Miscellaneous fixes (#21141)

* Remove source_type from API

* Don't require state classification models to select all classes

* Specifically validate provided end_time for manual events

* Remove yolov9 specification for warning

* Remove warning for coral

* clarify zone name tip

* clarify replace rules in lpr docs

* remove periods

* Add explanation for review report

* adjust HLS gap controller params

defaults to false, should help to recover from hangs and stalling in tracking details videos on chrome

* only redirect to login page once on 401

attempt to fix ios pwa safari redirect storm

* Use contextual information from other cameras to inform report summary

* Formatting and prompt improvements for review summary report

* More improvements to prompt

* Remove examples

* Don't show admin action buttons on export card

* fix redirect race condition

Coordinate 401 redirect logic between ApiProvider and ProtectedRoute using a shared flag to prevent multiple simultaneous redirects that caused UI flashing. Ensure both auth error paths check and set the redirect flag before navigating to login, eliminating race conditions where both mechanisms could trigger at once

---------

Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>

.cspell/frigate-dictionary.txt

@@ -0,0 +1,319 @@
+aarch
+absdiff
+airockchip
+Alloc
+alpr
+Amcrest
+amdgpu
+analyzeduration
+Annke
+apexcharts
+arange
+argmax
+argmin
+argpartition
+ascontiguousarray
+astype
+authelia
+authentik
+autodetected
+automations
+autotrack
+autotracked
+autotracker
+autotracking
+balena
+Beelink
+BGRA
+BHWC
+blackshear
+blakeblackshear
+bottombar
+buildx
+castable
+cdist
+Celeron
+cgroups
+chipset
+chromadb
+Chromecast
+cmdline
+codeowner
+CODEOWNERS
+codeproject
+colormap
+colorspace
+comms
+cooldown
+coro
+ctypeslib
+CUDA
+Cuvid
+Dahua
+datasheet
+debconf
+deci
+deepstack
+defragment
+devcontainer
+DEVICEMAP
+discardcorrupt
+dpkg
+dsize
+dtype
+ECONNRESET
+edgetpu
+facenet
+fastapi
+faststart
+fflags
+ffprobe
+fillna
+flac
+foscam
+fourcc
+framebuffer
+fregate
+frégate
+fromarray
+frombuffer
+frontdoor
+fstype
+fullchain
+fullscreen
+genai
+generativeai
+genpts
+getpid
+gpuload
+HACS
+Hailo
+hass
+hconcat
+healthcheck
+hideable
+Hikvision
+homeassistant
+homekit
+homography
+hsize
+hstack
+httpx
+hwaccel
+hwdownload
+hwmap
+hwupload
+iloc
+imagestream
+imdecode
+imencode
+imread
+imwrite
+inpoint
+interp
+iostat
+iotop
+itemsize
+Jellyfin
+jetson
+jetsons
+jina
+jinaai
+joserfc
+jsmpeg
+jsonify
+Kalman
+keepalive
+keepdims
+labelmap
+letsencrypt
+levelname
+LIBAVFORMAT
+libedgetpu
+libnvinfer
+libva
+libwebp
+libx
+libyolo
+linalg
+localzone
+logpipe
+Loryta
+lstsq
+lsusb
+markupsafe
+maxsplit
+MEMHOSTALLOC
+memlimit
+meshgrid
+metadatas
+migraphx
+minilm
+mjpeg
+mkfifo
+mobiledet
+mobilenet
+modelpath
+mosquitto
+mountpoint
+movflags
+mpegts
+mqtt
+mse
+msenc
+namedtuples
+nbytes
+nchw
+ndarray
+ndimage
+nethogs
+newaxis
+nhwc
+NOBLOCK
+nobuffer
+nokey
+NONBLOCK
+noninteractive
+noprint
+Norfair
+nptype
+NTSC
+numpy
+nvenc
+nvhost
+nvml
+nvmpi
+ollama
+onnx
+onnxruntime
+onvif
+ONVIF
+openai
+opencv
+openvino
+overfitting
+OWASP
+paddleocr
+paho
+passwordless
+popleft
+posthog
+postprocess
+poweroff
+preexec
+probesize
+protobuf
+pstate
+psutil
+pubkey
+putenv
+pycache
+pydantic
+pyobj
+pysqlite
+pytz
+pywebpush
+qnap
+quantisation
+Radeon
+radeonsi
+radeontop
+rawvideo
+rcond
+RDONLY
+rebranded
+referer
+reindex
+Reolink
+restream
+restreamed
+restreaming
+rkmpp
+rknn
+rkrga
+rockchip
+rocm
+rocminfo
+rootfs
+rtmp
+RTSP
+ruamel
+scroller
+setproctitle
+setpts
+shms
+SIGUSR
+skylake
+sleeptime
+SNDMORE
+socs
+sqliteq
+sqlitevecq
+ssdlite
+statm
+stimeout
+stylelint
+subclassing
+substream
+superfast
+surveillance
+svscan
+Swipeable
+sysconf
+tailscale
+Tapo
+tensorrt
+tflite
+thresholded
+timelapse
+titlecase
+tmpfs
+tobytes
+toggleable
+traefik
+tzlocal
+Ubiquiti
+udev
+udevadm
+ultrafast
+unichip
+unidecode
+Unifi
+unixepoch
+unraid
+unreviewed
+userdata
+usermod
+uvicorn
+vaapi
+vainfo
+variations
+vbios
+vconcat
+vitb
+vstream
+vsync
+wallclock
+webp
+webpush
+webrtc
+websockets
+webui
+werkzeug
+workdir
+WRONLY
+wsgirefserver
+wsgiutils
+wsize
+xaddr
+xmaxs
+xmins
+XPUB
+XSUB
+ymaxs
+ymins
+yolo
+yolonas
+yolox
+zeep
+zerolatency

.cursor/rules/frontend-always-use-translation-files.mdc

@@ -0,0 +1,6 @@
+---
+globs: ["**/*.ts", "**/*.tsx"]
+alwaysApply: false
+---
+
+Never write strings in the frontend directly, always write to and reference the relevant translations file.

.devcontainer/devcontainer.json

@@ -8,12 +8,32 @@
   "overrideCommand": false,
   "remoteUser": "vscode",
   "features": {
-    "ghcr.io/devcontainers/features/common-utils:1": {}
+    "ghcr.io/devcontainers/features/common-utils:2": {}
+    // Uncomment the following lines to use ONNX Runtime with CUDA support
+    // "ghcr.io/devcontainers/features/nvidia-cuda:1": {
+    //   "installCudnn": true,
+    //   "installNvtx": true,
+    //   "installToolkit": true,
+    //   "cudaVersion": "12.5",
+    //   "cudnnVersion": "9.4.0.58"
+    // },
+    // "./features/onnxruntime-gpu": {}
   },
-  "forwardPorts": [5000, 5001, 5173, 1935, 8554, 8555],
+  "forwardPorts": [
+    8971,
+    5000,
+    5001,
+    5173,
+    8554,
+    8555
+  ],
   "portsAttributes": {
+    "8971": {
+      "label": "External NGINX",
+      "onAutoForward": "silent"
+    },
     "5000": {
-      "label": "NGINX",
+      "label": "Internal NGINX",
       "onAutoForward": "silent"
     },
     "5001": {
@@ -24,10 +44,6 @@
       "label": "Vite Server",
       "onAutoForward": "silent"
     },
-    "1935": {
-      "label": "RTMP",
-      "onAutoForward": "silent"
-    },
     "8554": {
       "label": "gortc RTSP",
       "onAutoForward": "silent"
@@ -42,7 +58,6 @@
       "extensions": [
         "ms-python.python",
         "ms-python.vscode-pylance",
-        "ms-python.black-formatter",
         "visualstudioexptteam.vscodeintellicode",
         "mhutchie.git-graph",
         "ms-azuretools.vscode-docker",
@@ -53,13 +68,11 @@
         "csstools.postcss",
         "blanu.vscode-styled-jsx",
         "bradlc.vscode-tailwindcss",
-        "ms-python.isort",
-        "charliermarsh.ruff"
+        "charliermarsh.ruff",
+        "eamodio.gitlens"
       ],
       "settings": {
         "remote.autoForwardPorts": false,
-        "python.linting.pylintEnabled": true,
-        "python.linting.enabled": true,
         "python.formatting.provider": "none",
         "python.languageServer": "Pylance",
         "editor.formatOnPaste": false,
@@ -67,12 +80,20 @@
         "editor.formatOnType": true,
         "python.testing.pytestEnabled": false,
         "python.testing.unittestEnabled": true,
-        "python.testing.unittestArgs": ["-v", "-s", "./frigate/test"],
+        "python.testing.unittestArgs": [
+          "-v",
+          "-s",
+          "./frigate/test"
+        ],
         "files.trimTrailingWhitespace": true,
-        "eslint.workingDirectories": ["./web"],
-        "isort.args": ["--settings-path=./pyproject.toml"],
+        "eslint.workingDirectories": [
+          "./web"
+        ],
+        "isort.args": [
+          "--settings-path=./pyproject.toml"
+        ],
         "[python]": {
-          "editor.defaultFormatter": "ms-python.black-formatter",
+          "editor.defaultFormatter": "charliermarsh.ruff",
           "editor.formatOnSave": true,
           "editor.codeActionsOnSave": {
             "source.fixAll": true,
@@ -89,8 +110,15 @@
           ],
           "editor.tabSize": 2
         },
-        "cSpell.ignoreWords": ["rtmp"],
-        "cSpell.words": ["preact", "astype", "hwaccel", "mqtt"]
+        "cSpell.ignoreWords": [
+          "rtmp"
+        ],
+        "cSpell.words": [
+          "preact",
+          "astype",
+          "hwaccel",
+          "mqtt"
+        ]
       }
     }
   }

