed and/or translated through the Transcribe button (the microphone icon) in the Tracked Object Details pane.
+Any `speech` events in Explore can be transcribed and/or translated through the Transcribe button in the Tracked Object Details pane.
 
 In order to use transcription and translation for past events, you must enable audio detection and define `speech` as an audio type to listen for. To have `speech` events translated into the language of your choice, set the `language` config parameter with the correct [language code](https://github.com/openai/whisper/blob/main/whisper/tokenizer.py#L10).
 
@@ -380,7 +221,7 @@ Only one `speech` event may be transcribed at a time. Frigate does not automatic
 
 :::
 
-With `model: whisper`, recorded `speech` events always use a `whisper` model, regardless of the `model_size` config setting. Without a supported Nvidia GPU, generating transcriptions for longer `speech` events may take a fair amount of time, so be patient. With a [GenAI provider](#genai-provider), the recorded clip is sent to the provider instead and no local model is used.
+Recorded `speech` events will always use a `whisper` model, regardless of the `model_size` config setting. Without a supported Nvidia GPU, generating transcriptions for longer `speech` events may take a fair amount of time, so be patient.
 
 #### FAQ
 
@@ -390,7 +231,7 @@ With `model: whisper`, recorded `speech` events always use a `whisper` model, re
 
    Because transcription is **serialized (one event at a time)** and speech events can be generated far faster than they can be processed, an auto-transcribe toggle would very quickly create an ever-growing backlog and degrade core functionality. For the amount of engineering and risk involved, it adds **very little practical value** for the majority of deployments, which are often on low-powered, edge hardware.
 
-   If you hear speech that's actually important and worth saving/indexing for the future, **just press the transcribe button (the microphone icon) in Explore** on that specific `speech` event - that keeps things explicit, reliable, and under your control.
+   If you hear speech that's actually important and worth saving/indexing for the future, **just press the transcribe button in Explore** on that specific `speech` event - that keeps things explicit, reliable, and under your control.
 
    Other options are being considered for future versions of Frigate to add transcription options that support external `whisper` Docker containers. A single transcription service could then be shared by Frigate and other applications (for example, Home Assistant Voice), and run on more powerful machines when available.
 

docs/docs/configuration/authentication.md

@@ -22,9 +22,7 @@ The following ports are available to access the Frigate web UI.
 
 ## Onboarding
 
-On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time.
+On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time under Settings > Users.
-
-On a new install the [setup wizard](../guides/getting_started.md#configuring-frigate) offers this as its first step, along with creating accounts for anyone else who needs access. You can also do both at any time under <NavPath path="Settings > Users" />.
 
 ## Resetting admin password
 
@@ -93,7 +91,7 @@ auth:
 
 ## Session Length
 
-The default session length for user authentication in Frigate is 24 hours. This setting determines how long a user's authenticated session remains active before a token refresh is required. Otherwise, the user will need to log in again.
+The default session length for user authentication in Frigate is 24 hours. This setting determines how long a user's authenticated session remains active before a token refresh is required — otherwise, the user will need to log in again.
 
 While the default provides a balance of security and convenience, you can customize this duration to suit your specific security requirements and user experience preferences. The session length is configured in seconds.
 
@@ -143,7 +141,7 @@ Changing the secret will invalidate current tokens.
 
 ## Proxy configuration
 
-Frigate can be configured to leverage features of common upstream authentication proxies such as Authelia, Authentik, oauth2_proxy, or traefik-forward-auth. Frigate does not implement OIDC, SAML, or LDAP natively; as an NVR focused on recording and object detection, it relies on robust, battle-tested proxies to handle those protocols and passes the authenticated user and role through via headers (see below).
+Frigate can be configured to leverage features of common upstream authentication proxies such as Authelia, Authentik, oauth2_proxy, or traefik-forward-auth.
 
 If you are leveraging the authentication of an upstream proxy, you likely want to disable Frigate's authentication as there is no correspondence between users in Frigate's database and users authenticated via the proxy. Optionally, if communication between the reverse proxy and Frigate is over an untrusted network, you should set an `auth_secret` in the `proxy` config and configure the proxy to send the secret value as a header named `X-Proxy-Secret`. Assuming this is an untrusted network, you will also want to [configure a real TLS certificate](tls.md) to ensure the traffic can't simply be sniffed to steal the secret.
 
@@ -216,9 +214,9 @@ A default role can be provided. Any value in the mapped `role` header will overr
 
 Navigate to <NavPath path="Settings > System > Proxy" /> and set the default role.
 
-| Field            | Description                                                                                          |
+| Field            | Description                                                   |
-| ---------------- | ---------------------------------------------------------------------------------------------------- |
+| ---------------- | ------------------------------------------------------------- |
-| **Default role** | Fallback role when no role header is present (e.g., `viewer`), or `None (deny access)` to reject unmapped users |
+| **Default role** | Fallback role when no role header is present (e.g., `viewer`) |
 
 </TabItem>
 <TabItem value="yaml">
@@ -232,14 +230,6 @@ proxy:
 </TabItem>
 </ConfigTabs>
 
-Setting `default_role` to `none` denies access instead of falling back to a role. Any proxy-authenticated user whose headers do not match an explicit `role_map` entry receives a 403 response. This is useful when the upstream proxy authenticates a broader set of users than should reach Frigate, so that only mapped groups are allowed in.
-
-```yaml
-proxy:
-  ...
-  default_role: none
-```
-
 ## Role mapping
 
 In some environments, upstream identity providers (OIDC, SAML, LDAP, etc.) do not pass a Frigate-compatible role directly, but instead pass one or more group claims. To handle this, Frigate supports a `role_map` that translates upstream group names into Frigate's internal roles (`admin`, `viewer`, or custom). This is configurable via YAML in the configuration file:
@@ -265,26 +255,13 @@ In this example:
 - If the proxy passes a role header containing `sysadmins` or `access-level-security`, the user is assigned the `admin` role.
 - If the proxy passes a role header containing `camera-viewer`, the user is assigned the `viewer` role.
 - If the proxy passes a role header containing `operators`, the user is assigned the `operator` custom role.
-- If no mapping matches, Frigate falls back to `default_role` if configured, or denies access if `default_role` is `none`.
+- If no mapping matches, Frigate falls back to `default_role` if configured.
 - If `role_map` is not defined, Frigate assumes the role header directly contains `admin`, `viewer`, or a custom role name.
 
 **Note on matching semantics:**
 
 - Admin precedence: if the `admin` mapping matches, Frigate resolves the session to `admin` to avoid accidental downgrade when a user belongs to multiple groups (for example both `admin` and `viewer` groups).
 
-:::note
-
-If a user isn't getting the role you expect, enable debug logging to see exactly what headers Frigate is receiving from your proxy:
-
-```yaml
-logger:
-  default: info
-  logs:
-    frigate.api.auth: debug
-```
-
-:::
-
 #### Port Considerations
 
 **Authenticated Port (8971)**
@@ -339,7 +316,7 @@ Frigate supports user roles to control access to certain features in the UI and
 
 - **admin**: Full access to all features, including user management and configuration.
 - **viewer**: Read-only access to the UI and API, including viewing cameras, review items, and historical footage. Configuration editor and settings in the UI are inaccessible.
-- **Custom Roles**: Arbitrary role names (alphanumeric, dots/underscores) with specific camera permissions. These extend the system for granular access (e.g., "operator" for select cameras). The names `admin`, `viewer`, and `none` are reserved and cannot be used.
+- **Custom Roles**: Arbitrary role names (alphanumeric, dots/underscores) with specific camera permissions. These extend the system for granular access (e.g., "operator" for select cameras).
 
 ### Custom Roles and Camera Access
 

docs/docs/configuration/autotracking.md

@@ -6,7 +6,6 @@ title: Camera Autotracking
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
-import FaqItem from "@site/src/components/FaqItem";
 
 An ONVIF-capable, PTZ (pan-tilt-zoom) camera that supports relative movement within the field of view (FOV) can be configured to automatically track moving objects and keep them in the center of the frame.
 
@@ -162,13 +161,13 @@ Every PTZ camera is different, so autotracking may not perform ideally in every
 
 The object tracker in Frigate estimates the motion of the PTZ so that tracked objects are preserved when the camera moves. In most cases 5 fps is sufficient, but if you plan to track faster moving objects, you may want to increase this slightly. Higher frame rates (> 10fps) will only slow down Frigate and the motion estimator and may lead to dropped frames, especially if you are using experimental zooming.
 
-A fast [detector](object_detectors.md) is recommended. CPU detectors will not perform well or won't work at all. You can watch Frigate's [debug viewer](/usage/live#the-single-camera-view) for your camera to see a thicker colored box around the object currently being autotracked.
+A fast [detector](object_detectors.md) is recommended. CPU detectors will not perform well or won't work at all. You can watch Frigate's debug viewer for your camera to see a thicker colored box around the object currently being autotracked.
 
 ![Autotracking Debug View](/img/autotracking-debug.gif)
 
 A full-frame zone in `required_zones` is not recommended, especially if you've calibrated your camera and there are `movement_weights` defined in the configuration file. Frigate will continue to autotrack an object that has entered one of the `required_zones`, even if it moves outside of that zone.
 
-Some users have found it helpful to adjust the zone `inertia` value. See the [configuration reference](advanced/reference.md).
+Some users have found it helpful to adjust the zone `inertia` value. See the [configuration reference](index.md).
 
 ## Zooming
 
@@ -188,96 +187,30 @@ In security and surveillance, it's common to use "spotter" cameras in combinatio
 
 ## Troubleshooting and FAQ
 
-### Camera Compatibility
+### The autotracker loses track of my object. Why?
-
-<FaqItem id="which-ptz-camera-should-i-use-for-autotracking" question="Which PTZ camera should I use for autotracking?">
-
-See the community-maintained list of [ONVIF PTZ camera recommendations](cameras.md#onvif-ptz-camera-recommendations) for cameras and brands reported to work (and not work) with autotracking. This is not an exhaustive list that is frequently updated, so other cameras not listed may also work well. Frigate's autotracking was developed with a Dahua SD1A404XB-GNR (now sold as the EmpireTech PTZ1A4M-4X-S2), and Dahua / EmpireTech PTZs are the most consistently reported as working well.
-
-When comparing models:
-
-- Verify ONVIF support first. See [Checking ONVIF camera support](#checking-onvif-camera-support) above.
-- Favor a camera with a fast PTZ motor. Cameras with slow motors may fail [calibration](#calibration) and will struggle to keep up with objects that move across the field of view quickly.
-
-</FaqItem>
-
-<FaqItem id="does-autotracking-work-with-reolink-ptz-cameras" question="Does autotracking work with Reolink PTZ cameras?">
-
-No. Reolink cameras (including the TrackMix series) lack the ONVIF FOV RelativeMove firmware support that Frigate's autotracker requires, so autotracking will not work with any current Reolink PTZ. Their video streams and basic PTZ controls still work in Frigate. If you want object tracking on a Reolink PTZ, you will need to use the tracking feature built into the camera's firmware, which is proprietary and operates independently of Frigate.
-
-</FaqItem>
-
-<FaqItem id="im-seeing-an-error-in-the-logs-that-my-camera-is-still-in-onvif-moving-status-what-does-this-mean" question={"I'm seeing an error in the logs that my camera \"is still in ONVIF 'MOVING' status.\" What does this mean?"}>
-
-There are two possible known reasons for this (and perhaps others yet unknown): a slow PTZ motor or buggy camera firmware. Frigate uses an ONVIF parameter provided by the camera, `MoveStatus`, to determine when the PTZ's motor is moving or idle. According to some users, Hikvision PTZs (even with the latest firmware), are not updating this value after PTZ movement. Unfortunately there is no workaround to this bug in Hikvision firmware, so autotracking will not function correctly and should be disabled in your config. This may also be the case with other non-Hikvision cameras utilizing Hikvision firmware, such as some Annke models. In rare cases the vendor may provide fixed firmware on request; for example, Annke has supplied firmware that resolves this for the CZ504 (see the [camera recommendations list](cameras.md#onvif-ptz-camera-recommendations)).
-
-</FaqItem>
-
-<FaqItem id="calibration-seems-to-have-completed-but-the-camera-is-not-actually-moving-to-track-my-object-why" question="Calibration seems to have completed, but the camera is not actually moving to track my object. Why?">
-
-Some cameras have firmware that reports that FOV RelativeMove, the ONVIF command that Frigate uses for autotracking, is supported. However, if the camera does not pan or tilt when an object comes into the required zone, your camera's firmware does not actually support FOV RelativeMove. One such camera is the Uniview IPC672LR-AX4DUPK. It actually moves its zoom motor instead of panning and tilting and does not follow the ONVIF standard whatsoever.
-
-</FaqItem>
-
-### Calibration Issues
-
-<FaqItem id="i-tried-calibrating-my-camera-but-the-logs-show-that-it-is-stuck-at-0-and-frigate-is-not-starting-up" question="I tried calibrating my camera, but the logs show that it is stuck at 0% and Frigate is not starting up.">
-
-This is often caused by the same reason as the "MOVING" status error above - the `MoveStatus` ONVIF parameter is not changing due to a bug in your camera's firmware. Also, see the note above: Frigate's web UI and all other cameras will be unresponsive while calibration is in progress. This is expected and normal. But if you don't see log entries every few seconds for calibration progress, your camera is not compatible with autotracking.
-
-</FaqItem>
-
-<FaqItem id="frigate-reports-an-error-saying-that-calibration-has-failed-why" question="Frigate reports an error saying that calibration has failed. Why?">
-
-Calibration measures the amount of time it takes for Frigate to make a series of movements with your PTZ. This error message is recorded in the log if these values are too high for Frigate to support calibrated autotracking. This is often the case when your camera's motor or network connection is too slow or your camera's firmware doesn't report the motor status in a timely manner.
-
-Some things to try:
-
-- If your camera's firmware has a PTZ or motor speed setting, set it to the fastest available speed and calibrate again.
-- Run without calibration: remove the `movement_weights` line from your config, set `calibrate_on_startup` to `False`, and restart.
-
-If calibration consistently fails, this often means your camera's motor is too slow and autotracking will behave unpredictably or won't be able to keep up with moving objects.
-
-</FaqItem>
-
-<FaqItem id="autotracking-is-erratic-or-moves-the-camera-in-the-wrong-direction" question="Autotracking is erratic, moves the camera in the wrong direction, or zooms past my object. Why?">
-
-Frigate uses the `movement_weights` measured during calibration to predict how far the camera needs to move to keep an object centered, so inaccurate values produce movements that don't seem to make sense: overshooting, moving the opposite direction, or zooming in on an object's last known position and losing it entirely. This is almost always a calibration issue.
-
-- Remove the `movement_weights` entry from your config and restart Frigate to run without calibration. If tracking improves, try recalibrating.
-- Recalibrate several times. The `movement_weights` values should be close to each other after each run. If they vary significantly between runs, your camera may not be reporting its motor status reliably, and you may get better results without calibration.
-- If you are using zooming, a high `zoom_factor` can cause the camera to zoom in too far and lose the object. Try a lower value.
-
-Remember to recalibrate whenever you change your `return_preset`, change your camera's detect `fps`, or enable zooming after calibrating with it disabled.
-
-</FaqItem>
-
-### Tracking Behavior
-
-<FaqItem id="the-autotracker-loses-track-of-my-object-why" question="The autotracker loses track of my object. Why?">
 
 There are many reasons this could be the case. If you are using experimental zooming, your `zoom_factor` value might be too high, the object might be traveling too quickly, the scene might be too dark, there are not enough details in the scene (for example, a PTZ looking down on a driveway or other monotone background without a sufficient number of hard edges or corners), or the scene is otherwise less than optimal for Frigate to maintain tracking.
 
 Your camera's shutter speed may also be set too low so that blurring occurs with motion. Check your camera's firmware to see if you can increase the shutter speed.
 
-Watching Frigate's debug view can help to determine a possible cause. The autotracked object will have a thicker colored box around it. If the camera consistently zooms in on the object and then loses it, see [Autotracking is erratic, moves the camera in the wrong direction, or zooms past my object. Why?](#autotracking-is-erratic-or-moves-the-camera-in-the-wrong-direction) above.
+Watching Frigate's debug view can help to determine a possible cause. The autotracked object will have a thicker colored box around it.
 
-</FaqItem>
+### I'm seeing an error in the logs that my camera "is still in ONVIF 'MOVING' status." What does this mean?
 
-<FaqItem id="im-seeing-this-error-in-the-logs-autotracker-motion-estimator-couldnt-get-transformations-what-does-this-mean" question={"I'm seeing this error in the logs: \"Autotracker: motion estimator couldn't get transformations\". What does this mean?"}>
+There are two possible known reasons for this (and perhaps others yet unknown): a slow PTZ motor or buggy camera firmware. Frigate uses an ONVIF parameter provided by the camera, `MoveStatus`, to determine when the PTZ's motor is moving or idle. According to some users, Hikvision PTZs (even with the latest firmware), are not updating this value after PTZ movement. Unfortunately there is no workaround to this bug in Hikvision firmware, so autotracking will not function correctly and should be disabled in your config. This may also be the case with other non-Hikvision cameras utilizing Hikvision firmware.
+
+### I tried calibrating my camera, but the logs show that it is stuck at 0% and Frigate is not starting up.
+
+This is often caused by the same reason as above - the `MoveStatus` ONVIF parameter is not changing due to a bug in your camera's firmware. Also, see the note above: Frigate's web UI and all other cameras will be unresponsive while calibration is in progress. This is expected and normal. But if you don't see log entries every few seconds for calibration progress, your camera is not compatible with autotracking.
+
+### I'm seeing this error in the logs: "Autotracker: motion estimator couldn't get transformations". What does this mean?
 
 To maintain object tracking during PTZ moves, Frigate tracks the motion of your camera based on the details of the frame. If you are seeing this message, it could mean that your `zoom_factor` may be set too high, the scene around your detected object does not have enough details (like hard edges or color variations), or your camera's shutter speed is too slow and motion blur is occurring. Try reducing `zoom_factor`, finding a way to alter the scene around your object, or changing your camera's shutter speed.
 
-</FaqItem>
+### Calibration seems to have completed, but the camera is not actually moving to track my object. Why?
 
-<FaqItem id="why-does-object-detection-pause-briefly-when-the-camera-moves" question="Why does object detection pause briefly when the camera moves?">
+Some cameras have firmware that reports that FOV RelativeMove, the ONVIF command that Frigate uses for autotracking, is supported. However, if the camera does not pan or tilt when an object comes into the required zone, your camera's firmware does not actually support FOV RelativeMove. One such camera is the Uniview IPC672LR-AX4DUPK. It actually moves its zoom motor instead of panning and tilting and does not follow the ONVIF standard whatsoever.
 
-When the PTZ moves, the entire frame changes at once. Frigate's motion detection treats sudden scene-wide changes (like a lightning flash, an infrared mode switch, or a camera move) specially and pauses detection momentarily until the scene stabilizes. This is expected and normal, and detection resumes shortly after the camera stops moving. If detection does not resume once the camera is stationary, use the [debug view](/usage/live#the-single-camera-view) to see what is happening.
+### Frigate reports an error saying that calibration has failed. Why?
 
-</FaqItem>
+Calibration measures the amount of time it takes for Frigate to make a series of movements with your PTZ. This error message is recorded in the log if these values are too high for Frigate to support calibrated autotracking. This is often the case when your camera's motor or network connection is too slow or your camera's firmware doesn't report the motor status in a timely manner. You can try running without calibration (just remove the `movement_weights` line from your config and restart), but if calibration fails, this often means that autotracking will behave unpredictably.
-
-<FaqItem id="can-i-turn-autotracking-on-and-off-automatically" question="Can I turn autotracking on and off automatically?">
-
-Yes. Autotracking can be toggled per camera at runtime over MQTT with the [`frigate/<camera_name>/ptz_autotracker/set`](../integrations/mqtt.md#frigatecamera_nameptz_autotrackerset) topic, and the [Home Assistant integration](../integrations/home-assistant.md) exposes a switch for it. This pairs well with the "spotter" camera automations described in [Usage applications](#usage-applications) above, for example only enabling autotracking at night or when nobody is home.
-
-</FaqItem>

docs/docs/configuration/birdseye.md

@@ -6,29 +6,19 @@ import NavPath from "@site/src/components/NavPath";
 
 In addition to Frigate's Live camera dashboard, Birdseye allows a portable heads-up view of your cameras to see what is going on around your property / space without having to watch all cameras that may have nothing happening. Birdseye allows specific modes that intelligently show and disappear based on what you care about.
 
-Birdseye can be viewed by adding the "Birdseye" camera to a Camera Group in the Web UI. Add a Camera Group by pressing the pencil icon in the sidebar on the Live page, and choose "Birdseye" as one of the cameras.
+Birdseye can be viewed by adding the "Birdseye" camera to a Camera Group in the Web UI. Add a Camera Group by pressing the "+" icon on the Live page, and choose "Birdseye" as one of the cameras.
 
 Birdseye can also be used in Home Assistant dashboards, cast to media devices, etc.
 
-:::note
-
-Each camera tile in Birdseye is composed from the frames of the stream assigned the `detect` role, so a camera's image quality in Birdseye matches its detect stream resolution rather than a higher-resolution recording stream. If a camera looks low quality in Birdseye, increasing the detect width and height (or assigning the `detect` role to a higher-resolution stream) is what affects it. See [setting up camera inputs](./cameras.md#setting-up-camera-inputs) for how roles are assigned.
-
-:::
-
 ## Birdseye Behavior
 
-### Birdseye Activity Types
+### Birdseye Modes
 
-Birdseye offers independent activity types that control when cameras are shown. Multiple activity types can be listed together.
+Birdseye offers different modes to customize which cameras show under which circumstances.
 
-- **continuous:** The camera is always included
+- **continuous:** All cameras are always included
-- **motion:** The camera is included when motion was detected within the last 30 seconds
+- **motion:** Cameras that have detected motion within the last 30 seconds are included
-- **all_objects:** The camera is included when a tracked object is present, active or stationary
+- **objects:** Cameras that have tracked an active object within the last 30 seconds are included
-- **alerts:** The camera is included while an alert review item is in progress
-- **detections:** The camera is included while a detection review item is in progress
-
-`alerts` and `detections` follow the review item's own lifetime, so the camera is removed as soon as the review item ends. Which objects qualify for each is set in [review configuration](./review.md).
 
 ### Custom Birdseye Icon
 
@@ -43,29 +33,27 @@ To include a camera in Birdseye view only for specific circumstances, or exclude
 
 **Global settings:** Navigate to <NavPath path="Settings > System > Birdseye" /> to configure the default Birdseye behavior for all cameras.
 
-**Per-camera overrides:** Navigate to <NavPath path="Settings > Camera configuration > Birdseye" /> to override the activity types or disable Birdseye for a specific camera.
+**Per-camera overrides:** Navigate to <NavPath path="Settings > Camera configuration > Birdseye" /> to override the mode or disable Birdseye for a specific camera.
 
-| Field                  | Description                                                |
+| Field | Description |
-| ---------------------- | ---------------------------------------------------------- |
+|-------|-------------|
-| **Enable Birdseye**    | Whether this camera appears in Birdseye view               |
+| **Enable Birdseye** | Whether this camera appears in Birdseye view |
-| **Activity types**     | Conditions that determine when to show the camera          |
+| **Tracking mode** | When to show the camera: `continuous`, `motion`, or `objects` |
 
 </TabItem>
 <TabItem value="yaml">
 
-```yaml {10-12,15-16}
+```yaml {8-10,12-14}
 # Include all cameras by default in Birdseye view
 birdseye:
   enabled: True
-  modes:
+  mode: continuous
-    - continuous
 
 cameras:
   front:
-    # Only include the "front" camera in Birdseye view when an alert is in progress
+    # Only include the "front" camera in Birdseye view when objects are detected
     birdseye:
-      modes:
+      mode: objects
-        - alerts
   back:
     # Exclude the "back" camera from Birdseye view
     birdseye:
@@ -77,15 +65,15 @@ cameras:
 
 ### Birdseye Inactivity
 
-By default birdseye shows all cameras that have had the configured activity in the last 30 seconds. This threshold can be configured, and applies to the `motion` and `all_objects` activity types only.
+By default birdseye shows all cameras that have had the configured activity in the last 30 seconds. This threshold can be configured.
 
 <ConfigTabs>
 <TabItem value="ui">
 
 Navigate to <NavPath path="Settings > System > Birdseye" />.
 
-| Field                    | Description                                                                 |
+| Field | Description |
-| ------------------------ | --------------------------------------------------------------------------- |
+|-------|-------------|
 | **Inactivity threshold** | Seconds of inactivity before a camera is hidden from Birdseye (default: 30) |
 
 </TabItem>
@@ -112,9 +100,9 @@ The resolution and aspect ratio of birdseye can be configured. Resolution will i
 
 Navigate to <NavPath path="Settings > System > Birdseye" />.
 
-| Field      | Description                                     |
+| Field | Description |
-| ---------- | ----------------------------------------------- |
+|-------|-------------|
-| **Width**  | Birdseye output width in pixels (default: 1280) |
+| **Width** | Birdseye output width in pixels (default: 1280) |
 | **Height** | Birdseye output height in pixels (default: 720) |
 
 </TabItem>
@@ -132,12 +120,12 @@ birdseye:
 
 ### Sorting cameras in the Birdseye view
 
-It is possible to override the order of cameras that are being shown in the Birdseye view. The order is set at the camera level (when using YAML).
+It is possible to override the order of cameras that are being shown in the Birdseye view. The order is set at the camera level.
 
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Birdseye" /> and in the **Camera order** field, use the drag handle next to each camera name to control the display order.
+Navigate to <NavPath path="Settings > Camera configuration > Birdseye" /> for each camera and set the **Position** field to control the display order.
 
 </TabItem>
 <TabItem value="yaml">
@@ -146,8 +134,7 @@ Navigate to <NavPath path="Settings > System > Birdseye" /> and in the **Camera
 # Include all cameras by default in Birdseye view
 birdseye:
   enabled: True
-  modes:
+  mode: continuous
-    - continuous
 
 cameras:
   front:
@@ -174,8 +161,8 @@ It is possible to limit the number of cameras shown on birdseye at one time. Whe
 
 Navigate to <NavPath path="Settings > System > Birdseye" />.
 
-| Field                    | Description                                                                         |
+| Field | Description |
-| ------------------------ | ----------------------------------------------------------------------------------- |
+|-------|-------------|
 | **Layout > Max cameras** | Maximum number of cameras shown at once (e.g., `1` for only the most active camera) |
 
 </TabItem>
@@ -200,8 +187,8 @@ By default birdseye tries to fit 2 cameras in each row and then double in size u
 
 Navigate to <NavPath path="Settings > System > Birdseye" />.
 