.devcontainer/features/onnxruntime-gpu/devcontainer-feature.json

@@ -0,0 +1,22 @@
+{
+  "id": "onnxruntime-gpu",
+  "version": "0.0.1",
+  "name": "ONNX Runtime GPU (Nvidia)",
+  "description": "Installs ONNX Runtime for Nvidia GPUs.",
+  "documentationURL": "",
+  "options": {
+    "version": {
+      "type": "string",
+      "proposals": [
+        "latest",
+        "1.20.1",
+        "1.20.0"
+      ],
+      "default": "latest",
+      "description": "Version of ONNX Runtime to install"
+    }
+  },
+  "installsAfter": [
+    "ghcr.io/devcontainers/features/nvidia-cuda"
+  ]
+}

.devcontainer/features/onnxruntime-gpu/install.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -e
+
+VERSION=${VERSION}
+
+python3 -m pip config set global.break-system-packages true
+# if VERSION == "latest" or VERSION is empty, install the latest version
+if [ "$VERSION" == "latest" ] || [ -z "$VERSION" ]; then
+    python3 -m pip install onnxruntime-gpu
+else
+    python3 -m pip install onnxruntime-gpu==$VERSION
+fi
+
+echo "Done!"

.devcontainer/post_create.sh

@@ -3,10 +3,12 @@
 set -euxo pipefail
 
 # Cleanup the old github host key
-sed -i -e '/AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31\/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi\/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==/d' ~/.ssh/known_hosts
-# Add new github host key
-curl -L https://api.github.com/meta | jq -r '.ssh_keys | .[]' | \
+if [[ -f ~/.ssh/known_hosts ]]; then
+  # Add new github host key
+  sed -i -e '/AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31\/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi\/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==/d' ~/.ssh/known_hosts
+  curl -L https://api.github.com/meta | jq -r '.ssh_keys | .[]' | \
     sed -e 's/^/github.com /' >> ~/.ssh/known_hosts
+fi
 
 # Frigate normal container runs as root, so it have permission to create
 # the folders. But the devcontainer runs as the host user, so we need to
@@ -17,7 +19,7 @@ sudo chown -R "$(id -u):$(id -g)" /media/frigate
 # When started as a service, LIBAVFORMAT_VERSION_MAJOR is defined in the
 # s6 service file. For dev, where frigate is started from an interactive
 # shell, we define it in .bashrc instead.
-echo 'export LIBAVFORMAT_VERSION_MAJOR=$(ffmpeg -version | grep -Po "libavformat\W+\K\d+")' >> $HOME/.bashrc
+echo 'export LIBAVFORMAT_VERSION_MAJOR=$("$(python3 /usr/local/ffmpeg/get_ffmpeg_path.py)" -version | grep -Po "libavformat\W+\K\d+")' >> "$HOME/.bashrc"
 
 make version
 

.github/DISCUSSION_TEMPLATE/camera-support.yml

@@ -0,0 +1,138 @@
+title: "[Camera Support]: "
+labels: ["support", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for support or questions for an issue with your cameras.
+
+        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the problem you are having
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.14.0-ea36ds1)
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: What browser(s) are you using?
+      placeholder: Google Chrome 88.0.4324.150
+      description: >
+        Provide the full name and don't forget to add the version!
+  - type: textarea
+    id: config
+    attributes:
+      label: Frigate config file
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: frigatelogs
+    attributes:
+      label: Relevant Frigate log output
+      description: Please copy and paste any relevant Frigate log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: go2rtclogs
+    attributes:
+      label: Relevant go2rtc log output
+      description: Please copy and paste any relevant go2rtc log output. Include logs before and after your exact error when possible. Logs can be viewed via the Frigate UI, Docker, or the go2rtc dashboard. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: ffprobe
+    attributes:
+      label: FFprobe output from your camera
+      description: Run `ffprobe <camera_url>` from within the Frigate container if possible, and provide output below
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: stats
+    attributes:
+      label: Frigate stats
+      description: Output from frigate's /api/stats endpoint
+      render: json
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Home Assistant OS
+        - Debian
+        - Other Linux
+        - Proxmox
+        - UNRAID
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - Home Assistant Add-on
+        - Docker Compose
+        - Docker CLI
+        - Proxmox via Docker
+        - Proxmox via TTeck Script
+        - Windows WSL2
+    validations:
+      required: true
+  - type: dropdown
+    id: object-detector
+    attributes:
+      label: Object Detector
+      options:
+        - Coral
+        - OpenVino
+        - TensorRT
+        - RKNN
+        - Other
+        - CPU (no coral)
+    validations:
+      required: true
+  - type: dropdown
+    id: network
+    attributes:
+      label: Network connection
+      options:
+        - Wired
+        - Wireless
+        - Mixed
+    validations:
+      required: true
+  - type: input
+    id: camera
+    attributes:
+      label: Camera make and model
+      description: Dahua, hikvision, amcrest, reolink, etc and model number
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots of the Frigate UI's System metrics pages
+      description: Drag and drop for images is possible in this field. Please post screenshots of at least General and Cameras tabs.
+    validations:
+      required: true
+  - type: textarea
+    id: other
+    attributes:
+      label: Any other information that may be helpful

.github/DISCUSSION_TEMPLATE/config-support.yml

@@ -0,0 +1,113 @@
+title: "[Config Support]: "
+labels: ["support", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for support or questions related to Frigate's configuration and config file.
+
+        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the problem you are having
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.14.0-ea36ds1)
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Frigate config file
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: frigatelogs
+    attributes:
+      label: Relevant Frigate log output
+      description: Please copy and paste any relevant Frigate log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: go2rtclogs
+    attributes:
+      label: Relevant go2rtc log output
+      description: Please copy and paste any relevant go2rtc log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: stats
+    attributes:
+      label: Frigate stats
+      description: Output from frigate's /api/stats endpoint
+      render: json
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Home Assistant OS
+        - Debian
+        - Other Linux
+        - Proxmox
+        - UNRAID
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - Home Assistant Add-on
+        - Docker Compose
+        - Docker CLI
+        - Proxmox via Docker
+        - Proxmox via TTeck Script
+        - Windows WSL2
+    validations:
+      required: true
+  - type: textarea
+    id: docker
+    attributes:
+      label: docker-compose file or Docker CLI command
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: dropdown
+    id: object-detector
+    attributes:
+      label: Object Detector
+      options:
+        - Coral
+        - OpenVino
+        - TensorRT
+        - RKNN
+        - Other
+        - CPU (no coral)
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots of the Frigate UI's System metrics pages
+      description: Drag and drop or simple cut/paste is possible in this field
+  - type: textarea
+    id: other
+    attributes:
+      label: Any other information that may be helpful

.github/DISCUSSION_TEMPLATE/detector-support.yml

@@ -0,0 +1,87 @@
+title: "[Detector Support]: "
+labels: ["support", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for support or questions related to Frigate's object detectors.
+
+        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the problem you are having
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.14.0-ea36ds1)
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Frigate config file
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: docker
+    attributes:
+      label: docker-compose file or Docker CLI command
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: frigatelogs
+    attributes:
+      label: Relevant Frigate log output
+      description: Please copy and paste any relevant Frigate log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - Home Assistant Add-on
+        - Docker Compose
+        - Docker CLI
+        - Proxmox via Docker
+        - Proxmox via TTeck Script
+        - Windows WSL2
+    validations:
+      required: true
+  - type: dropdown
+    id: object-detector
+    attributes:
+      label: Object Detector
+      options:
+        - Coral
+        - OpenVino
+        - TensorRT
+        - RKNN
+        - Other
+        - CPU (no coral)
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots of the Frigate UI's System metrics pages
+      description: Drag and drop for images is possible in this field. Please post screenshots of at least General and Cameras tabs.
+    validations:
+      required: true
+  - type: textarea
+    id: other
+    attributes:
+      label: Any other information that may be helpful