-| Field                       | Description                                              |
+| Field | Description |
-| --------------------------- | -------------------------------------------------------- |
+|-------|-------------|
 | **Layout > Scaling factor** | Camera scaling factor between 1.0 and 5.0 (default: 2.0) |
 
 </TabItem>

docs/docs/configuration/camera_specific.md

@@ -3,8 +3,6 @@ id: camera_specific
 title: Camera Specific Configurations
 ---
 
-import NavPath from "@site/src/components/NavPath";
-
 :::note
 
 This page makes use of presets of FFmpeg args. For more information on presets, see the [FFmpeg Presets](/configuration/ffmpeg_presets) page.
@@ -150,34 +148,19 @@ WEB Digest Algorithm  - MD5
 
 Reolink has many different camera models with inconsistently supported features and behavior. The below table shows a summary of various features and recommendations.
 
-| Camera Resolution | Camera Generation         | Recommended Stream Type           | Additional Notes                                                                            |
+| Camera Resolution | Camera Generation         | Recommended Stream Type           | Additional Notes                                                        |
-| ----------------- | ------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------- |
+| ----------------- | ------------------------- | --------------------------------- | ----------------------------------------------------------------------- |
-| 5MP or lower      | All                       | http-flv                          | Stream is h264                                                                              |
+| 5MP or lower      | All                       | http-flv                          | Stream is h264                                                          |
-| 6MP or higher     | Latest (ex: Duo3, CX-8##) | http-flv with ffmpeg 8.0, or rtsp | This uses the new http-flv-enhanced over H265 which requires ffmpeg 8.0 (Frigate's default) |
+| 6MP or higher     | Latest (ex: Duo3, CX-8##) | http-flv with ffmpeg 8.0, or rtsp | This uses the new http-flv-enhanced over H265 which requires ffmpeg 8.0 |
-| 6MP or higher     | Older (ex: RLC-8##)       | rtsp                              |                                                                                             |
+| 6MP or higher     | Older (ex: RLC-8##)       | rtsp                              |                                                                         |
 
-Frigate works much better with newer Reolink cameras that are setup with the below options:
+Frigate works much better with newer reolink cameras that are setup with the below options:
 
 If available, recommended settings are:
 
 - `On, fluency first` this sets the camera to CBR (constant bit rate)
 - `Interframe Space 1x` this sets the iframe interval to the same as the frame rate
 
-#### Setup via the Add Camera Wizard
-
-The [Add Camera Wizard](cameras.md#adding-a-camera-with-the-add-camera-wizard) is the recommended way to add a standard Reolink camera. Before starting, make sure [HTTP is enabled](https://support.reolink.com/articles/360003452893-How-to-Access-Reolink-Cameras-NVRs-Home-Hub-Locally-via-Web-Browsers/) in the camera's advanced network settings. The wizard uses the camera's HTTP API to determine its resolution and choose the recommended stream type from the table above.
-
-1. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />.
-2. Choose **Manual selection** as the stream detection method and select **Reolink** as the camera brand.
-3. The wizard queries the camera and automatically uses an http-flv stream for cameras 5MP and lower, or an RTSP stream for higher resolution cameras.
-4. In the validation step, enable **Use stream compatibility mode** for http-flv streams when the wizard recommends it.
-
-If you use the **Probe camera** method instead, the discovered stream URLs will be RTSP. For Reolink cameras where http-flv is recommended, the wizard will show a warning in the validation step.
-
-The wizard covers standard single-camera setups. For two way talk, cameras connected through a Reolink NVR, or audio transcoding for WebRTC live view, configure the camera manually as shown below.
-
-#### Manual configuration
-
 According to [this discussion](https://github.com/blakeblackshear/frigate/issues/3235#issuecomment-1135876973), the http video streams seem to be the most reliable for Reolink.
 
 Cameras connected via a Reolink NVR can be connected with the http stream, use `channel[0..15]` in the stream url for the additional channels.
@@ -192,7 +175,7 @@ Reolink's latest cameras support two way audio via go2rtc and other applications
 
 NOTE: The RTSP stream can not be prefixed with `ffmpeg:`, as go2rtc needs to handle the stream to support two way audio.
 
-Ensure [HTTP is enabled](https://support.reolink.com/articles/360003452893-How-to-Access-Reolink-Cameras-NVRs-Home-Hub-Locally-via-Web-Browsers/) in the camera's advanced network settings. To use two way talk with Frigate, see the [Live view documentation](/configuration/live#two-way-talk).
+Ensure HTTP is enabled in the camera's advanced network settings. To use two way talk with Frigate, see the [Live view documentation](/configuration/live#two-way-talk).
 
 :::
 
@@ -204,7 +187,7 @@ go2rtc:
       - "ffmpeg:http://reolink_ip/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=username&password=password#video=copy#audio=copy#audio=opus"
     your_reolink_camera_sub:
       - "ffmpeg:http://reolink_ip/flv?port=1935&app=bcs&stream=channel0_ext.bcs&user=username&password=password"
-    # example for connecting to a Reolink camera that supports two way talk
+    # example for connectin to a Reolink camera that supports two way talk
     your_reolink_camera_twt:
       - "ffmpeg:http://reolink_ip/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=username&password=password#video=copy#audio=copy#audio=opus"
       - "rtsp://username:password@reolink_ip/Preview_01_sub"
@@ -242,14 +225,13 @@ cameras:
           roles:
             - detect
 ```
-
 </details>
 
 ### Unifi Protect Cameras
 
-:::note
+:::note 
 
-Unifi G5s cameras and newer need a Unifi Protect server to enable rtsps stream, it's not possible to enable it in standalone mode.
+Unifi G5s cameras and newer need a Unifi Protect server to enable rtsps stream, it's not posible to enable it in standalone mode.
 
 :::
 
@@ -264,7 +246,7 @@ go2rtc:
       - rtspx://192.168.1.1:7441/abcdefghijk
 ```
 
-[See the go2rtc docs for more information](https://github.com/AlexxIT/go2rtc/tree/v1.9.14#source-rtsp)
+[See the go2rtc docs for more information](https://github.com/AlexxIT/go2rtc/tree/v1.9.13#source-rtsp)
 
 In the Unifi 2.0 update Unifi Protect Cameras had a change in audio sample rate which causes issues for ffmpeg. The input rate needs to be set for record if used directly with unifi protect.
 
@@ -287,6 +269,7 @@ Some community members have found better performance on Wyze cameras by using an
 To use a USB camera (webcam) with Frigate, the recommendation is to use go2rtc's [FFmpeg Device](https://github.com/AlexxIT/go2rtc?tab=readme-ov-file#source-ffmpeg-device) support:
 
 - Preparation outside of Frigate:
+
   - Get USB camera path. Run `v4l2-ctl --list-devices` to get a listing of locally-connected cameras available. (You may need to install `v4l-utils` in a way appropriate for your Linux distribution). In the sample configuration below, we use `video=0` to correlate with a detected device path of `/dev/video0`
   - Get USB camera formats & resolutions. Run `ffmpeg -f v4l2 -list_formats all -i /dev/video0` to get an idea of what formats and resolutions the USB Camera supports. In the sample configuration below, we use a width of 1024 and height of 576 in the stream and detection settings based on what was reported back.
   - If using Frigate in a container (e.g. Docker on TrueNAS), ensure you have USB Passthrough support enabled, along with a specific Host Device (`/dev/video0`) + Container Device (`/dev/video0`) listed.

docs/docs/configuration/cameras.md

@@ -7,74 +7,6 @@ import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
 
-## Adding a camera with the Add Camera Wizard
-
-The Add Camera Wizard is the recommended way to add a camera. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />, or use it from the [setup wizard](../guides/getting_started.md#configuring-frigate) on a new install. The wizard connects to your camera, tests each stream, and writes the camera's configuration for you, including the [go2rtc](go2rtc.md) restream and the live view stream mapping, so a standard setup needs no hand-written YAML.
-
-### Step 1: Name and connection
-
-Enter a name for the camera along with its host or IP address and credentials, then choose how the wizard should find the camera's streams:
-
-- **Probe camera** queries the camera over ONVIF (the ONVIF port is usually 80 or 8080) and asks it for its stream URLs. Some cameras use a separate ONVIF/service account rather than the device admin user, and some require **Use digest authentication** to be enabled.
-- **Manual selection** builds a stream URL from a template for the camera brand you pick (Dahua/Amcrest/EmpireTech, Hikvision/Uniview/Annke, Ubiquiti, Reolink, Axis, TP-Link, or Foscam). Choose **Other** to enter a custom RTSP URL directly. Non-RTSP stream types must be [configured manually](#setting-up-camera-inputs).
-
-The name you enter is lowercased and spaces become underscores. If the result still isn't a valid config key, the wizard generates a safe name and stores what you typed as `friendly_name`.
-
-### Step 2: Probe or snapshot
-
-In probe mode, the wizard reports what the camera returned (manufacturer, model, firmware, profile count, and whether PTZ, presets, and [autotracking](autotracking.md) are supported) along with the RTSP URLs it discovered. Test each candidate to see its resolution, frame rate, and codecs together with a snapshot, then select the one you want to use.
-
-In manual mode, the wizard tests the templated URL and shows the same metadata and snapshot.
-
-If no RTSP URLs are found, the credentials may be wrong or the camera may not support ONVIF. Go back and use manual selection instead.
-
-### Step 3: Stream configuration
-
-Assign [roles](#setting-up-camera-inputs) to the stream, and use **Add Another Stream** to add the camera's other streams, for example a substream for `detect` alongside the main stream for `record`. At least one stream must have the `detect` role before you can continue.
-
-**Reduce connections to camera** routes that input through the go2rtc restream so Frigate and the live view share a single connection to the camera instead of each opening their own. See [restream](restream.md) for more detail.
-
-### Step 4: Validation and testing
-
-Connect each stream to get a live preview, an estimated bandwidth figure, and a list of validation results. The wizard checks for the most common misconfigurations, including:
-
-- A detect resolution that is too high (increased resource usage) or too low for reliable detection, or one it could not probe at all
-- A stream marked `record` whose audio codec is not AAC, or that has no audio at all
-- A stream marked `audio` that carries no audio stream
-- Using a restreamed input for the `record` role
-- Brand-specific issues, such as an RTSP stream on a Reolink camera that should use http-flv, or a Dahua/Hikvision substream selected for `detect`
-
-**Use stream compatibility mode** passes the stream through go2rtc's ffmpeg module. Enable it if a stream fails to load after several attempts. Note that this also prevents [two way talk](/configuration/live#two-way-talk) from being detected for that stream.
-
-**Save New Camera** writes the configuration and starts the camera right away. No restart is required.
-
-Other features, including [hardware acceleration](hardware_acceleration_video.md), [two way talk](/configuration/live#two-way-talk), and audio transcoding, is configured after the camera has been added. For camera model specific quirks, see the [camera specific](camera_specific.md) docs.
-
-## Deleting a camera
-
-Click **Delete Camera** in <NavPath path="Settings > Global configuration > Camera management" />, choose the camera, and confirm. Deleting a camera requires the `admin` role and cannot be undone.
-
-:::warning
-
-Deleting a camera permanently removes its recordings, tracked objects, and configuration. If you only want to stop processing a camera, set its state to **Off** or **Disabled** in <NavPath path="Settings > Global configuration > Camera management" /> instead. See [camera state](/configuration/live#camera-state).
-
-:::
-
-Deleting a camera removes:
-
-- The camera's section of your config file, along with its entries in any [role](authentication.md#user-roles) camera list. A custom role left with no cameras is removed as well.
-- Every database record for the camera: tracked objects, review items, recordings, previews, timeline entries, the saved region grid, and [triggers](semantic_search.md#triggers).
-- Every media file for the camera: recordings, snapshots, thumbnails, and preview clips.
-
-[Exports](/usage/exports) are kept by default, so saved footage survives the deletion of the camera it came from. Turn on **Also delete exports for this camera** in the confirmation step to remove those too.
-
-The camera's processes are stopped and the change takes effect immediately, so no restart is required. If the resulting config cannot be parsed, Frigate restores the previous config and reports an error instead of leaving Frigate in a broken state.
-
-Two things are not cleaned up for you:
-
-- **go2rtc streams.** Frigate makes a best effort to stop a running [go2rtc](go2rtc.md) stream named after the camera, but stream entries in your config file remain and are recreated on the next restart. Remove them in <NavPath path="Settings > System > go2rtc streams" /> or in your config file.
-- **Camera groups.** A deleted camera stays listed in any [camera group](#setting-up-camera-groups) that referenced it. The group skips the missing camera, so this is harmless, but you can edit the group to drop the stale entry.
-
 ## Setting Up Camera Inputs
 
 Several inputs can be configured for each camera and the role of each input can be mixed and matched based on your needs. This allows you to use a lower resolution stream for object detection, but create recordings from a higher resolution stream, or vice versa.
@@ -83,24 +15,21 @@ A camera is enabled by default but can be disabled by using `enabled: False`. Ca
 
 Each role can only be assigned to one input per camera. The options for roles are as follows:
 
-| Role         | Description                                                                                                  |
+| Role     | Description                                                                         |
-| ------------ | ------------------------------------------------------------------------------------------------------------ |
+| -------- | ----------------------------------------------------------------------------------- |
-| `detect`     | Main feed for object detection. [docs](object_detectors.md)                                                  |
+| `detect` | Main feed for object detection. [docs](object_detectors.md)                         |
-| `record`     | Saves segments of the video feed based on configuration settings. [docs](record.md)                          |
+| `record` | Saves segments of the video feed based on configuration settings. [docs](record.md) |
-| `record_sub` | Saves segments of a second, lower quality stream with its own retention. [docs](record.md#sub-stream-recording) |
+| `audio`  | Feed for audio based detection. [docs](audio_detectors.md)                          |
-| `audio`      | Feed for audio based detection. [docs](audio_detectors.md)                                                   |
 
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > Camera configuration > Streams (FFmpeg)" />.
+Navigate to <NavPath path="Settings > Camera configuration > FFmpeg" />.
 
 | Field             | Description                                                         |
 | ----------------- | ------------------------------------------------------------------- |
 | **Camera inputs** | List of input stream definitions (paths and roles) for this camera. |
 
-For each input you can choose its source: select **Restream (go2rtc)** to pick an existing [go2rtc stream](restream.md) from a dropdown (Frigate uses the `rtsp://127.0.0.1:8554/<stream>` path and `preset-rtsp-restream` input args for that input automatically), or **Manual input path** to type the stream URL directly.
-
 Navigate to <NavPath path="Settings > Camera configuration > Object detection" />.
 
 | Field             | Description                                                                                            |
@@ -138,7 +67,7 @@ Additional cameras are simply added under the camera configuration section.
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and use the [Add Camera Wizard](#adding-a-camera-with-the-add-camera-wizard) to configure each additional camera.
+Navigate to <NavPath path="Settings > Camera configuration > Management" /> and use the add camera button to configure each additional camera.
 
 </TabItem>
 <TabItem value="yaml">
@@ -214,11 +143,6 @@ If your ONVIF camera does not require authentication credentials, you may still
 
 :::
 
-If a camera connects but fails to authenticate, two optional fields can help:
-
-- `tls_insecure`: Skips TLS certificate verification and sends the ONVIF password as plaintext (`PasswordText`) instead of a hashed digest (`PasswordDigest`). Some cameras reject the digest token and only accept plaintext. This weakens connection security, so only enable it on a trusted local network.
-- `ignore_time_mismatch`: ONVIF authentication tokens include a timestamp, and a camera will reject the token if its clock differs too much from Frigate's. Enabling this makes Frigate compensate for the time offset so authentication can still succeed. Running NTP on both the camera and the Frigate host is the recommended fix; only use this in a "safe" environment, as it slightly weakens token validation.
-
 If your camera has multiple ONVIF profiles, you can specify which one to use for PTZ control with the `profile` option, matched by token or name. When not set, Frigate selects the first profile with a valid PTZ configuration. Check the Frigate debug logs (`frigate.ptz.onvif: debug`) to see available profile names and tokens for your camera.
 
 An ONVIF-capable camera that supports relative movement within the field of view (FOV) can also be configured to automatically track moving objects and keep them in the center of the frame. For autotracking setup, see the [autotracking](autotracking.md) docs.
@@ -250,7 +174,7 @@ The FeatureList on the [ONVIF Conformant Products Database](https://www.onvif.or
 | Hikvision DS-2DE3A404IWG-E/W |      ✅      |      ✅      |                                                                                                                                                                                                                                                                   |
 | Reolink                      |      ✅      |      ❌      |                                                                                                                                                                                                                                                                   |
 | Speco O8P32X                 |      ✅      |      ❌      |                                                                                                                                                                                                                                                                   |
-| Sunba 405-D20X               |      ✅      |      ❌      | Incomplete ONVIF support reported on original, and 4k models. All models are suspected incompatible.                                                                                                                                                              |
+| Sunba 405-D20X               |      ✅      |      ❌      | Incomplete ONVIF support reported on original, and 4k models. All models are suspected incompatable.                                                                                                                                                              |
 | Tapo                         |      ✅      |      ❌      | Many models supported, ONVIF Service Port: 2020                                                                                                                                                                                                                   |
 | Uniview IPC672LR-AX4DUPK     |      ✅      |      ❌      | Firmware says FOV relative movement is supported, but camera doesn't actually move when sending ONVIF commands                                                                                                                                                    |
 | Uniview IPC6612SR-X33-VG     |      ✅      |      ✅      | Leave `calibrate_on_startup` as `False`. A user has reported that zooming with `absolute` is working.                                                                                                                                                             |
@@ -263,7 +187,7 @@ Camera groups let you organize cameras together with a shared name and icon, mak
 <ConfigTabs>
 <TabItem value="ui">
 
-On the Live dashboard, press the **pencil icon** in the main navigation to add a new camera group. Configure the group name, select which cameras to include, choose an icon, and set the display order.
+On the Live dashboard, press the **+** icon in the main navigation to add a new camera group. Configure the group name, select which cameras to include, choose an icon, and set the display order.
 
 </TabItem>
 <TabItem value="yaml">

docs/docs/configuration/config_overrides.md

@@ -1,244 +0,0 @@
----
-id: config_overrides
-title: Global and Camera-Level Configuration
----
-
-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
-Most of Frigate's configuration can be set once for all cameras and then adjusted for individual cameras. The global value acts as the default for every camera, and any camera can override it.
-
-This page explains how that inheritance works. For a tour of the Settings UI itself, see [Frigate Configuration](./config.md).
-
-## The basics
-
-Set a value globally and every camera uses it. Set the same value on a camera and that camera uses its own value instead.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > Global configuration > Object detection" /> and set **Detect FPS** to `5`. Every camera now detects at 5 fps.
-2. Navigate to <NavPath path="Settings > Camera configuration > Object detection" />, select the `driveway` camera, and set **Detect FPS** to `10`.
-
-The `driveway` camera now detects at 10 fps. Every other camera still uses the global value of 5.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-detect:
-  fps: 5 # every camera detects at 5 fps
-
-cameras:
-  front_door:
-    ffmpeg: ...
-  driveway:
-    ffmpeg: ...
-    detect:
-      fps: 10 # except this one
-```
-
-`front_door` inherits `fps: 5`, and `driveway` uses `10`.
-
-</TabItem>
-</ConfigTabs>
-
-## Overrides apply per value, not per section
-
-Overriding one value in a section does not detach the rest of that section. Everything you don't set on the camera still comes from the global configuration.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-If you set a camera's **Motion threshold** but leave **Contour area** alone, only the threshold is overridden. The contour area continues to follow <NavPath path="Settings > Global configuration > Motion detection" />, and changing it there still affects that camera.
-
-Open a section to see which values are overridden: the section header indicates how many fields differ from the global configuration.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-motion:
-  threshold: 30
-  contour_area: 10
-
-cameras:
-  driveway:
-    motion:
-      threshold: 40
-```
-
-The `driveway` camera ends up with `threshold: 40` and `contour_area: 10`. Only the value you wrote was overridden.
-
-</TabItem>
-</ConfigTabs>
-
-## Returning a camera to the global value
-
-<ConfigTabs>
-<TabItem value="ui">
-
-A camera section that has its own values shows an **Overridden** badge. To remove the override and go back to inheriting, use the **Reset to Global** button at the bottom of the section.
-
-</TabItem>
-<TabItem value="yaml">
-
-Frigate treats a camera value as an override because it is written in the config file, not because it differs from the global value. Repeating the global value under a camera still creates an override:
-
-```yaml
-snapshots:
-  enabled: true
-
-cameras:
-  driveway:
-    snapshots:
-      enabled: true # this is an override, even though it matches
-```
-
-If you later change the global `snapshots.enabled` to `false`, `driveway` keeps saving snapshots, because it has its own value. To make a camera follow the global value again, delete the key from the camera rather than setting it to match.
-
-</TabItem>
-</ConfigTabs>
-
-## Lists replace, maps merge
-
-This is the distinction that surprises people most.
-
-**Lists are replaced entirely.** A camera's list does not add to the global list, it takes its place.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-The camera page shows the objects the camera is currently tracking, starting from the global list. Changing that selection under <NavPath path="Settings > Camera configuration > Objects" /> replaces the list for that camera, so make sure every object you want tracked is selected, not just the ones you are adding.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-objects:
-  track:
-    - person
-    - car
-
-cameras:
-  backyard:
-    objects:
-      track:
-        - dog # backyard tracks ONLY dog, not person or car
-```
-
-To track `dog` in addition to the global objects, list all of them on the camera.
-
-</TabItem>
-</ConfigTabs>
-
-An empty list is a valid override, and is the normal way to opt a camera out of something:
-
-```yaml
-review:
-  alerts:
-    labels:
-      - person
-
-cameras:
-  street:
-    review:
-      alerts:
-        labels: [] # this camera never creates alerts
-```
-
-**Maps are merged key by key.** A camera can add an entry without redeclaring the others.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Adding a filter for one object under <NavPath path="Settings > Camera configuration > Objects" /> does not remove the filters inherited from <NavPath path="Settings > Global configuration > Objects" />. The camera keeps both.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-objects:
-  filters:
-    person:
-      min_area: 5000
-
-cameras:
-  driveway:
-    objects:
-      filters:
-        car:
-          min_area: 10000
-```
-
-The `driveway` camera ends up with both the `car` filter it defined and the `person` filter from the global configuration.
-
-</TabItem>
-</ConfigTabs>
-
-## Which settings can be overridden
-
-Most, but not all. The [full reference config](./advanced/reference.md) is the authoritative source: sections that support camera-level overrides are marked with the comment `# NOTE: Can be overridden at the camera level`. In the UI, a setting can be overridden if it appears under both <NavPath path="Settings > Global configuration" /> and <NavPath path="Settings > Camera configuration" />.
-
-A few things worth knowing beyond that:
-
-- Some sections are **global only** and have no camera-level equivalent, including `go2rtc`, `genai` providers, `classification`, `telemetry`, `camera_groups`, and `ui`.
-- Some sections exist **only at the camera level**, such as `zones` and `onvif`.
-- Some sections are **partially overridable**, meaning a camera accepts only a few of the keys available globally. `face_recognition`, `lpr`, and `audio_transcription` work this way, and the reference config notes which keys apply.
-
-## Enrichments that must be enabled globally first
-
-License plate recognition and face recognition are special: the global setting is not just a default, it is a switch that must be on before any camera can use the feature. Enabling one on a camera while it is disabled globally is a configuration error, and Frigate will refuse to start:
-
-```
-Camera driveway has lpr enabled but lpr is disabled at the global level of the config. You must enable lpr at the global level.
-```
-
-Enable the feature globally, then turn it off on the cameras that don't need it.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > Global configuration > License plate recognition" /> and enable **LPR**.
-2. Navigate to <NavPath path="Settings > Camera configuration > License plate recognition" />, select each camera that should not run LPR, and disable the **Enable LPR** toggle.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-lpr:
-  enabled: true
-
-cameras:
-  driveway:
-    ffmpeg: ... # inherits lpr, enabled
-  backyard:
-    ffmpeg: ...
-    lpr:
-      enabled: false # opted out
-```
-
-</TabItem>
-</ConfigTabs>
-
-:::note
-
-This applies only to `lpr` and `face_recognition`, because the global setting controls whether the supporting background process starts at all. Other features do not work this way. Audio transcription, for example, can be enabled on a single camera without being enabled globally.
-
-:::
-
-## Profiles
-
-[Profiles](./profiles.md) add a further layer on top of everything described above. A profile is a named set of camera overrides that you can switch on and off while Frigate is running, for example to change detection and recording behavior when you leave the house.
-
-Profiles are applied on top of a camera's already-resolved configuration, so a profile value wins over both the camera and the global value while that profile is active. Profiles cover a subset of the camera sections and do not modify your config file.
-
-## Summary
-
-- A camera inherits every value you don't set on it.
-- Overriding one value does not detach the rest of the section.
-- Writing a value on a camera overrides it, even if it matches the global value. Remove it to inherit again.
-- Lists replace the global list. Maps merge into it.
-- An empty list is an override, not an omission.
-- `lpr` and `face_recognition` must be enabled globally before a camera can use them.

docs/docs/configuration/custom_classification/object_classification.md

@@ -11,7 +11,7 @@ Object classification allows you to train a custom MobileNetV2 classification mo
 
 :::info
 
-Training a custom object classification model requires an internet connection to download MobileNetV2 base weights. By default these weights are not cached in `/config/`, so they are downloaded again after the container is recreated. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
+Training a custom object classification model requires a one-time internet connection to download MobileNetV2 base weights. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
 
 :::
 
@@ -137,7 +137,7 @@ If examples for some of your classes do not appear in the grid, you can continue
 
 :::tip Diversity matters far more than volume
 
-Selecting dozens of nearly identical images is one of the fastest ways to degrade model performance. MobileNetV2 can overfit quickly when trained on homogeneous data. The model learns what _that exact moment_ looked like rather than what actually defines the class. **This is why Frigate does not implement bulk training in the UI.**
+Selecting dozens of nearly identical images is one of the fastest ways to degrade model performance. MobileNetV2 can overfit quickly when trained on homogeneous data — the model learns what _that exact moment_ looked like rather than what actually defines the class. **This is why Frigate does not implement bulk training in the UI.**
 
 For more detail, see [Frigate Tip: Best Practices for Training Face and Custom Classification Models](https://github.com/blakeblackshear/frigate/discussions/21374).
 