.github/DISCUSSION_TEMPLATE/general-support.yml

@@ -0,0 +1,130 @@
+title: "[Support]: "
+labels: ["support", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for support for issues that don't fall into any specific category.
+
+        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the problem you are having
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.14.0-ea36ds1)
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: What browser(s) are you using?
+      placeholder: Google Chrome 88.0.4324.150
+      description: >
+        Provide the full name and don't forget to add the version!
+  - type: textarea
+    id: config
+    attributes:
+      label: Frigate config file
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: frigatelogs
+    attributes:
+      label: Relevant Frigate log output
+      description: Please copy and paste any relevant Frigate log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: go2rtclogs
+    attributes:
+      label: Relevant go2rtc log output
+      description: Please copy and paste any relevant go2rtc log output. Include logs before and after your exact error when possible. Logs can be viewed via the Frigate UI, Docker, or the go2rtc dashboard. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: ffprobe
+    attributes:
+      label: FFprobe output from your camera
+      description: Run `ffprobe <camera_url>` from within the Frigate container if possible, and provide output below
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: stats
+    attributes:
+      label: Frigate stats
+      description: Output from frigate's /api/stats endpoint
+      render: json
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - Home Assistant Add-on
+        - Docker Compose
+        - Docker CLI
+        - Proxmox via Docker
+        - Proxmox via TTeck Script
+        - Windows WSL2
+    validations:
+      required: true
+  - type: textarea
+    id: docker
+    attributes:
+      label: docker-compose file or Docker CLI command
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: dropdown
+    id: object-detector
+    attributes:
+      label: Object Detector
+      options:
+        - Coral
+        - OpenVino
+        - TensorRT
+        - RKNN
+        - Other
+        - CPU (no coral)
+    validations:
+      required: true
+  - type: dropdown
+    id: network
+    attributes:
+      label: Network connection
+      options:
+        - Wired
+        - Wireless
+        - Mixed
+    validations:
+      required: true
+  - type: input
+    id: camera
+    attributes:
+      label: Camera make and model
+      description: Dahua, hikvision, amcrest, reolink, etc and model number
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots of the Frigate UI's System metrics pages
+      description: Drag and drop for images is possible in this field
+  - type: textarea
+    id: other
+    attributes:
+      label: Any other information that may be helpful

.github/DISCUSSION_TEMPLATE/hardware-acceleration-support.yml

@@ -0,0 +1,120 @@
+title: "[HW Accel Support]: "
+labels: ["support", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form to submit a support request for hardware acceleration issues.
+
+        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the problem you are having
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.14.0-ea36ds1)
+    validations:
+      required: true
+  - type: textarea
+    id: config
+    attributes:
+      label: Frigate config file
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: docker
+    attributes:
+      label: docker-compose file or Docker CLI command
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: frigatelogs
+    attributes:
+      label: Relevant Frigate log output
+      description: Please copy and paste any relevant Frigate log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: go2rtclogs
+    attributes:
+      label: Relevant go2rtc log output
+      description: Please copy and paste any relevant go2rtc log output. Include logs before and after your exact error when possible. Logs can be viewed via the Frigate UI, Docker, or the go2rtc dashboard. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: ffprobe
+    attributes:
+      label: FFprobe output from your camera
+      description: Run `ffprobe <camera_url>` from within the Frigate container if possible, and provide output below
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - Home Assistant Add-on
+        - Docker Compose
+        - Docker CLI
+        - Proxmox via Docker
+        - Proxmox via TTeck Script
+        - Windows WSL2
+    validations:
+      required: true
+  - type: dropdown
+    id: object-detector
+    attributes:
+      label: Object Detector
+      options:
+        - Coral
+        - OpenVino
+        - TensorRT
+        - RKNN
+        - Other
+        - CPU (no coral)
+    validations:
+      required: true
+  - type: dropdown
+    id: network
+    attributes:
+      label: Network connection
+      options:
+        - Wired
+        - Wireless
+        - Mixed
+    validations:
+      required: true
+  - type: input
+    id: camera
+    attributes:
+      label: Camera make and model
+      description: Dahua, hikvision, amcrest, reolink, etc and model number
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots of the Frigate UI's System metrics pages
+      description: Drag and drop for images is possible in this field. Please post screenshots of at least General and Cameras tabs.
+    validations:
+      required: true
+  - type: textarea
+    id: other
+    attributes:
+      label: Any other information that may be helpful

.github/DISCUSSION_TEMPLATE/question.yml

@@ -0,0 +1,21 @@
+title: "[Question]: "
+labels: ["question"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for questions you have about Frigate.
+
+        Before submitting your question, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
+
+        **If you are looking for support, start a new discussion and use a support category.**
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+  - type: textarea
+    id: description
+    attributes:
+      label: "What is your question?"
+    validations:
+      required: true

.github/DISCUSSION_TEMPLATE/report-a-bug.yml

@@ -0,0 +1,149 @@
+title: "[Bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form to submit a reproducible bug in Frigate or Frigate's UI.
+
+        Before submitting your bug report, please ask the AI with the "Ask AI" button on the [official documentation site][ai] about your issue, [search the discussions][discussions], look at recent open and closed [pull requests][prs], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your bug has already been fixed by the developers or reported by the community.
+
+        **If you are unsure if your issue is actually a bug or not, please submit a support request first.**
+
+        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
+        [prs]: https://www.github.com/blakeblackshear/frigate/pulls
+        [docs]: https://docs.frigate.video
+        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai]: https://docs.frigate.video
+  - type: checkboxes
+    attributes:
+      label: Checklist
+      description: Please verify that you've followed these steps
+      options:
+        - label: I have updated to the latest available Frigate version.
+          required: true
+        - label: I have cleared the cache of my browser.
+          required: true
+        - label: I have tried a different browser to see if it is related to my browser.
+          required: true
+        - label: I have tried reproducing the issue in [incognito mode](https://www.computerworld.com/article/1719851/how-to-go-incognito-in-chrome-firefox-safari-and-edge.html) to rule out problems with any third party extensions or plugins I have installed.
+        - label: I have asked the AI at https://docs.frigate.video about my issue.
+          required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the problem you are having
+      description: Provide a clear and concise description of what the bug is.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: |
+        Please tell us exactly how to reproduce your issue.
+        Provide clear and concise step by step instructions and add code snippets if needed.
+      value: |
+        1.
+        2.
+        3.
+        ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.14.0-ea36ds1)
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: In which browser(s) are you experiencing the issue with?
+      placeholder: Google Chrome 88.0.4324.150
+      description: >
+        Provide the full name and don't forget to add the version!
+  - type: textarea
+    id: config
+    attributes:
+      label: Frigate config file
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: docker
+    attributes:
+      label: docker-compose file or Docker CLI command
+      description: This will be automatically formatted into code, so no need for backticks.
+      render: yaml
+    validations:
+      required: true
+  - type: textarea
+    id: frigatelogs
+    attributes:
+      label: Relevant Frigate log output
+      description: Please copy and paste any relevant Frigate log output. Include logs before and after your exact error when possible. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: go2rtclogs
+    attributes:
+      label: Relevant go2rtc log output
+      description: Please copy and paste any relevant go2rtc log output. Include logs before and after your exact error when possible. Logs can be viewed via the Frigate UI, Docker, or the go2rtc dashboard. This will be automatically formatted into code, so no need for backticks.
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Home Assistant OS
+        - Debian
+        - Other Linux
+        - Proxmox
+        - UNRAID
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - Home Assistant Add-on
+        - Docker Compose
+        - Docker CLI
+    validations:
+      required: true
+  - type: dropdown
+    id: network
+    attributes:
+      label: Network connection
+      options:
+        - Wired
+        - Wireless
+        - Mixed
+    validations:
+      required: true
+  - type: input
+    id: camera
+    attributes:
+      label: Camera make and model
+      description: Dahua, hikvision, amcrest, reolink, etc and model number
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots of the Frigate UI's System metrics pages
+      description: Drag and drop for images is possible in this field. Please post screenshots of all tabs.
+    validations:
+      required: true
+  - type: textarea
+    id: other
+    attributes:
+      label: Any other information that may be helpful

.github/FUNDING.yml

@@ -1,3 +1,4 @@
 github:
   - blakeblackshear
   - NickM-27
+  - hawkeye217

.github/ISSUE_TEMPLATE/camera_support_request.yml

@@ -1,107 +0,0 @@
-name: Camera Support Request
-description: Support for setting up cameras in Frigate
-title: "[Camera Support]: "
-labels: ["support", "triage"]
-assignees: []
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Describe the problem you are having
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: Visible on the Debug page in the Web UI
-    validations:
-      required: true
-  - type: textarea
-    id: config
-    attributes:
-      label: Frigate config file
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
-      render: shell
-    validations:
-      required: true
-  - type: textarea
-    id: ffprobe
-    attributes:
-      label: FFprobe output from your camera
-      description: Run `ffprobe <camera_url>` and provide output below
-      render: shell
-    validations:
-      required: true
-  - type: textarea
-    id: stats
-    attributes:
-      label: Frigate stats
-      description: Output from frigate's /api/stats endpoint
-      render: json
-  - type: dropdown
-    id: os
-    attributes:
-      label: Operating system
-      options:
-        - HassOS
-        - Debian
-        - Other Linux
-        - Proxmox
-        - UNRAID
-        - Windows
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: install-method
-    attributes:
-      label: Install method
-      options:
-        - HassOS Addon
-        - Docker Compose
-        - Docker CLI
-    validations:
-      required: true
-  - type: dropdown
-    id: coral
-    attributes:
-      label: Coral version
-      options:
-        - USB
-        - PCIe
-        - M.2
-        - Dev Board
-        - Other
-        - CPU (no coral)
-    validations:
-      required: true
-  - type: dropdown
-    id: network
-    attributes:
-      label: Network connection
-      options:
-        - Wired
-        - Wireless
-        - Mixed
-    validations:
-      required: true
-  - type: input
-    id: camera
-    attributes:
-      label: Camera make and model
-      description: Dahua, hikvision, amcrest, reolink, etc and model number
-    validations:
-      required: true
-  - type: textarea
-    id: other
-    attributes:
-      label: Any other information that may be helpful