@@ -149,16 +149,9 @@ For more detail, see [Frigate Tip: Best Practices for Training Face and Custom C
 - **The wizard is just the starting point**: You don't need to find and label every class upfront. Missing classes will naturally appear in Recent Classifications, and those images tend to be more valuable because they represent new conditions and edge cases.
 - **Problem framing**: Keep classes visually distinct and relevant to the chosen object types.
 - **Preprocessing**: Ensure examples reflect object crops similar to Frigate's boxes; keep the subject centered.
-- **Crop size**: Aim for crops of at least 100×100 pixels (a 10,000 pixel area). Crops smaller than ~80×80 get stretched 3-7× by the model's 224×224 input resize and tend to collapse into a generic "blob" region of feature space where identity becomes unreliable. If most of your detections are small because the camera is far from the subject, consider repositioning the camera for closer crops.
+- **Labels**: Keep label names short and consistent; include a `none` class if you plan to ignore uncertain predictions for sub labels.
-- **Class balance**: Aim to keep your largest class within ~3× the count of your smallest. Beyond that, the model becomes biased toward the dominant class and tends to default borderline predictions to it (the "everything looks like Buddy" failure mode).
 - **Threshold**: Tune `threshold` per model to reduce false assignments. Start at `0.8` and adjust based on validation.
 
-:::tip `none` works differently from named classes
-
-Named classes work best with visually uniform examples. Every Buddy photo should look like Buddy. The `none` class needs the opposite: visual diversity across sizes, framings, and qualities, because at inference it has to absorb everything that isn't one of your named classes. Don't apply the same "only keep large, well-framed images" rule to `none` that you would to a named class. Mix in small crops, partial views, and false positives deliberately - otherwise the model has no signal for "small/ambiguous thing = not one of my known classes" and will force those crops into a named class by default.
-
-:::
-
 ## Debugging Classification Models
 
 To troubleshoot issues with object classification models, enable debug logging to see detailed information about classification attempts, scores, and consensus calculations.

docs/docs/configuration/custom_classification/state_classification.md

@@ -11,7 +11,7 @@ State classification allows you to train a custom MobileNetV2 classification mod
 
 :::info
 
-Training a custom state classification model requires an internet connection to download MobileNetV2 base weights. By default these weights are not cached in `/config/`, so they are downloaded again after the container is recreated. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
+Training a custom state classification model requires a one-time internet connection to download MobileNetV2 base weights. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
 
 :::
 
@@ -73,13 +73,9 @@ classification:
         interval: 10 # also run every N seconds (optional)
         cameras:
           front:
-            # [x1, y1, x2, y2] as decimals between 0 and 1, relative to the
+            crop: [0, 180, 220, 400]
-            # camera's detect resolution
-            crop: [0.0, 0.25, 0.3, 0.85]
 ```
 
-Crop coordinates are normalized: each value is a fraction of the camera's `detect` width or height, not a pixel value. Drawing the crop in the UI wizard writes these values for you.
-
 An optional config, `save_attempts`, can be set as a key under the model name. This defines the number of classification attempts to save in the Recent Classifications tab. For state classification models, the default is 100.
 
 </TabItem>
@@ -107,7 +103,7 @@ Once some images are assigned, training will begin automatically.
 
 :::tip Diversity matters far more than volume
 
-Selecting dozens of nearly identical images is one of the fastest ways to degrade model performance. MobileNetV2 can overfit quickly when trained on homogeneous data. The model learns what _that exact moment_ looked like rather than what actually defines the state. This often leads to models that work perfectly under the original conditions but become unstable when day turns to night, weather changes, or seasonal lighting shifts. **This is why Frigate does not implement bulk training in the UI.**
+Selecting dozens of nearly identical images is one of the fastest ways to degrade model performance. MobileNetV2 can overfit quickly when trained on homogeneous data — the model learns what _that exact moment_ looked like rather than what actually defines the state. This often leads to models that work perfectly under the original conditions but become unstable when day turns to night, weather changes, or seasonal lighting shifts. **This is why Frigate does not implement bulk training in the UI.**
 
 For more detail, see [Frigate Tip: Best Practices for Training Face and Custom Classification Models](https://github.com/blakeblackshear/frigate/discussions/21374).
 

docs/docs/configuration/face_recognition.md

@@ -6,7 +6,6 @@ title: Face Recognition
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
-import FaqItem from "@site/src/components/FaqItem";
 
 Face recognition identifies known individuals by matching detected faces with previously learned facial data. When a known `person` is recognized, their name will be added as a `sub_label`. This information is included in the UI, filters, as well as in notifications.
 
@@ -20,7 +19,7 @@ Face recognition requires a one-time internet connection to download detection a
 
 ### Face Detection
 
-When running a Frigate+ model (or any custom model that natively detects faces) should ensure that `face` is added to the [list of objects to track](../plus/index.md#available-label-types) either globally or for a specific camera. This will allow face detection to run at the same time as object detection and be more efficient.
+When running a Frigate+ model (or any custom model that natively detects faces) should ensure that `face` is added to the [list of objects to track](../plus/#available-label-types) either globally or for a specific camera. This will allow face detection to run at the same time as object detection and be more efficient.
 
 When running a default COCO model or another model that does not include `face` as a detectable label, face detection will run via CV2 using a lightweight DNN model that runs on the CPU. In this case, you should _not_ define `face` in your list of objects to track.
 
@@ -87,7 +86,7 @@ Navigate to <NavPath path="Settings > Enrichments > Face recognition" />.
 - **Detection threshold**: Face detection confidence score required before recognition runs. This field only applies to the standalone face detection model; `min_score` should be used to filter for models that have face detection built in.
   - Default: `0.7`
 - **Minimum face area**: Minimum size (in pixels) a face must be before recognition runs. Depending on the resolution of your camera's `detect` stream, you can increase this value to ignore small or distant faces.
-  - Default: `750` pixels
+  - Default: `500` pixels
 
 </TabItem>
 <TabItem value="yaml">
@@ -96,7 +95,7 @@ Navigate to <NavPath path="Settings > Enrichments > Face recognition" />.
 face_recognition:
   enabled: true
   detection_threshold: 0.7
-  min_area: 750
+  min_area: 500
 ```
 
 </TabItem>
@@ -152,14 +151,6 @@ Follow these steps to begin:
 
 ## Creating a Robust Training Set
 
-:::tip
-
-**The short version:** Start with a few clear, front-facing photos of each person. As faces are detected in the Recent Recognitions tab, train clear images that scored lower, adding variety (different angles, lighting, and expressions) slowly. Diversity matters far more than volume, and low-quality images hurt recognition more than they help.
-
-For a step-by-step narrative of these best practices (and the same principles applied to state and object classification), see the [Frigate Tips: Best Practices for Training](https://github.com/blakeblackshear/frigate/discussions/21374) discussion.
-
-:::
-
 The number of images needed for a sufficient training set for face recognition varies depending on several factors:
 
 - Diversity of the dataset: A dataset with diverse images, including variations in lighting, pose, and facial expressions, will require fewer images per person than a less diverse dataset.
@@ -180,7 +171,7 @@ When choosing images to include in the face training set it is recommended to al
 - If it is difficult to make out details in a persons face it will not be helpful in training.
 - Avoid images with extreme under/over-exposure.
 - Avoid blurry / pixelated images.
-- Avoid training on infrared (gray-scale). The models are trained on color images and will not be able to extract features from gray-scale images.
+- Avoid training on infrared (gray-scale). The models are trained on color images and will be able to extract features from gray-scale images.
 - Using images of people wearing hats / sunglasses may confuse the model.
 - Do not upload too many similar images at the same time, it is recommended to train no more than 4-6 similar images for each person to avoid over-fitting.
 
@@ -190,27 +181,9 @@ When choosing images to include in the face training set it is recommended to al
 
 The Recent Recognitions tab in the face library displays recent face recognition attempts. Detected face images are grouped according to the person they were identified as potentially matching.
 
-Each face image is labeled with a name (or `Unknown`) along with the confidence score of that recognition attempt. Images are grouped by the person they were matched against, not by who they actually are, so a group labeled with a person's name can contain a crop that is really someone else but happened to score as a partial match. The name and score shown on each individual crop describe that single attempt.
+Each face image is labeled with a name (or `Unknown`) along with the confidence score of the recognition attempt. While each image can be used to train the system for a specific person, not all images are suitable for training.
 
-While each image can be used to train the system for a specific person, not all images are suitable for training. Refer to the guidelines below for best practices on selecting images for training.
+Refer to the guidelines below for best practices on selecting images for training.
-
-### How Frigate Decides Who a Person Is
-
-Recognition does not happen one frame at a time. While a `person` is in view, Frigate runs face recognition on many frames, not just a single frame. The final `sub_label` is decided from all of those attempts together, weighted by the area of each face (larger, closer faces count more), not from any single frame.
-
-This has a few practical consequences:
-
-- A handful of wrong guesses on blurry or distant frames usually do not change the result. If Frigate sees a person as "Tom, Tom, Sam, Tom, Tom," it will still conclude the person was Tom.
-- The goal is not for every individual face crop to be correct. The goal is for each person to be recognized correctly overall, across all the faces captured while they were present.
-- A single very high confidence match will not by itself assign a sub label. Recognition must be consistent. See [I see scores above the threshold in the Recent Recognitions tab, but a sub label wasn't assigned?](#i-see-scores-above-the-threshold-in-the-recent-recognitions-tab-but-a-sub-label-wasnt-assigned) below.
-
-### Which Faces Are Worth Training?
-
-Whether a face is worth training has little to do with what it was recognized as. A crop is a good training candidate when all of these are true:
-
-- It did not already score high and correctly. Faces that are already recognized confidently add little and increase the risk of over-fitting.
-- It is clear enough to be useful: not blurry, not heavily off-axis, not infrared (gray-scale). If it is hard for you to make out the face, it will not help the model.
-- It adds something new: a different angle, lighting, expression, or distance than what you already have.
 
 ### Step 1 - Building a Strong Foundation
 
@@ -226,81 +199,39 @@ Once front-facing images are performing well, start choosing slightly off-angle
 
 ## FAQ
 
-### Getting Recognition Working
+### How do I debug Face Recognition issues?
-
-<FaqItem id="how-do-i-debug-face-recognition-issues" question="How do I debug Face Recognition issues?">
 
 Start with the [Usage](#usage) section and re-read the [Model Requirements](#model-requirements) above.
 
-1. Enable debug logs to see exactly what Frigate is doing.
+1. Ensure `person` is being _detected_. A `person` will automatically be scanned by Frigate for a face. Any detected faces will appear in the Recent Recognitions tab in the Frigate UI's Face Library.
-   - Enable debug logs for face recognition by adding `frigate.data_processing.real_time.face: debug` to your `logger` configuration. Restart Frigate after this change.
-
-     ```yaml
-     logger:
-       default: info
-       logs:
-         # highlight-next-line
-         frigate.data_processing.real_time.face: debug
-     ```
-
-   - These logs report where the pipeline stopped for each `person` object, such as no face being found within the person's bounding box, the detected face being smaller than `min_area`, or a face being recognized but scoring too low.
-   - If you see no face-related messages at all, also add `frigate.embeddings.maintainer: debug` to confirm that the face processor was created at startup and that `person` updates are reaching it.
-
-2. Ensure `person` is being _detected_. A `person` will automatically be scanned by Frigate for a face. Any detected faces will appear in the Recent Recognitions tab in the Frigate UI's Face Library.
 
    If you are using a Frigate+ or `face` detecting model:
-   - Watch the [debug view](/usage/live#the-single-camera-view) to ensure that `face` is being detected along with `person`.
+   - Watch the debug view (Settings --> Debug) to ensure that `face` is being detected along with `person`.
    - You may need to adjust the `min_score` for the `face` object if faces are not being detected.
 
    If you are **not** using a Frigate+ or `face` detecting model:
    - Check your `detect` stream resolution and ensure it is sufficiently high enough to capture face details on `person` objects.
    - You may need to lower your `detection_threshold` if faces are not being detected.
 
-3. Any detected faces will then be _recognized_.
+2. Any detected faces will then be _recognized_.
    - Make sure you have trained at least one face per the recommendations above.
    - Adjust `recognition_threshold` settings per the suggestions [above](#advanced-configuration).
 
-</FaqItem>
+### Detection does not work well with blurry images?
 
-<FaqItem id="does-face-recognition-run-on-the-recording-stream" question="Does face recognition run on the recording stream?">
+Accuracy is definitely a going to be improved with higher quality cameras / streams. It is important to look at the DORI (Detection Observation Recognition Identification) range of your camera, if that specification is posted. This specification explains the distance from the camera that a person can be detected, observed, recognized, and identified. The identification range is the most relevant here, and the distance listed by the camera is the furthest that face recognition will realistically work.
-
-Face recognition does not run on the recording stream, this would be suboptimal for many reasons:
-
-1. The latency of accessing the recordings means the notifications would not include the names of recognized people because recognition would not complete until after.
-2. The embedding models used run on a set image size, so larger images will be scaled down to match this anyway.
-3. Motion clarity is much more important than extra pixels, over-compression and motion blur are much more detrimental to results than resolution.
-
-</FaqItem>
-
-### Improving Accuracy and Training
-
-<FaqItem id="detection-does-not-work-well-with-blurry-images" question="Detection does not work well with blurry images?">
-
-Accuracy is definitely going to be improved with higher quality cameras / streams. It is important to look at the DORI (Detection Observation Recognition Identification) range of your camera, if that specification is posted. This specification explains the distance from the camera that a person can be detected, observed, recognized, and identified. The identification range is the most relevant here, and the distance listed by the camera is the furthest that face recognition will realistically work.
 
 Some users have also noted that setting the stream in camera firmware to a constant bit rate (CBR) leads to better image clarity than with a variable bit rate (VBR).
 