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1,8 @@
 blank_issues_enabled: false
+contact_links:
+  - name: Frigate Support
+    url: https://github.com/blakeblackshear/frigate/discussions/new/choose
+    about: Get support for setting up or troubleshooting Frigate.
+  - name: Frigate Bug Report
+    url: https://github.com/blakeblackshear/frigate/discussions/new/choose
+    about: Report a specific UI or backend bug.

.github/ISSUE_TEMPLATE/config_support_request.yml

@@ -1,82 +0,0 @@
-name: Config Support Request
-description: Support for Frigate configuration
-title: "[Config Support]: "
-labels: ["support", "triage"]
-assignees: []
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Describe the problem you are having
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: Visible on the Debug page in the Web UI
-    validations:
-      required: true
-  - type: textarea
-    id: config
-    attributes:
-      label: Frigate config file
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
-      render: shell
-    validations:
-      required: true
-  - type: textarea
-    id: stats
-    attributes:
-      label: Frigate stats
-      description: Output from frigate's /api/stats endpoint
-      render: json
-  - type: dropdown
-    id: os
-    attributes:
-      label: Operating system
-      options:
-        - HassOS
-        - Debian
-        - Other Linux
-        - Proxmox
-        - UNRAID
-        - Windows
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: install-method
-    attributes:
-      label: Install method
-      options:
-        - HassOS Addon
-        - Docker Compose
-        - Docker CLI
-    validations:
-      required: true
-  - type: dropdown
-    id: coral
-    attributes:
-      label: Coral version
-      options:
-        - USB
-        - PCIe
-        - M.2
-        - Dev Board
-        - Other
-        - CPU (no coral)
-    validations:
-      required: true
-  - type: textarea
-    id: other
-    attributes:
-      label: Any other information that may be helpful

.github/ISSUE_TEMPLATE/detector_support_request.yml

@@ -1,84 +0,0 @@
-name: Detector Support Request
-description: Support for setting up object detector in Frigate (Coral, OpenVINO, TensorRT, etc.)
-title: "[Detector Support]: "
-labels: ["support", "triage"]
-assignees: []
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Describe the problem you are having
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: Visible on the Debug page in the Web UI
-    validations:
-      required: true
-  - type: textarea
-    id: config
-    attributes:
-      label: Frigate config file
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: docker
-    attributes:
-      label: docker-compose file or Docker CLI command
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
-      render: shell
-    validations:
-      required: true
-  - type: dropdown
-    id: os
-    attributes:
-      label: Operating system
-      options:
-        - HassOS
-        - Debian
-        - Other Linux
-        - Proxmox
-        - UNRAID
-        - Windows
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: install-method
-    attributes:
-      label: Install method
-      options:
-        - HassOS Addon
-        - Docker Compose
-        - Docker CLI
-    validations:
-      required: true
-  - type: dropdown
-    id: coral
-    attributes:
-      label: Coral version
-      options:
-        - USB
-        - PCIe
-        - M.2
-        - Dev Board
-        - Other
-        - CPU (no coral)
-    validations:
-      required: true
-  - type: textarea
-    id: other
-    attributes:
-      label: Any other information that may be helpful

.github/ISSUE_TEMPLATE/general_support_request.yml

@@ -1,107 +0,0 @@
-name: General Support Request
-description: General support request for Frigate
-title: "[Support]: "
-labels: ["support", "triage"]
-assignees: []
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Describe the problem you are having
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: Visible on the Debug page in the Web UI
-    validations:
-      required: true
-  - type: textarea
-    id: config
-    attributes:
-      label: Frigate config file
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
-      render: shell
-    validations:
-      required: true
-  - type: textarea
-    id: ffprobe
-    attributes:
-      label: FFprobe output from your camera
-      description: Run `ffprobe <camera_url>` and provide output below
-      render: shell
-    validations:
-      required: true
-  - type: textarea
-    id: stats
-    attributes:
-      label: Frigate stats
-      description: Output from frigate's /api/stats endpoint
-      render: json
-  - type: dropdown
-    id: os
-    attributes:
-      label: Operating system
-      options:
-        - HassOS
-        - Debian
-        - Other Linux
-        - Proxmox
-        - UNRAID
-        - Windows
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: install-method
-    attributes:
-      label: Install method
-      options:
-        - HassOS Addon
-        - Docker Compose
-        - Docker CLI
-    validations:
-      required: true
-  - type: dropdown
-    id: coral
-    attributes:
-      label: Coral version
-      options:
-        - USB
-        - PCIe
-        - M.2
-        - Dev Board
-        - Other
-        - CPU (no coral)
-    validations:
-      required: true
-  - type: dropdown
-    id: network
-    attributes:
-      label: Network connection
-      options:
-        - Wired
-        - Wireless
-        - Mixed
-    validations:
-      required: true
-  - type: input
-    id: camera
-    attributes:
-      label: Camera make and model
-      description: Dahua, hikvision, amcrest, reolink, etc and model number
-    validations:
-      required: true
-  - type: textarea
-    id: other
-    attributes:
-      label: Any other information that may be helpful

.github/ISSUE_TEMPLATE/hwaccel_support_request.yml

@@ -1,96 +0,0 @@
-name: Hardware Acceleration Support Request
-description: Support for setting up GPU hardware acceleration in Frigate
-title: "[HW Accel Support]: "
-labels: ["support", "triage"]
-assignees: []
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Describe the problem you are having
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: Visible on the Debug page in the Web UI
-    validations:
-      required: true
-  - type: textarea
-    id: config
-    attributes:
-      label: Frigate config file
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: docker
-    attributes:
-      label: docker-compose file or Docker CLI command
-      description: This will be automatically formatted into code, so no need for backticks.
-      render: yaml
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
-      render: shell
-    validations:
-      required: true
-  - type: textarea
-    id: ffprobe
-    attributes:
-      label: FFprobe output from your camera
-      description: Run `ffprobe <camera_url>` and provide output below
-      render: shell
-    validations:
-      required: true
-  - type: dropdown
-    id: os
-    attributes:
-      label: Operating system
-      options:
-        - HassOS
-        - Debian
-        - Other Linux
-        - Proxmox
-        - UNRAID
-        - Windows
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: install-method
-    attributes:
-      label: Install method
-      options:
-        - HassOS Addon
-        - Docker Compose
-        - Docker CLI
-    validations:
-      required: true
-  - type: dropdown
-    id: network
-    attributes:
-      label: Network connection
-      options:
-        - Wired
-        - Wireless
-        - Mixed
-    validations:
-      required: true
-  - type: input
-    id: camera
-    attributes:
-      label: Camera make and model
-      description: Dahua, hikvision, amcrest, reolink, etc and model number
-    validations:
-      required: true
-  - type: textarea
-    id: other
-    attributes:
-      label: Any other information that may be helpful

.github/actions/setup/action.yml

@@ -5,26 +5,37 @@ inputs:
     required: true
 outputs:
   image-name:
-    value: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ github.ref_name }}-${{ steps.create-short-sha.outputs.SHORT_SHA }}
+    value: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ steps.create-short-sha.outputs.SHORT_SHA }}
   cache-name:
     value: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:cache
 runs:
   using: "composite"
   steps:
-    - name: Remove unnecessary files
-      run: |
-        sudo rm -rf /usr/share/dotnet
-        sudo rm -rf /usr/local/lib/android
-        sudo rm -rf /opt/ghc
+    # Stop docker so we can mount more space at /var/lib/docker
+    - name: Stop docker
+      run: sudo systemctl stop docker
+      shell: bash
+    # This creates a virtual volume at /var/lib/docker to maximize the size
+    # As of 2/14/2024, this results in 97G for docker images
+    - name: Maximize build space
+      uses: easimon/maximize-build-space@master
+      with:
+        remove-dotnet: 'true'
+        remove-android: 'true'
+        remove-haskell: 'true'
+        remove-codeql: 'true'
+        build-mount-path: '/var/lib/docker'
+    - name: Start docker
+      run: sudo systemctl start docker
       shell: bash
     - id: lowercaseRepo
       uses: ASzc/change-string-case-action@v5
       with:
         string: ${{ github.repository }}
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@v3
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v3
     - name: Log in to the Container registry
       uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
       with:

.github/dependabot.yml

@@ -18,6 +18,12 @@ updates:
       interval: daily
     open-pull-requests-limit: 10
     target-branch: dev
+  - package-ecosystem: "pip"
+    directory: "/docker/tensorrt"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    target-branch: dev
   - package-ecosystem: "npm"
     directory: "/web"
     schedule:
@@ -28,5 +34,7 @@ updates:
     directory: "/docs"
     schedule:
       interval: daily
+    allow:
+      - dependency-name: "@docusaurus/*"
     open-pull-requests-limit: 10
     target-branch: dev

.github/pull_request_template.md

@@ -0,0 +1,39 @@
+## Proposed change
+<!--
+  Thank you!
+
+  If you're introducing a new feature or significantly refactoring existing functionality,
+  we encourage you to start a discussion first. This helps ensure your idea aligns with
+  Frigate's development goals.
+
+  Describe what this pull request does and how it will benefit users of Frigate.
+  Please describe in detail any considerations, breaking changes, etc. that are
+  made in this pull request.
+-->
+
+
+## Type of change
+
+- [ ] Dependency upgrade
+- [ ] Bugfix (non-breaking change which fixes an issue)
+- [ ] New feature
+- [ ] Breaking change (fix/feature causing existing functionality to break)
+- [ ] Code quality improvements to existing code
+- [ ] Documentation Update
+
+## Additional information
+
+- This PR fixes or closes issue: fixes #
+- This PR is related to issue:
+
+## Checklist
+
+<!--
+  Put an `x` in the boxes that apply.
+-->
+
+- [ ] The code change is tested and works locally.
+- [ ] Local tests pass. **Your PR cannot be merged unless tests pass**
+- [ ] There is no commented out code in this PR.
+- [ ] UI changes including text have used i18n keys and have been added to the `en` locale.
+- [ ] The code has been formatted using Ruff (`ruff format frigate`)

.github/workflows/ci.yml

@@ -6,6 +6,8 @@ on:
     branches:
       - dev
       - master
+    paths-ignore:
+      - "docs/**"
 
 # only run the latest commit to avoid cache overwrites
 concurrency:
@@ -13,15 +15,17 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: 3.9
+  PYTHON_VERSION: 3.11
 
 jobs:
   amd64_build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     name: AMD64 Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up QEMU and Buildx
         id: setup
         uses: ./.github/actions/setup
@@ -37,22 +41,15 @@ jobs:
           target: frigate
           tags: ${{ steps.setup.outputs.image-name }}-amd64
           cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64
-      - name: Build and push TensorRT (x86 GPU)
-        uses: docker/bake-action@v4
-        with:
-          push: true
-          targets: tensorrt
-          files: docker/tensorrt/trt.hcl
-          set: |
-            tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt
-            *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64
-            *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64,mode=max
+          cache-to: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64,mode=max
   arm64_build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04-arm
     name: ARM Build
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up QEMU and Buildx
         id: setup
         uses: ./.github/actions/setup
@@ -70,8 +67,9 @@ jobs:
             ${{ steps.setup.outputs.image-name }}-standard-arm64
           cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64
       - name: Build and push RPi build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
         with:
+          source: .
           push: true
           targets: rpi
           files: docker/rpi/rpi.hcl
@@ -79,71 +77,130 @@ jobs:
             rpi.tags=${{ steps.setup.outputs.image-name }}-rpi
             *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64
             *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64,mode=max
-      - name: Build and push RockChip build
-        uses: docker/bake-action@v3
+  jetson_jp6_build:
+    runs-on: ubuntu-22.04-arm
+    name: Jetson Jetpack 6
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v5
         with:
+          persist-credentials: false
+      - name: Set up QEMU and Buildx
+        id: setup
+        uses: ./.github/actions/setup
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push TensorRT (Jetson, Jetpack 6)
+        env:
+          ARCH: arm64
+          BASE_IMAGE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu
+          SLIM_BASE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu
+          TRT_BASE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu
+        uses: docker/bake-action@v6
+        with:
+          source: .
+          push: true
+          targets: tensorrt
+          files: docker/tensorrt/trt.hcl
+          set: |
+            tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt-jp6
+            *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp6
+            *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp6,mode=max
+  amd64_extra_builds:
+    runs-on: ubuntu-22.04
+    name: AMD64 Extra Build
+    needs:
+      - amd64_build
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Set up QEMU and Buildx
+        id: setup
+        uses: ./.github/actions/setup
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push TensorRT (x86 GPU)
+        env:
+          COMPUTE_LEVEL: "50 60 70 80 90"
+        uses: docker/bake-action@v6
+        with:
+          source: .
+          push: true
+          targets: tensorrt
+          files: docker/tensorrt/trt.hcl
+          set: |
+            tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt
+            *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-tensorrt
+            *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-tensorrt,mode=max
+      - name: AMD/ROCm general build
+        env:
+          HSA_OVERRIDE: 0
+        uses: docker/bake-action@v6
+        with:
+          source: .
+          push: true
+          targets: rocm
+          files: docker/rocm/rocm.hcl
+          set: |
+            rocm.tags=${{ steps.setup.outputs.image-name }}-rocm
+            *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-rocm,mode=max
+            *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-rocm
+  arm64_extra_builds:
+    runs-on: ubuntu-22.04-arm
+    name: ARM Extra Build
+    needs:
+      - arm64_build
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Set up QEMU and Buildx
+        id: setup
+        uses: ./.github/actions/setup
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push Rockchip build
+        uses: docker/bake-action@v6
+        with:
+          source: .
           push: true
           targets: rk
           files: docker/rockchip/rk.hcl
           set: |
             rk.tags=${{ steps.setup.outputs.image-name }}-rk
             *.cache-from=type=gha
-  jetson_jp4_build:
-    runs-on: ubuntu-latest
-    name: Jetson Jetpack 4
+  synaptics_build:
+    runs-on: ubuntu-22.04-arm
+    name: Synaptics Build
+    needs:
+      - arm64_build
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up QEMU and Buildx
         id: setup
         uses: ./.github/actions/setup
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push TensorRT (Jetson, Jetpack 4)
-        env:
-          ARCH: arm64
-          BASE_IMAGE: timongentzsch/l4t-ubuntu20-opencv:latest
-          SLIM_BASE: timongentzsch/l4t-ubuntu20-opencv:latest
-          TRT_BASE: timongentzsch/l4t-ubuntu20-opencv:latest
-        uses: docker/bake-action@v4
+      - name: Build and push Synaptics build
+        uses: docker/bake-action@v6
         with:
+          source: .
           push: true
-          targets: tensorrt
-          files: docker/tensorrt/trt.hcl
+          targets: synaptics
+          files: docker/synaptics/synaptics.hcl
           set: |
-            tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt-jp4
-            *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp4
-            *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp4,mode=max
-  jetson_jp5_build:
-    runs-on: ubuntu-latest
-    name: Jetson Jetpack 5
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-      - name: Set up QEMU and Buildx
-        id: setup
-        uses: ./.github/actions/setup
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push TensorRT (Jetson, Jetpack 5)
-        env:
-          ARCH: arm64
-          BASE_IMAGE: nvcr.io/nvidia/l4t-tensorrt:r8.5.2-runtime
-          SLIM_BASE: nvcr.io/nvidia/l4t-tensorrt:r8.5.2-runtime
-          TRT_BASE: nvcr.io/nvidia/l4t-tensorrt:r8.5.2-runtime
-        uses: docker/bake-action@v4
-        with:
-          push: true
-          targets: tensorrt
-          files: docker/tensorrt/trt.hcl
-          set: |
-            tensorrt.tags=${{ steps.setup.outputs.image-name }}-tensorrt-jp5
-            *.cache-from=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp5
-            *.cache-to=type=registry,ref=${{ steps.setup.outputs.cache-name }}-jp5,mode=max
+            synaptics.tags=${{ steps.setup.outputs.image-name }}-synaptics
+            *.cache-from=type=gha
   # The majority of users running arm64 are rpi users, so the rpi
   # build should be the primary arm64 image
   assemble_default_build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     name: Assemble and push default build
     needs:
       - amd64_build
@@ -154,16 +211,16 @@ jobs:
         with:
           string: ${{ github.repository }}
       - name: Log in to the Container registry
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Create short sha
         run: echo "SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV
-      - uses: int128/docker-manifest-create-action@v1
+      - uses: int128/docker-manifest-create-action@v2
         with:
-          tags: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ github.ref_name }}-${{ env.SHORT_SHA }}
-          suffixes: |
-            -amd64
-            -rpi
+          tags: ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ env.SHORT_SHA }}
+          sources: |
+            ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ env.SHORT_SHA }}-amd64
+            ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}:${{ env.SHORT_SHA }}-rpi