-</FaqItem>
+### Why can't I bulk upload photos?
-
-<FaqItem id="can-i-train-faces-for-people-who-only-appear-at-night" question="Can I train faces for people who only appear at night?">
-
-The embedding models are trained on color images, so gray-scale and infrared (IR) faces sit in a different feature distribution and are more easily confused with other people. Prefer color images, and avoid mixing gray-scale samples in early while you are building a foundation. If someone only ever appears at night, gray-scale training is acceptable, but keep those samples limited and as clear as possible, and add them only once color recognition is stable for your other people.
-
-</FaqItem>
-
-<FaqItem id="why-cant-i-bulk-upload-photos" question="Why can't I bulk upload photos?">
 
 It is important to methodically add photos to the library, bulk importing photos (especially from a general photo library) will lead to over-fitting in that particular scenario and hurt recognition performance.
 
-</FaqItem>
+### Why can't I bulk reprocess faces?
-
-<FaqItem id="why-cant-i-bulk-reprocess-faces" question="Why can't I bulk reprocess faces?">
 
 Face embedding models work by breaking apart faces into different features. This means that when reprocessing an image, only images from a similar angle will have its score affected.
 
-</FaqItem>
+### Why do unknown people score similarly to known people?
-
-<FaqItem id="why-do-unknown-people-score-similarly-to-known-people" question="Why do unknown people score similarly to known people?">
 
 This can happen for a few different reasons, but this is usually an indicator that the training set needs to be improved. This is often related to over-fitting:
 
@@ -310,54 +241,33 @@ This can happen for a few different reasons, but this is usually an indicator th
 
 Review your face collections and remove most of the unclear or low-quality images. Then, use the **Reprocess** button on each face in the **Train** tab to evaluate how the changes affect recognition scores.
 
-Avoid training on images that already score highly, as this can lead to over-fitting. Instead, focus on relatively clear images that score lower (ideally with different lighting, angles, and conditions) to help the model generalize more effectively.
+Avoid training on images that already score highly, as this can lead to over-fitting. Instead, focus on relatively clear images that score lower - ideally with different lighting, angles, and conditions—to help the model generalize more effectively.
 
-</FaqItem>
+### Frigate misidentified a face. Can I tell it that a face is "not" a specific person?
-
-<FaqItem id="should-i-correct-a-face-that-was-recognized-as-the-wrong-person" question="Should I correct a face that was recognized as the wrong person?">
-
-Only if it is a good image. Reassigning a face does add it to that person's training set, but two things are true at once:
-
-- Reassigning a single misclassified frame has a small effect. The image is weighted against every other sample for that person, so correcting 1 frame out of 20 will not move recognition much. Occasional wrong guesses on poor frames are normal and do not need to be fixed.
-- Reassigning a poor image (blurry, off-angle, low-resolution, gray-scale) can hurt more than the misidentification did, because low-quality samples degrade recognition for that whole person.
-
-So the decision is about image quality, not about the wrong label. If the crop is clear, well-lit, and reasonably front-facing, and it scored low or was wrong, assigning it to the correct person is useful. If you can barely make out the face yourself, ignore it; do not train it just to correct the label.
-
-If a person is repeatedly misidentified, do not keep reassigning the same frame. Instead, remove low-quality or misleading images and add a few high-quality samples to the correct person. See [Why do unknown people score similarly to known people?](#why-do-unknown-people-score-similarly-to-known-people) above.
-
-</FaqItem>
-
-<FaqItem id="frigate-misidentified-a-face-can-i-tell-it-that-a-face-is-not-a-specific-person" question={'Frigate misidentified a face. Can I tell it that a face is "not" a specific person?'}>
 
 No, face recognition does not support negative training (i.e., explicitly telling it who someone is _not_). Instead, the best approach is to improve the training data by using a more diverse and representative set of images for each person.
 For more guidance, refer to the section above on improving recognition accuracy.
 
-This also applies to a stranger who is repeatedly matched to a known person (for example, a delivery driver recognized as you). Do not create a profile for them and do not reassign their faces to yourself, as this pollutes your training set and makes recognition worse. Leave the detection as unknown and improve the known person's training set instead. Face recognition learns who someone is, not who they are not.
+### I see scores above the threshold in the Recent Recognitions tab, but a sub label wasn't assigned?
 
-</FaqItem>
+The Frigate considers the recognition scores across all recognition attempts for each person object. The scores are continually weighted based on the area of the face, and a sub label will only be assigned to person if a person is confidently recognized consistently. This avoids cases where a single high confidence recognition would throw off the results.
 
-<FaqItem id="i-see-scores-above-the-threshold-in-the-recent-recognitions-tab-but-a-sub-label-wasnt-assigned" question="I see scores above the threshold in the Recent Recognitions tab, but a sub label wasn't assigned?">
+### Can I use other face recognition software like DoubleTake at the same time as the built in face recognition?
-
-Frigate considers the recognition scores across all recognition attempts for each person object. The scores are continually weighted based on the area of the face, and a sub label will only be assigned to person if a person is confidently recognized consistently. This avoids cases where a single high confidence recognition would throw off the results.
-
-</FaqItem>
-
-### Compatibility and Maintenance
-
-<FaqItem id="can-i-use-other-face-recognition-software-like-doubletake-at-the-same-time-as-the-built-in-face-recognition" question="Can I use other face recognition software like DoubleTake at the same time as the built in face recognition?">
 
 No, using another face recognition service will interfere with Frigate's built in face recognition. When using double-take the sub_label feature must be disabled if the built in face recognition is also desired.
 
-</FaqItem>
+### Does face recognition run on the recording stream?
 
-<FaqItem id="i-get-an-unknown-error-when-taking-a-photo-directly-with-my-iphone" question="I get an unknown error when taking a photo directly with my iPhone">
+Face recognition does not run on the recording stream, this would be suboptimal for many reasons:
+
+1. The latency of accessing the recordings means the notifications would not include the names of recognized people because recognition would not complete until after.
+2. The embedding models used run on a set image size, so larger images will be scaled down to match this anyway.
+3. Motion clarity is much more important than extra pixels, over-compression and motion blur are much more detrimental to results than resolution.
+
+### I get an unknown error when taking a photo directly with my iPhone
 
 By default iOS devices will use HEIC (High Efficiency Image Container) for images, but this format is not supported for uploads. Choosing `large` as the format instead of `original` will use JPG which will work correctly.
 
-</FaqItem>
+### How can I delete the face database and start over?
-
-<FaqItem id="how-can-i-delete-the-face-database-and-start-over" question="How can I delete the face database and start over?">
 
 Frigate does not store anything in its database related to face recognition. You can simply delete all of your faces through the Frigate UI or remove the contents of the `/media/frigate/clips/faces` directory.
-
-</FaqItem>

docs/docs/configuration/ffmpeg_presets.md

@@ -7,33 +7,33 @@ import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
 
-Frigate ships with a set of FFmpeg presets to keep your configuration short and readable. Each preset expands to a longer list of FFmpeg arguments at runtime. You can see exactly what every preset expands to in [this file](https://github.com/blakeblackshear/frigate/blob/master/frigate/ffmpeg_presets.py).
+Some presets of FFmpeg args are provided by default to make the configuration easier. All presets can be seen in [this file](https://github.com/blakeblackshear/frigate/blob/master/frigate/ffmpeg_presets.py).
 
-In the config file you reference a preset by its name (for example, `preset-vaapi`). In the UI, the same preset is shown with a friendly label (for example, **VAAPI (Intel/AMD GPU)**). Both refer to the same thing: the tables below list the config name alongside the label you'll see in the UI.
+### Hwaccel Presets
 
-### Hwaccel (Hardware Acceleration) Presets {#hwaccel-presets}
+It is highly recommended to use hwaccel presets in the config. These presets not only replace the longer args, but they also give Frigate hints of what hardware is available and allows Frigate to make other optimizations using the GPU such as when encoding the birdseye restream or when scaling a stream that has a size different than the native stream size.
 
-Hardware acceleration arguments tell FFmpeg to decode your camera's video stream on a GPU or integrated graphics chip instead of the CPU, which dramatically lowers CPU usage. Using a preset is highly recommended. Beyond replacing a long list of arguments, each preset also tells Frigate what hardware is available so it can offload additional work to the GPU, for example, encoding the Birdseye restream or scaling a stream whose resolution differs from the camera's native size.
+See [the hwaccel docs](/configuration/hardware_acceleration_video.md) for more info on how to setup hwaccel for your GPU / iGPU.
 
-See [the hardware acceleration docs](/configuration/hardware_acceleration_video.md) for details on setting up hardware acceleration for your GPU / iGPU, then select the preset that matches your hardware.
+| Preset                | Usage                          | Other Notes                                           |
+| --------------------- | ------------------------------ | ----------------------------------------------------- |
+| preset-rpi-64-h264    | 64 bit Rpi with h264 stream    |                                                       |
+| preset-rpi-64-h265    | 64 bit Rpi with h265 stream    |                                                       |
+| preset-vaapi          | Intel & AMD VAAPI              | Check hwaccel docs to ensure correct driver is chosen |
+| preset-intel-qsv-h264 | Intel QSV with h264 stream     | If issues occur recommend using vaapi preset instead  |
+| preset-intel-qsv-h265 | Intel QSV with h265 stream     | If issues occur recommend using vaapi preset instead  |
+| preset-nvidia         | Nvidia GPU                     |                                                       |
+| preset-jetson-h264    | Nvidia Jetson with h264 stream |                                                       |
+| preset-jetson-h265    | Nvidia Jetson with h265 stream |                                                       |
+| preset-rkmpp          | Rockchip MPP                   | Use image with \*-rk suffix and privileged mode       |
 
-| Preset (YAML config)  | UI Label                | Usage                             | Notes                                                           |
+Select the appropriate hwaccel preset for your hardware.
-| --------------------- | ----------------------- | --------------------------------- | --------------------------------------------------------------- |
-| preset-rpi-64-h264    | Raspberry Pi (H.264)    | 64-bit Raspberry Pi, H.264 stream |                                                                 |
-| preset-rpi-64-h265    | Raspberry Pi (H.265)    | 64-bit Raspberry Pi, H.265 stream |                                                                 |
-| preset-vaapi          | VAAPI (Intel/AMD GPU)   | Intel or AMD GPU via VAAPI        | Check the hwaccel docs to ensure the correct driver is selected |
-| preset-intel-qsv-h264 | Intel QuickSync (H.264) | Intel QuickSync, H.264 stream     | If you have issues, use the VAAPI preset instead                |
-| preset-intel-qsv-h265 | Intel QuickSync (H.265) | Intel QuickSync, H.265 stream     | If you have issues, use the VAAPI preset instead                |
-| preset-nvidia         | NVIDIA GPU              | NVIDIA GPU                        |                                                                 |
-| preset-jetson-h264    | NVIDIA Jetson (H.264)   | NVIDIA Jetson, H.264 stream       |                                                                 |
-| preset-jetson-h265    | NVIDIA Jetson (H.265)   | NVIDIA Jetson, H.265 stream       |                                                                 |
-| preset-rkmpp          | Rockchip RKMPP          | Rockchip MPP                      | Use an image with the `-rk` suffix and run in privileged mode   |
 
 <ConfigTabs>
 <TabItem value="ui">
 
 1. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to the appropriate preset for your hardware.
-2. To override for a specific camera, navigate to <NavPath path="Settings > Camera configuration > Streams (FFmpeg)" /> and set **Hardware acceleration arguments** for that camera.
+2. To override for a specific camera, navigate to <NavPath path="Settings > Camera configuration > FFmpeg" /> and set **Hardware acceleration arguments** for that camera.
 
 </TabItem>
 <TabItem value="yaml">
@@ -53,25 +53,25 @@ cameras:
 
 ### Input Args Presets
 
-Input arguments are passed to FFmpeg before your camera source and control how Frigate connects to and reads the stream: the transport protocol, timeouts, reconnection behavior, and how the stream is probed. The right input args ensure a reliable connection and maximum compatibility for each type of stream.
+Input args presets help make the config more readable and handle use cases for different types of streams to ensure maximum compatibility.
 
-See [the camera-specific docs](/configuration/camera_specific.md) for more on non-standard cameras and recommendations for using them in Frigate.
+See [the camera specific docs](/configuration/camera_specific.md) for more info on non-standard cameras and recommendations for using them in Frigate.
 