.github/workflows/dependabot-auto-merge.yaml

@@ -1,24 +0,0 @@
-name: dependabot-auto-merge
-on: pull_request
-
-permissions:
-  contents: write
-
-jobs:
-  dependabot-auto-merge:
-    runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
-    steps:
-      - name: Get Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v1
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Enable auto-merge for Dependabot PRs
-        if: steps.metadata.outputs.dependency-type == 'direct:development' && (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch')
-        run: |
-          gh pr review --approve "$PR_URL"
-          gh pr merge --auto --squash "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pull_request.yml

@@ -1,40 +1,24 @@
 name: On pull request
 
-on: pull_request
+on:
+  pull_request:
+    paths-ignore:
+      - "docs/**"
+      - ".github/*.yml"
+      - ".github/DISCUSSION_TEMPLATE/**"
+      - ".github/ISSUE_TEMPLATE/**"
 
 env:
-  DEFAULT_PYTHON: 3.9
+  DEFAULT_PYTHON: 3.11
 
 jobs:
-  build_devcontainer:
-    runs-on: ubuntu-latest
-    name: Build Devcontainer
-    # The Dockerfile contains features that requires buildkit, and since the
-    # devcontainer cli uses docker-compose to build the image, the only way to
-    # ensure docker-compose uses buildkit is to explicitly enable it.
-    env:
-      DOCKER_BUILDKIT: "1"
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@master
-        with:
-          node-version: 16.x
-      - name: Install devcontainer cli
-        run: npm install --global @devcontainers/cli
-      - name: Build devcontainer
-        run: devcontainer build --workspace-folder .
-      # It would be nice to also test the following commands, but for some
-      # reason they don't work even though in VS Code devcontainer works.
-      # - name: Start devcontainer
-      #   run: devcontainer up --workspace-folder .
-      # - name: Run devcontainer scripts
-      #   run: devcontainer run-user-commands --workspace-folder .
-
   web_lint:
     name: Web - Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@master
         with:
           node-version: 16.x
@@ -48,37 +32,41 @@ jobs:
     name: Web - Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@master
         with:
-          node-version: 16.x
+          node-version: 20.x
       - run: npm install
         working-directory: ./web
-      - name: Test
-        run: npm run test
+      - name: Build web
+        run: npm run build
         working-directory: ./web
+      # - name: Test
+      #   run: npm run test
+      #   working-directory: ./web
 
   python_checks:
     runs-on: ubuntu-latest
     name: Python Checks
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
-        uses: actions/setup-python@v4.7.1
+        uses: actions/setup-python@v5.4.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
       - name: Install requirements
         run: |
           python3 -m pip install -U pip
           python3 -m pip install -r docker/main/requirements-dev.txt
-      - name: Check black
+      - name: Check formatting
         run: |
-          black --check --diff frigate migrations docker *.py
-      - name: Check isort
-        run: |
-          isort --check --diff frigate migrations docker *.py
-      - name: Check ruff
+          ruff format --check --diff frigate migrations docker *.py
+      - name: Check lint
         run: |
           ruff check frigate migrations docker *.py
 
@@ -87,22 +75,21 @@ jobs:
     name: Python Tests
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@master
         with:
-          node-version: 16.x
-      - run: npm install
-        working-directory: ./web
-      - name: Build web
-        run: npm run build
-        working-directory: ./web
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build
-        run: make
-      - name: Run mypy
-        run: docker run --rm --entrypoint=python3 frigate:latest -u -m mypy --config-file frigate/mypy.ini frigate
-      - name: Run tests
-        run: docker run --rm --entrypoint=python3 frigate:latest -u -m unittest
+          node-version: 20.x
+      - name: Install devcontainer cli
+        run: npm install --global @devcontainers/cli
+      - name: Build devcontainer
+        env:
+          DOCKER_BUILDKIT: "1"
+        run: devcontainer build --workspace-folder .
+      - name: Start devcontainer
+        run: devcontainer up --workspace-folder .
+      - name: Run mypy in devcontainer
+        run: devcontainer exec --workspace-folder . bash -lc "python3 -u -m mypy --config-file frigate/mypy.ini frigate"
+      - name: Run unit tests in devcontainer
+        run: devcontainer exec --workspace-folder . bash -lc "python3 -u -m unittest"

.github/workflows/release.yml

@@ -1,6 +1,7 @@
 name: On release
 
 on:
+  workflow_dispatch:
   release:
     types: [published]
 
@@ -9,55 +10,43 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - id: lowercaseRepo
         uses: ASzc/change-string-case-action@v6
         with:
           string: ${{ github.repository }}
       - name: Log in to the Container registry
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Create tag variables
+        env:
+          TAG: ${{ github.ref_name }}
+          LOWERCASE_REPO: ${{ steps.lowercaseRepo.outputs.lowercase }}
         run: |
-          BRANCH=$([[ "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "master" || echo "dev")
-          echo "BASE=ghcr.io/${{ steps.lowercaseRepo.outputs.lowercase }}" >> $GITHUB_ENV
-          echo "BUILD_TAG=${BRANCH}-${GITHUB_SHA::7}" >> $GITHUB_ENV
+          BUILD_TYPE=$([[ "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "stable" || echo "beta")
+          echo "BUILD_TYPE=${BUILD_TYPE}" >> $GITHUB_ENV
+          echo "BASE=ghcr.io/${LOWERCASE_REPO}" >> $GITHUB_ENV
+          echo "BUILD_TAG=${GITHUB_SHA::7}" >> $GITHUB_ENV
           echo "CLEAN_VERSION=$(echo ${GITHUB_REF##*/} | tr '[:upper:]' '[:lower:]' | sed 's/^[v]//')" >> $GITHUB_ENV
       - name: Tag and push the main image
         run: |
           VERSION_TAG=${BASE}:${CLEAN_VERSION}
+          STABLE_TAG=${BASE}:stable
           PULL_TAG=${BASE}:${BUILD_TAG}
-          docker pull ${PULL_TAG}
-          docker tag ${PULL_TAG} ${VERSION_TAG}
-          docker push ${VERSION_TAG}
-      - name: Tag and push standard arm64
-        run: |
-          VERSION_TAG=${BASE}:${CLEAN_VERSION}-standard-arm64
-          PULL_TAG=${BASE}:${BUILD_TAG}-standard-arm64
-          docker pull ${PULL_TAG}
-          docker tag ${PULL_TAG} ${VERSION_TAG}
-          docker push ${VERSION_TAG}
-      - name: Tag and push tensorrt
-        run: |
-          VERSION_TAG=${BASE}:${CLEAN_VERSION}-tensorrt
-          PULL_TAG=${BASE}:${BUILD_TAG}-tensorrt
-          docker pull ${PULL_TAG}
-          docker tag ${PULL_TAG} ${VERSION_TAG}
-          docker push ${VERSION_TAG}
-      - name: Tag and push tensorrt-jp4
-        run: |
-          VERSION_TAG=${BASE}:${CLEAN_VERSION}-tensorrt-jp4
-          PULL_TAG=${BASE}:${BUILD_TAG}-tensorrt-jp4
-          docker pull ${PULL_TAG}
-          docker tag ${PULL_TAG} ${VERSION_TAG}
-          docker push ${VERSION_TAG}
-      - name: Tag and push tensorrt-jp5
-        run: |
-          VERSION_TAG=${BASE}:${CLEAN_VERSION}-tensorrt-jp5
-          PULL_TAG=${BASE}:${BUILD_TAG}-tensorrt-jp5
-          docker pull ${PULL_TAG}
-          docker tag ${PULL_TAG} ${VERSION_TAG}
-          docker push ${VERSION_TAG}
+          docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG} docker://${VERSION_TAG}
+          for variant in standard-arm64 tensorrt tensorrt-jp6 rk rocm; do
+            docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG}-${variant} docker://${VERSION_TAG}-${variant}
+          done
+
+          # stable tag
+          if [[ "${BUILD_TYPE}" == "stable" ]]; then
+            docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG} docker://${STABLE_TAG}
+            for variant in standard-arm64 tensorrt tensorrt-jp6 rk rocm; do
+              docker run --rm -v $HOME/.docker/config.json:/config.json quay.io/skopeo/stable:latest copy --authfile /config.json --multi-arch all docker://${PULL_TAG}-${variant} docker://${STABLE_TAG}-${variant}
+            done
+          fi

.github/workflows/stale.yml

@@ -23,4 +23,20 @@ jobs:
           exempt-pr-labels: "pinned,security,dependencies"
           operations-per-run: 120
       - name: Print outputs
-        run: echo ${{ join(steps.stale.outputs.*, ',') }}
+        env:
+          STALE_OUTPUT: ${{ join(steps.stale.outputs.*, ',') }}
+        run: echo "$STALE_OUTPUT"
+
+  # clean_ghcr:
+  #   name: Delete outdated dev container images
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Delete old images
+  #       uses: snok/container-retention-policy@v2
+  #       with:
+  #         image-names: dev-*
+  #         cut-off: 60 days ago UTC
+  #         keep-at-least: 5
+  #         account-type: personal
+  #         token: ${{ secrets.GITHUB_TOKEN }}
+  #         token-type: github-token

.gitignore

@@ -1,5 +1,6 @@
 .DS_Store
-*.pyc
+__pycache__
+.mypy_cache
 *.swp
 debug
 .vscode/*
@@ -8,13 +9,14 @@ config/*
 !config/*.example
 models
 *.mp4
-*.ts
 *.db
 *.csv
 frigate/version.py
 web/build
 web/node_modules
 web/coverage
+web/.env
 core
 !/web/**/*.ts
 .idea/*
+.ipynb_checkpoints

.vscode/launch.json

@@ -3,10 +3,9 @@
   "configurations": [
     {
       "name": "Python: Launch Frigate",
-      "type": "python",
+      "type": "debugpy",
       "request": "launch",
-      "module": "frigate",
-      "justMyCode": true
+      "module": "frigate"
     }
   ]
 }

CODEOWNERS

@@ -2,5 +2,6 @@
 /docker/tensorrt/ @madsciencetist @NateMeyer
 /docker/tensorrt/*arm64* @madsciencetist
 /docker/tensorrt/*jetson* @madsciencetist
-
 /docker/rockchip/ @MarcA711
+/docker/rocm/ @harakas
+/docker/hailo8l/ @spanner3003

LICENSE

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright (c) 2020 Blake Blackshear
+Copyright (c) 2025 Frigate LLC (Frigate™)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -1,11 +1,9 @@
 default_target: local
 
 COMMIT_HASH := $(shell git log -1 --pretty=format:"%h"|tail -1)
-VERSION = 0.13.0
+VERSION = 0.17.0
 IMAGE_REPO ?= ghcr.io/blakeblackshear/frigate
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
-CURRENT_UID := $(shell id -u)
-CURRENT_GID := $(shell id -g)
 BOARDS= #Initialized empty
 
 include docker/*/*.mk
@@ -16,27 +14,47 @@ push-boards: $(BOARDS:%=push-%)
 
 version:
 	echo 'VERSION = "$(VERSION)-$(COMMIT_HASH)"' > frigate/version.py
+	echo 'VITE_GIT_COMMIT_HASH=$(COMMIT_HASH)' > web/.env
 
 local: version
-	docker buildx build --target=frigate --tag frigate:latest --load --file docker/main/Dockerfile .
+	docker buildx build --target=frigate --file docker/main/Dockerfile . \
+		--tag frigate:latest \
+		--load
+
+debug: version
+	docker buildx build --target=frigate --file docker/main/Dockerfile . \
+	    --build-arg DEBUG=true \
+		--tag frigate:latest \
+		--load
 
 amd64:
-	docker buildx build --platform linux/amd64 --target=frigate --tag $(IMAGE_REPO):$(VERSION)-$(COMMIT_HASH) --file docker/main/Dockerfile .
+	docker buildx build --target=frigate --file docker/main/Dockerfile . \
+		--tag $(IMAGE_REPO):$(VERSION)-$(COMMIT_HASH) \
+		--platform linux/amd64
 
 arm64:
-	docker buildx build --platform linux/arm64 --target=frigate --tag $(IMAGE_REPO):$(VERSION)-$(COMMIT_HASH) --file docker/main/Dockerfile .
+	docker buildx build --target=frigate --file docker/main/Dockerfile . \
+		--tag $(IMAGE_REPO):$(VERSION)-$(COMMIT_HASH) \
+		--platform linux/arm64
 
 build: version amd64 arm64
-	docker buildx build --platform linux/arm64/v8,linux/amd64 --target=frigate --tag $(IMAGE_REPO):$(VERSION)-$(COMMIT_HASH) --file docker/main/Dockerfile .
+	docker buildx build --target=frigate --file docker/main/Dockerfile . \
+		--tag $(IMAGE_REPO):$(VERSION)-$(COMMIT_HASH) \
+		--platform linux/arm64/v8,linux/amd64
 
 push: push-boards
-	docker buildx build --push --platform linux/arm64/v8,linux/amd64 --target=frigate --tag $(IMAGE_REPO):${GITHUB_REF_NAME}-$(COMMIT_HASH) --file docker/main/Dockerfile .
+	docker buildx build --target=frigate --file docker/main/Dockerfile . \
+		--tag $(IMAGE_REPO):${GITHUB_REF_NAME}-$(COMMIT_HASH) \
+		--platform linux/arm64/v8,linux/amd64 \
+		--push
 
 run: local
 	docker run --rm --publish=5000:5000 --volume=${PWD}/config:/config frigate:latest
 
 run_tests: local
-	docker run --rm --workdir=/opt/frigate --entrypoint= frigate:latest python3 -u -m unittest
-	docker run --rm --workdir=/opt/frigate --entrypoint= frigate:latest python3 -u -m mypy --config-file frigate/mypy.ini frigate
+	docker run --rm --workdir=/opt/frigate --entrypoint= frigate:latest \
+		python3 -u -m unittest
+	docker run --rm --workdir=/opt/frigate --entrypoint= frigate:latest \
+		python3 -u -m mypy --config-file frigate/mypy.ini frigate
 
 .PHONY: run_tests

README.md

@@ -1,12 +1,20 @@
 <p align="center">
-  <img align="center" alt="logo" src="docs/static/img/frigate.png">
+  <img align="center" alt="logo" src="docs/static/img/branding/frigate.png">
 </p>
 
-# Frigate - NVR With Realtime Object Detection for IP Cameras
+# Frigate NVR™ - Realtime Object Detection for IP Cameras
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+<a href="https://hosted.weblate.org/engage/frigate-nvr/">
+<img src="https://hosted.weblate.org/widget/frigate-nvr/language-badge.svg" alt="Translation status" />
+</a>
+
+\[English\] | [简体中文](https://github.com/blakeblackshear/frigate/blob/dev/README_CN.md)
 
 A complete and local NVR designed for [Home Assistant](https://www.home-assistant.io) with AI object detection. Uses OpenCV and Tensorflow to perform realtime object detection locally for IP cameras.
 
-Use of a [Google Coral Accelerator](https://coral.ai/products/) is optional, but highly recommended. The Coral will outperform even the best CPUs and can process 100+ FPS with very little overhead.
+Use of a GPU or AI accelerator is highly recommended. AI accelerators will outperform even the best CPUs with very little overhead. See Frigate's supported [object detectors](https://docs.frigate.video/configuration/object_detectors/).
 
 - Tight integration with Home Assistant via a [custom component](https://github.com/blakeblackshear/frigate-hass-integration)
 - Designed to minimize resource use and maximize performance by only looking for objects when and where it is necessary
@@ -27,20 +35,49 @@ View the documentation at https://docs.frigate.video
 
 If you would like to make a donation to support development, please use [Github Sponsors](https://github.com/sponsors/blakeblackshear).
 
+## License
+
+This project is licensed under the **MIT License**.
+
+- **Code:** The source code, configuration files, and documentation in this repository are available under the [MIT License](LICENSE). You are free to use, modify, and distribute the code as long as you include the original copyright notice.
+- **Trademarks:** The "Frigate" name, the "Frigate NVR" brand, and the Frigate logo are **trademarks of Frigate LLC** and are **not** covered by the MIT License.
+
+Please see our [Trademark Policy](TRADEMARK.md) for details on acceptable use of our brand assets.
+
 ## Screenshots
 
-Integration into Home Assistant
+### Live dashboard
 
 <div>
-<a href="docs/static/img/media_browser.png"><img src="docs/static/img/media_browser.png" height=400></a>
-<a href="docs/static/img/notification.png"><img src="docs/static/img/notification.png" height=400></a>
+<img width="800" alt="Live dashboard" src="https://github.com/blakeblackshear/frigate/assets/569905/5e713cb9-9db5-41dc-947a-6937c3bc376e">
 </div>
 
-Also comes with a builtin UI:
+### Streamlined review workflow
 
 <div>
-<a href="docs/static/img/home-ui.png"><img src="docs/static/img/home-ui.png" height=400></a>
-<a href="docs/static/img/camera-ui.png"><img src="docs/static/img/camera-ui.png" height=400></a>
+<img width="800" alt="Streamlined review workflow" src="https://github.com/blakeblackshear/frigate/assets/569905/6fed96e8-3b18-40e5-9ddc-31e6f3c9f2ff">
 </div>
 