-| Preset (config)                  | UI Label                                  | Usage                       | Notes                                                                           |
+| Preset                           | Usage                     | Other Notes                                                                                      |
-| -------------------------------- | ----------------------------------------- | --------------------------- | ------------------------------------------------------------------------------- |
+| -------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------ |
-| preset-http-jpeg-generic         | HTTP JPEG (Generic)                       | HTTP live JPEG              | Restreaming the live JPEG is recommended instead                                |
+| preset-http-jpeg-generic         | HTTP Live Jpeg            | Recommend restreaming live jpeg instead                                                          |
-| preset-http-mjpeg-generic        | HTTP MJPEG (Generic)                      | HTTP MJPEG stream           | Restreaming the MJPEG stream is recommended instead                             |
+| preset-http-mjpeg-generic        | HTTP Mjpeg Stream         | Recommend restreaming mjpeg stream instead                                                       |
-| preset-http-reolink              | HTTP - Reolink Cameras                    | Reolink HTTP-FLV stream     | Only for Reolink HTTP, not when restreaming as RTSP                             |
+| preset-http-reolink              | Reolink HTTP-FLV Stream   | Only for reolink http, not when restreaming as rtsp                                              |
-| preset-rtmp-generic              | RTMP (Generic)                            | RTMP stream                 |                                                                                 |
+| preset-rtmp-generic              | RTMP Stream               |                                                                                                  |
-| preset-rtsp-generic              | RTSP (Generic)                            | RTSP stream                 | The default when no input args are specified                                    |
+| preset-rtsp-generic              | RTSP Stream               | This is the default when nothing is specified                                                    |
-| preset-rtsp-restream             | RTSP - Restream from go2rtc               | RTSP stream from a restream | Use when a go2rtc restream is the source for Frigate                            |
+| preset-rtsp-restream             | RTSP Stream from restream | Use for rtsp restream as source for frigate                                                      |
-| preset-rtsp-restream-low-latency | RTSP - Restream from go2rtc (Low Latency) | RTSP stream from a restream | Lowers latency for a go2rtc restream source; may cause issues with some cameras |
+| preset-rtsp-restream-low-latency | RTSP Stream from restream | Use for rtsp restream as source for frigate to lower latency, may cause issues with some cameras |
-| preset-rtsp-udp                  | RTSP - UDP                                | RTSP stream over UDP        | Use when the camera only supports UDP                                           |
+| preset-rtsp-udp                  | RTSP Stream via UDP       | Use when camera is UDP only                                                                      |
-| preset-rtsp-blue-iris            | RTSP - Blue Iris                          | Blue Iris RTSP stream       | Use when consuming a stream from Blue Iris                                      |
+| preset-rtsp-blue-iris            | Blue Iris RTSP Stream     | Use when consuming a stream from Blue Iris                                                       |
 
 :::warning
 
-Be mindful of input arguments when restreaming, because you can end up with a mix of protocols. The `http` and `rtmp` presets cannot be used with `rtsp` streams. For example, using a Reolink camera with an RTSP restream as the recording source while `preset-http-reolink` is applied will cause a crash. In cases like this, set the preset at the stream level instead. See the example below.
+It is important to be mindful of input args when using restream because you can have a mix of protocols. `http` and `rtmp` presets cannot be used with `rtsp` streams. For example, when using a reolink cam with the rtsp restream as a source for record the preset-http-reolink will cause a crash. In this case presets will need to be set at the stream level. See the example below.
 
 :::
 
@@ -96,15 +96,13 @@ cameras:
 
 ### Output Args Presets
 
-Output arguments are passed to FFmpeg after your camera source and control how recordings are written: which codecs are used and whether audio and video are copied as-is or re-encoded. The right output args ensure consistent, playable recordings for each type of stream.
+Output args presets help make the config more readable and handle use cases for different types of streams to ensure consistent recordings.
 
-| Preset (config)                  | UI Label                        | Usage                               | Notes                                                                                                                                                             |
+| Preset                           | Usage                             | Other Notes                                                                                                                                                                                              |
-| -------------------------------- | ------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------------------- | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| preset-record-generic            | Record (Generic, no audio)      | Record without audio                | Use this if your camera has no audio, or if you don't want to record audio                                                                                        |
+| preset-record-generic            | Record WITHOUT audio              | If your camera doesn't have audio, or if you don't want to record audio, use this option                                                                                                                 |
-| preset-record-generic-audio-copy | Record (Generic + Copy Audio)   | Record with the original audio      | Use this to keep the camera's audio in recordings without re-encoding                                                                                             |
+| preset-record-generic-audio-copy | Record WITH original audio        | Use this to enable audio in recordings                                                                                                                                                                   |
-| preset-record-generic-audio-aac  | Record (Generic + Audio to AAC) | Record with audio transcoded to AAC | The default when no output args are specified. Transcodes audio to AAC. If the source is already AAC, use `preset-record-generic-audio-copy` to avoid re-encoding |
+| preset-record-generic-audio-aac  | Record WITH transcoded aac audio  | This is the default when no option is specified. Use it to transcode audio to AAC. If the source is already in AAC format, use preset-record-generic-audio-copy instead to avoid unnecessary re-encoding |
-| preset-record-mjpeg              | Record - MJPEG Cameras          | Record an MJPEG stream              | Restreaming the MJPEG stream is recommended instead                                                                                                               |
+| preset-record-mjpeg              | Record an mjpeg stream            | Recommend restreaming mjpeg stream instead                                                                                                                                                               |
-| preset-record-jpeg               | Record - JPEG Cameras           | Record a live JPEG                  | Restreaming the live JPEG is recommended instead                                                                                                                  |
+| preset-record-jpeg               | Record live jpeg                  | Recommend restreaming live jpeg instead                                                                                                                                                                  |
-| preset-record-ubiquiti           | Record - Ubiquiti Cameras       | Record a Ubiquiti stream with audio | Handles Ubiquiti's non-standard audio format                                                                                                                      |
+| preset-record-ubiquiti           | Record ubiquiti stream with audio | Recordings with ubiquiti non-standard audio                                                                                                                                                              |
-
-These presets apply to the `record` output args. If [sub stream recording](/configuration/record#sub-stream-recording) is enabled, the same args are used for the `record_sub` role unless `output_args.record_sub` is set, which accepts the same presets and manual args.

docs/docs/configuration/genai/config.md

@@ -6,46 +6,12 @@ title: Configuring Generative AI
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
-import FaqItem from "@site/src/components/FaqItem";
 
 ## Configuration
 
-A Generative AI provider can be configured in the global config, which will make the Generative AI features available for use. There are currently 5 native providers available to integrate with Frigate. Other providers that support the OpenAI standard API can also be used. See the OpenAI-Compatible section below.
+A Generative AI provider can be configured in the global config, which will make the Generative AI features available for use. There are currently 4 native providers available to integrate with Frigate. Other providers that support the OpenAI standard API can also be used. See the OpenAI-Compatible section below.
 
-`genai` is a map of named providers. Each key under `genai` is a name you choose, and its value is that provider's settings:
+To use Generative AI, you must define a single provider at the global level of your Frigate configuration. If the provider you choose requires an API key, you may either directly paste it in your configuration, or store it in an environment variable prefixed with `FRIGATE_`.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > Enrichments > Generative AI" />.
-   - Click **Add** and enter a **Provider name**. Any name of letters, numbers, hyphens, and underscores is accepted, but it cannot be changed from the UI after the provider is created.
-   - Set **Provider** to the service you are using (e.g., `ollama`)
-   - Set **Base URL**, **API key**, and **Model** as required by that provider
-   - Set **Roles** to the roles this provider should handle.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-genai:
-  my_provider: # any name you like
-    provider: ollama
-    base_url: http://localhost:11434
-    model: qwen3-vl:4b
-    roles:
-      - descriptions
-      - embeddings
-      - chat
-```
-
-</TabItem>
-</ConfigTabs>
-
-The examples on this page all use `my_provider`, but the name is arbitrary and is only used to reference the provider elsewhere in the config (for example, `semantic_search.model`).
-
-Each provider handles one or more **roles**: `chat`, `descriptions`, `embeddings`, and `transcribe`. A provider handles the first three by default; `transcribe` must always be listed explicitly, and is not available on Ollama, which has no audio input. Each role may be assigned to exactly one provider. Define a single provider if you want it to do everything, or split the roles across several providers using the `roles` option.
-
-If the provider you choose requires an API key, you may either directly paste it in your configuration, or store it in an environment variable prefixed with `FRIGATE_`.
 
 ## Local Providers
 
@@ -59,34 +25,15 @@ Running Generative AI models on CPU is not recommended, as high inference times
 
 ### Recommended Local Models
 
-#### Vision models
+You must use a vision-capable model with Frigate. The following models are recommended for local deployment:
 
-You must use a vision-capable model with Frigate. The following models are recommended for local deployment of the `descriptions` and `chat` roles:
+| Model         | Notes                                                                                                                                                                |
-
+| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Model               | Review [frame mode](/configuration/genai/genai_review#frame-mode) | Notes                                                                                                                                                                |
+| `qwen3-vl`    | Strong visual and situational understanding, enhanced ability to identify smaller objects and interactions with object.                                              |
-| ------------------- | --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `qwen3.5`     | Strong situational understanding, but missing DeepStack from qwen3-vl leading to worse performance for identifying objects in people's hand and other small details. |
-| `qwen3-vl`          | `frames`                                                              | Strong visual and situational understanding, enhanced ability to identify smaller objects and interactions with object. Follows a sequence of frames on its own.     |
+| `gemma4`      | Strong situational understanding, sometimes resorts to more vague terms like 'interacts' instead of assigning a specific action.                                     |
-| `qwen3.6`/`qwen3.8` | `frames`                                                              | Strong situational understanding, but missing DeepStack from qwen3-vl leading to worse performance for identifying objects in people's hand and other small details. |
+| `Intern3.5VL` | Relatively fast with good vision comprehension                                                                                                                       |
-| `gemma4`            | `annotated_frames`                                                    | Strong situational understanding, sometimes resorts to more vague terms like 'interacts' instead of assigning a specific action. Loses track of activity that repeats or reverses, so it benefits from annotated frames. |
+| `gemma3`      | Slower model with good vision and temporal understanding                                                                                                             |
-
-#### Embedding models
-
-The `embeddings` role needs a different kind of model. Text queries are matched against the stored image embeddings, so the model must be trained to place images and text into the same vector space. A chat or description model will still return vectors when asked, but those vectors are not trained for retrieval and text searches will return poor matches with no error to indicate why.
-
-| Model                | Notes                                                                                                                                                               |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `qwen3-vl-embedding` | Multimodal embeddings for [Semantic Search](/configuration/semantic_search#genai-provider). Must be served by llama.cpp started with `--embeddings` and `--mmproj`. |
-
-#### Transcription models
-
-The `transcribe` role needs a model that accepts audio input. A text-only or vision-only model cannot serve this role. The following are recommended for local deployment of the `transcribe` role:
-
-| Model       | Notes                                                                                                                                                                                                      |
-| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `qwen3-asr` | Dedicated speech recognition model covering 30 languages, and the better choice for transcription quality. It only transcribes, so it cannot be shared with the `descriptions` or `chat` roles.            |
-| `gemma4`    | General multimodal model that accepts audio as well as images, so one served model can cover `transcribe` alongside the other roles. Transcript quality is below `qwen3-asr`, particularly on noisy audio. |
-
-Both must be served by llama.cpp started with the matching audio `--mmproj`. llama.cpp only reports audio support when an audio projector is loaded. Without it Frigate sees the model as text-only and the `transcribe` role is unavailable in the UI. Frigate transcribes through the server's `/v1/audio/transcriptions` route, which llama.cpp serves for any audio-capable model.
 
 :::info
 
@@ -102,14 +49,15 @@ You should have at least 8 GB of RAM available (or VRAM if running on GPU) to ru
 
 ### Model Types: Instruct vs Thinking
 
-Vision-language models come in **instruct** variants (fine-tuned to follow instructions and respond concisely), **thinking** variants (fine-tuned for free-form, speculative reasoning), and **hybrid** variants that support both modes per request. Most modern vision-language models are hybrid.
+Most vision-language models are available as **instruct** models, which are fine-tuned to follow instructions and respond concisely to prompts. However, some models (such as certain Qwen-VL or minigpt variants) offer both **instruct** and **thinking** versions.
 
-Frigate manages reasoning per task automatically:
+- **Instruct models** are always recommended for use with Frigate. These models generate direct, relevant, actionable descriptions that best fit Frigate's object and event summary use case.
+- **Reasoning / Thinking models** are fine-tuned for more free-form, open-ended, and speculative outputs, which are typically not concise and may not provide the practical summaries Frigate expects. For this reason, Frigate does **not** recommend or support using thinking models.
 
-- **Description tasks** (object descriptions, review descriptions, review summaries) are synthesis-only and benefit from concise, direct output, so Frigate disables thinking for these calls when the model exposes a per-request toggle.
+Some models are labeled as **hybrid** (capable of both thinking and instruct tasks). In these cases, it is recommended to disable reasoning / thinking, which is generally model specific (see your models documentation).
-- **Chat** lets you toggle thinking on or off from the composer when the configured model supports it.
 
-You can use a pure instruct, hybrid, or thinking-capable model with Frigate. No extra configuration is required to disable thinking for descriptions.
+**Recommendation:**
+Always select the `-instruct` or documented instruct/tagged variant of any model you use in your Frigate configuration. If in doubt, refer to your model provider's documentation or model library for guidance on the correct model variant to use.
 
 ### llama.cpp
 
@@ -132,26 +80,23 @@ All llama.cpp native options can be passed through `provider_options`, including
    - Set **Provider** to `llamacpp`
    - Set **Base URL** to your llama.cpp server address (e.g., `http://localhost:8080`)
    - Set **Model** to the name of your model
-   - Optionally, under **Provider Options**, set `context_size` to override the context size Frigate detects from the server
+   - Under **Provider Options**, set `context_size` to tell Frigate your context size so it can send the appropriate amount of information
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
 genai:
-  my_provider:
+  provider: llamacpp
-    provider: llamacpp
+  base_url: http://localhost:8080
-    base_url: http://localhost:8080
+  model: your-model-name
-    model: your-model-name
+  provider_options:
-    provider_options:
+    context_size: 16000 # Tell Frigate your context size so it can send the appropriate amount of information.
-      context_size: 16000 # Optional, overrides the context size reported by the server.
 ```
 
 </TabItem>
 </ConfigTabs>
 
-Frigate queries the llama.cpp server for the model's context size at startup and logs it along with the other detected capabilities. If `context_size` is set in `provider_options`, that value is always used instead, even when the server reports its own.
-
 ### Ollama
 
 [Ollama](https://ollama.com/) allows you to self-host large language models and keep everything running locally. It is highly recommended to host this server on a machine with an Nvidia graphics card, or on a Apple silicon Mac for best performance.
@@ -184,14 +129,13 @@ Note that Frigate will not automatically download the model you specify in your
 
 ```yaml
 genai:
-  my_provider:
+  provider: ollama
-    provider: ollama
+  base_url: http://localhost:11434
-    base_url: http://localhost:11434
+  model: qwen3-vl:4b
-    model: qwen3-vl:4b
+  provider_options: # other Ollama client options can be defined
-    provider_options: # other Ollama client options can be defined
+    keep_alive: -1
-      keep_alive: -1
+    options:
-      options:
+      num_ctx: 8192 # make sure the context matches other services that are using ollama
-        num_ctx: 8192 # make sure the context matches other services that are using ollama
 ```
 
 </TabItem>
@@ -207,12 +151,11 @@ For OpenAI-compatible servers (such as llama.cpp) that don't expose the configur
 
 ```yaml
 genai:
-  my_provider:
+  provider: openai
-    provider: openai
+  base_url: http://your-llama-server
-    base_url: http://your-llama-server
+  model: your-model-name
-    model: your-model-name
+  provider_options:
-    provider_options:
+    context_size: 8192 # Specify the configured context size
-      context_size: 8192 # Specify the configured context size
 ```
 
 This ensures Frigate uses the correct context window size when generating prompts.
@@ -235,11 +178,10 @@ This ensures Frigate uses the correct context window size when generating prompt
 
 ```yaml
 genai:
-  my_provider:
+  provider: openai
-    provider: openai
+  base_url: http://your-server:port
-    base_url: http://your-server:port
+  api_key: your-api-key # May not be required for local servers
-    api_key: your-api-key # May not be required for local servers
+  model: your-model-name
-    model: your-model-name
 ```
 
 </TabItem>
@@ -259,7 +201,7 @@ Cloud Generative AI providers require an active internet connection to send imag
 
 ### Ollama Cloud
 
-Ollama also supports [cloud models](https://ollama.com/cloud), where model inference is performed in the cloud. You can connect directly to Ollama Cloud by setting `base_url` to `https://ollama.com` and providing an API key. Alternatively, you can run Ollama locally and use a cloud model name so your local instance forwards requests to the cloud. For more details, see the Ollama cloud model [docs](https://docs.ollama.com/cloud).
+Ollama also supports [cloud models](https://ollama.com/cloud), where your local Ollama instance handles requests from Frigate, but model inference is performed in the cloud. Set up Ollama locally, sign in with your Ollama account, and specify the cloud model name in your Frigate config. For more details, see the Ollama cloud model [docs](https://docs.ollama.com/cloud).
 
 #### Configuration
 
@@ -268,8 +210,7 @@ Ollama also supports [cloud models](https://ollama.com/cloud), where model infer
 
 1. Navigate to <NavPath path="Settings > Enrichments > Generative AI" />.
    - Set **Provider** to `ollama`
-   - Set **Base URL** to your local Ollama address (e.g., `http://localhost:11434`) or `https://ollama.com` for direct cloud inference
+   - Set **Base URL** to your local Ollama address (e.g., `http://localhost:11434`)
-   - Set **API key** if required by your endpoint (e.g., when using `https://ollama.com`)
    - Set **Model** to the cloud model name
 
 </TabItem>
@@ -277,21 +218,9 @@ Ollama also supports [cloud models](https://ollama.com/cloud), where model infer
 
 ```yaml
 genai:
-  my_provider:
+  provider: ollama
-    provider: ollama
+  base_url: http://localhost:11434
-    base_url: http://localhost:11434
+  model: cloud-model-name
-    model: cloud-model-name
-```
-
-or when using Ollama Cloud directly
-
-```yaml
-genai:
-  my_provider:
-    provider: ollama
-    base_url: https://ollama.com
-    model: cloud-model-name
-    api_key: your-api-key
 ```
 
 </TabItem>
@@ -329,10 +258,9 @@ To start using Gemini, you must first get an API key from [Google AI Studio](htt
 
 ```yaml
 genai:
-  my_provider:
+  provider: gemini
-    provider: gemini
+  api_key: "{FRIGATE_GEMINI_API_KEY}"
-    api_key: "{FRIGATE_GEMINI_API_KEY}"
+  model: gemini-2.5-flash
-    model: gemini-2.5-flash
 ```
 
 </TabItem>
@@ -342,13 +270,12 @@ genai:
 
 To use a different Gemini-compatible API endpoint, set the `provider_options` with the `base_url` key to your provider's API URL. For example:
 
-```yaml {5,6}
+```yaml {4,5}
 genai:
-  my_provider:
+  provider: gemini
-    provider: gemini
+  ...
-    ...
+  provider_options:
-    provider_options:
+    base_url: https://...
-      base_url: https://...
 ```
 
 Other HTTP options are available, see the [python-genai documentation](https://github.com/googleapis/python-genai).
@@ -357,7 +284,7 @@ Other HTTP options are available, see the [python-genai documentation](https://g
 
 ### OpenAI
 
-OpenAI does not have a free tier for their API.
+OpenAI does not have a free tier for their API. With the release of gpt-4o, pricing has been reduced and each generation should cost fractions of a cent if you choose to go this route.
 
 #### Supported Models
 
@@ -382,10 +309,9 @@ To start using OpenAI, you must first [create an API key](https://platform.opena
 
 ```yaml
 genai:
-  my_provider:
+  provider: openai
-    provider: openai
+  api_key: "{FRIGATE_OPENAI_API_KEY}"
-    api_key: "{FRIGATE_OPENAI_API_KEY}"
+  model: gpt-4o
-    model: gpt-4o
 ```
 
 </TabItem>
@@ -401,14 +327,13 @@ To use a different OpenAI-compatible API endpoint, set the `OPENAI_BASE_URL` env
 
 For OpenAI-compatible servers (such as llama.cpp) that don't expose the configured context size in the API response, you can manually specify the context size in `provider_options`:
 
-```yaml {6,7}
+```yaml {5,6}
 genai:
-  my_provider:
+  provider: openai
-    provider: openai
+  base_url: http://your-llama-server
-    base_url: http://your-llama-server
+  model: your-model-name
-    model: your-model-name
+  provider_options:
-    provider_options:
+    context_size: 8192 # Specify the configured context size
-      context_size: 8192 # Specify the configured context size
 ```
 
 This ensures Frigate uses the correct context window size when generating prompts.
@@ -443,91 +368,11 @@ To start using Azure OpenAI, you must first [create a resource](https://learn.mi
 
 ```yaml
 genai:
-  my_provider:
+  provider: azure_openai
-    provider: azure_openai
+  base_url: https://instance.cognitiveservices.azure.com/openai/responses?api-version=2025-04-01-preview
-    base_url: https://instance.cognitiveservices.azure.com/openai/responses?api-version=2025-04-01-preview
+  model: gpt-5-mini
-    model: gpt-5-mini
+  api_key: "{FRIGATE_OPENAI_API_KEY}"
-    api_key: "{FRIGATE_OPENAI_API_KEY}"
 ```
 
 </TabItem>
 </ConfigTabs>
-
-## FAQ
-
-<FaqItem id="how-do-i-debug-genai-issues" question="How do I debug GenAI issues?">
-
-Frigate's Generative AI features are configured and enabled separately. [Review descriptions and summaries](/configuration/genai/genai_review) live under `review.genai`, and [object descriptions](/configuration/genai/genai_objects) live under `objects.genai`. Configuring a provider on this page does not enable either feature, and enabling one does not enable the other. Decide which of the two is not working, then work through the steps below.
-
-1. Confirm a provider is available and holds the `descriptions` role.
-   - Review descriptions, review summaries, and object descriptions all use the provider that has the `descriptions` role assigned in <NavPath path="Settings > Enrichments > Generative AI > Roles" /> (`genai.<provider>.roles`).
-   - A provider is contacted the first time one of its roles is actually used. A provider holding the `embeddings` role for semantic search is initialized during startup, while a `descriptions` provider is not initialized until the first description is requested, which may be well after boot.
-   - In <NavPath path="Settings > Enrichments > Generative AI" />, use **Refresh models** next to the model field. It queries the provider for its model list and is a quick way to verify that the base URL, API key, and network path between Frigate and your provider are correct.
-
-2. Confirm the feature you expect is actually enabled.
-   - Object descriptions are disabled by default. Turn on <NavPath path="Settings > Global configuration > Objects > GenAI object config > Enable GenAI" /> (`objects.genai.enabled`), either globally or per camera. This is the most common reason custom prompts appear to be ignored while review summaries are still being generated.
-   - Review descriptions are disabled by default. Turn on <NavPath path="Settings > Global configuration > Review > GenAI config > Enable GenAI descriptions" /> (`review.genai.enabled`). Once enabled, alerts are described by default but detections are not, so a detection-only review item will never get a summary unless **Enable GenAI for detections** (`review.genai.detections`) is also on.
-
-3. If object descriptions are never requested, check the filters that skip generation.
-   - <NavPath path="Settings > Global configuration > Objects > GenAI object config > GenAI objects" /> (`objects.genai.objects`) limits generation to specific labels, and **Required zones** (`objects.genai.required_zones`) requires the object to have entered one of those zones. If either is set and does not match, Frigate skips the request silently.
-   - Thumbnails are only collected while an object is moving. Objects that go stationary early contribute fewer frames.
-   - **Use snapshots** (`objects.genai.use_snapshot`) requires snapshots to be enabled for the camera. If the snapshot cannot be read, Frigate logs `Cannot load snapshot for <id>, file not found` and no description is generated.
-   - **Send on end** (`objects.genai.send_triggers.tracked_object_end`) is on by default. If you have turned it off in favor of **Early GenAI trigger** (`objects.genai.send_triggers.after_significant_updates`), descriptions are only requested once that number of updates is reached.
-
-4. Enable debug logs to see exactly what Frigate is doing. Restart Frigate after this change. The next step also requires a restart, so turn both on at the same time to avoid restarting twice.
-
-   ```yaml
-   logger:
-     default: info
-     logs:
-       # highlight-start
-       frigate.genai: debug
-       frigate.data_processing.post.object_descriptions: debug
-       frigate.data_processing.post.review_descriptions: debug
-       # highlight-end
-   ```
-
-5. Save the exact images and prompts that were sent to your provider.
-   - Turn on **Save thumbnails** for the feature you are debugging (`review.genai.debug_save_thumbnails` or `objects.genai.debug_save_thumbnails`). Both features write to `/media/frigate/clips/genai-requests/`, and these files are admin-only.
-   - Review descriptions write `genai-requests/<review_id>/` containing the numbered frames that were sent, plus `prompt.txt` and `response.txt` with the exact prompt and the raw, unparsed model response.
-   - Review summary reports write `genai-requests/<start_ts>-<end_ts>/prompt.txt` and `response.txt`. No images are involved, since a report summarizes existing review descriptions.
-   - Object descriptions write `genai-requests/<event_id>/` containing the numbered thumbnails. The prompt for object descriptions is not written to a file, it is only visible in the debug logs from step 4.
-   - Look at the saved images before blaming the model. If the object is small, blurry, or out of frame, no prompt will fix the result. For object descriptions, consider turning on **Use snapshots** (`objects.genai.use_snapshot`) to send a higher quality image. For review items, consider setting **Review image source** (`review.genai.image_source`) to `recordings` for 480p frames instead of the lower resolution preview frames.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-For review descriptions, navigate to <NavPath path="Settings > Global configuration > Review" /> and set **GenAI config > Save thumbnails** to on.
-
-For object descriptions, navigate to <NavPath path="Settings > Global configuration > Objects" />, expand **GenAI object config**, and set **Save thumbnails** to on.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-review:
-  genai:
-    enabled: true
-    # highlight-next-line
-    debug_save_thumbnails: true
-
-objects:
-  genai:
-    enabled: true
-    # highlight-next-line
-    debug_save_thumbnails: true
-```
-
-</TabItem>
-</ConfigTabs>
-
-6. Verify the prompt is what you think it is.
-   - Object description prompts are the ones you control directly. A camera-level <NavPath path="Settings > Camera configuration > Objects > GenAI object config > Caption prompt" /> (`objects.genai.prompt`) overrides the global one, and an entry in **Object prompts** (`objects.genai.object_prompts`) for a label overrides both for that label. Only `{label}`, `{sub_label}`, and `{camera}` are substituted.
-   - Review description prompts are built by Frigate and request a structured JSON response, so they are not fully replaceable. The parts you control are <NavPath path="Settings > Global configuration > Review > GenAI config > Activity context prompt" /> (`review.genai.activity_context_prompt`) and **Additional concerns** (`review.genai.additional_concerns`). Keep the activity context prompt general, since overly specific rules will sway the model's threat level scoring.
-
-7. If descriptions are generated but the results are poor or inconsistent, look at the model and the context window.
-   - Empty fields, missing `shortSummary` values, or `Failed to parse review description` errors usually mean the model is not following the requested JSON schema. Smaller models struggle with structured output. Try a larger parameter size or one of the [recommended models](#recommended-local-models).
-   - Frigate calculates how many frames to send from the context size the provider reports. If your server reports a different value than it is actually running with, frames will be truncated or the request will fail. Pin the value by adding `context_size` under <NavPath path="Settings > Enrichments > Generative AI > Provider options" /> (`genai.<provider>.provider_options`), and for Ollama also confirm `options.num_ctx` there matches the context you have configured.
-   - Check **Review Description Speed** and **Object Description Speed** in <NavPath path="Health and Metrics > Enrichments" />. If inference takes tens of seconds, requests will queue behind each other and descriptions will appear to stop. For Ollama, review `OLLAMA_NUM_PARALLEL`, `OLLAMA_MAX_QUEUE`, and `OLLAMA_MAX_LOADED_MODELS` so that concurrent requests from Frigate are handled the way you expect.
-
-</FaqItem>