-![Events](docs/static/img/events-ui.png)
+### Multi-camera scrubbing
+
+<div>
+<img width="800" alt="Multi-camera scrubbing" src="https://github.com/blakeblackshear/frigate/assets/569905/d6788a15-0eeb-4427-a8d4-80b93cae3d74">
+</div>
+
+### Built-in mask and zone editor
+
+<div>
+<img width="800" alt="Multi-camera scrubbing" src="https://github.com/blakeblackshear/frigate/assets/569905/d7885fc3-bfe6-452f-b7d0-d957cb3e31f5">
+</div>
+
+## Translations
+
+We use [Weblate](https://hosted.weblate.org/projects/frigate-nvr/) to support language translations. Contributions are always welcome.
+
+<a href="https://hosted.weblate.org/engage/frigate-nvr/">
+<img src="https://hosted.weblate.org/widget/frigate-nvr/multi-auto.svg" alt="Translation status" />
+</a>
+
+---
+
+**Copyright © 2025 Frigate LLC.**

README_CN.md

@@ -0,0 +1,89 @@
+<p align="center">
+  <img align="center" alt="logo" src="docs/static/img/branding/frigate.png">
+</p>
+
+# Frigate NVR™ - 一个具有实时目标检测的本地 NVR
+
+[English](https://github.com/blakeblackshear/frigate) | \[简体中文\]
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+<a href="https://hosted.weblate.org/engage/frigate-nvr/-/zh_Hans/">
+<img src="https://hosted.weblate.org/widget/frigate-nvr/-/zh_Hans/svg-badge.svg" alt="翻译状态" />
+</a>
+
+一个完整的本地网络视频录像机（NVR），专为[Home Assistant](https://www.home-assistant.io)设计，具备 AI 目标/物体检测功能。使用 OpenCV 和 TensorFlow 在本地为 IP 摄像头执行实时物体检测。
+
+强烈推荐使用 GPU 或者 AI 加速器（例如[Google Coral 加速器](https://coral.ai/products/) 或者 [Hailo](https://hailo.ai/)等）。它们的运行效率远远高于现在的顶级 CPU，并且功耗也极低。
+
+- 通过[自定义组件](https://github.com/blakeblackshear/frigate-hass-integration)与 Home Assistant 紧密集成
+- 设计上通过仅在必要时和必要地点寻找目标，最大限度地减少资源使用并最大化性能
+- 大量利用多进程处理，强调实时性而非处理每一帧
+- 使用非常低开销的画面变动检测（也叫运动检测）来确定运行目标检测的位置
+- 使用 TensorFlow 进行目标检测，并运行在单独的进程中以达到最大 FPS
+- 通过 MQTT 进行通信，便于集成到其他系统中
+- 根据检测到的物体设置保留时间进行视频录制
+- 24/7 全天候录制
+- 通过 RTSP 重新流传输以减少摄像头的连接数
+- 支持 WebRTC 和 MSE，实现低延迟的实时观看
+
+## 社区中文翻译文档
+
+你可以在这里查看文档 https://docs.frigate-cn.video
+
+## 赞助
+
+如果您想通过捐赠支持开发，请使用 [Github Sponsors](https://github.com/sponsors/blakeblackshear)。
+
+## 协议
+
+本项目采用 **MIT 许可证**授权。
+**代码部分**：本代码库中的源代码、配置文件和文档均遵循 [MIT 许可证](LICENSE)。您可以自由使用、修改和分发这些代码，但必须保留原始版权声明。
+
+**商标部分**：“Frigate”名称、“Frigate NVR”品牌以及 Frigate 的 Logo 为 **Frigate LLC 的商标**，**不在** MIT 许可证覆盖范围内。
+有关品牌资产的规范使用详情，请参阅我们的[《商标政策》](TRADEMARK.md)。
+
+## 截图
+
+### 实时监控面板
+
+<div>
+<img width="800" alt="实时监控面板" src="https://github.com/blakeblackshear/frigate/assets/569905/5e713cb9-9db5-41dc-947a-6937c3bc376e">
+</div>
+
+### 简单的核查工作流程
+
+<div>
+<img width="800" alt="简单的审查工作流程" src="https://github.com/blakeblackshear/frigate/assets/569905/6fed96e8-3b18-40e5-9ddc-31e6f3c9f2ff">
+</div>
+
+### 多摄像头可按时间轴查看
+
+<div>
+<img width="800" alt="多摄像头可按时间轴查看" src="https://github.com/blakeblackshear/frigate/assets/569905/d6788a15-0eeb-4427-a8d4-80b93cae3d74">
+</div>
+
+### 内置遮罩和区域编辑器
+
+<div>
+<img width="800" alt="内置遮罩和区域编辑器" src="https://github.com/blakeblackshear/frigate/assets/569905/d7885fc3-bfe6-452f-b7d0-d957cb3e31f5">
+</div>
+
+## 翻译
+
+我们使用 [Weblate](https://hosted.weblate.org/projects/frigate-nvr/) 平台提供翻译支持，欢迎参与进来一起完善。
+
+## 非官方中文讨论社区
+
+欢迎加入中文讨论 QQ 群：[1043861059](https://qm.qq.com/q/7vQKsTmSz)
+
+Bilibili：https://space.bilibili.com/3546894915602564
+
+## 中文社区赞助商
+
+[![EdgeOne](https://edgeone.ai/media/34fe3a45-492d-4ea4-ae5d-ea1087ca7b4b.png)](https://edgeone.ai/zh?from=github)
+本项目 CDN 加速及安全防护由 Tencent EdgeOne 赞助
+
+---
+
+**Copyright © 2025 Frigate LLC.**

TRADEMARK.md

@@ -0,0 +1,58 @@
+# Trademark Policy
+
+**Last Updated:** November 2025
+
+This document outlines the policy regarding the use of the trademarks associated with the Frigate NVR project.
+
+## 1. Our Trademarks
+
+The following terms and visual assets are trademarks (the "Marks") of **Frigate LLC**:
+
+- **Frigate™**
+- **Frigate NVR™**
+- **Frigate+™**
+- **The Frigate Logo**
+
+**Note on Common Law Rights:**
+Frigate LLC asserts all common law rights in these Marks. The absence of a federal registration symbol (®) does not constitute a waiver of our intellectual property rights.
+
+## 2. Interaction with the MIT License
+
+The software in this repository is licensed under the [MIT License](LICENSE).
+
+**Crucial Distinction:**
+
+- The **Code** is free to use, modify, and distribute under the MIT terms.
+- The **Brand (Trademarks)** is **NOT** licensed under MIT.
+
+You may not use the Marks in any way that is not explicitly permitted by this policy or by written agreement with Frigate LLC.
+
+## 3. Acceptable Use
+
+You may use the Marks without prior written permission in the following specific contexts:
+
+- **Referential Use:** To truthfully refer to the software (e.g., _"I use Frigate NVR for my home security"_).
+- **Compatibility:** To indicate that your product or project works with the software (e.g., _"MyPlugin for Frigate NVR"_ or _"Compatible with Frigate"_).
+- **Commentary:** In news articles, blog posts, or tutorials discussing the software.
+
+## 4. Prohibited Use
+
+You may **NOT** use the Marks in the following ways:
+
+- **Commercial Products:** You may not use "Frigate" in the name of a commercial product, service, or app (e.g., selling an app named _"Frigate Viewer"_ is prohibited).
+- **Implying Affiliation:** You may not use the Marks in a way that suggests your project is official, sponsored by, or endorsed by Frigate LLC.
+- **Confusing Forks:** If you fork this repository to create a derivative work, you **must** remove the Frigate logo and rename your project to avoid user confusion. You cannot distribute a modified version of the software under the name "Frigate".
+- **Domain Names:** You may not register domain names containing "Frigate" that are likely to confuse users (e.g., `frigate-official-support.com`).
+
+## 5. The Logo
+
+The Frigate logo (the bird icon) is a visual trademark.
+
+- You generally **cannot** use the logo on your own website or product packaging without permission.
+- If you are building a dashboard or integration that interfaces with Frigate, you may use the logo only to represent the Frigate node/service, provided it does not imply you _are_ Frigate.
+
+## 6. Questions & Permissions
+
+If you are unsure if your intended use violates this policy, or if you wish to request a specific license to use the Marks (e.g., for a partnership), please contact us at:
+
+**help@frigate.video**

benchmark.py

@@ -5,11 +5,12 @@ from statistics import mean
 import numpy as np
 
 from frigate.config import DetectorTypeEnum
-from frigate.object_detection import (
+from frigate.object_detection.base import (
     ObjectDetectProcess,
     RemoteObjectDetector,
     load_labels,
 )
+from frigate.util.process import FrigateProcess
 
 my_frame = np.expand_dims(np.full((300, 300, 3), 1, np.uint8), axis=0)
 labels = load_labels("/labelmap.txt")
@@ -60,7 +61,7 @@ def start(id, num_detections, detection_queue, event):
     object_detector.cleanup()
     print(f"{id} - Processed for {duration:.2f} seconds.")
     print(f"{id} - FPS: {object_detector.fps.eps():.2f}")
-    print(f"{id} - Average frame processing time: {mean(frame_times)*1000:.2f}ms")
+    print(f"{id} - Average frame processing time: {mean(frame_times) * 1000:.2f}ms")
 
 
 ######
@@ -90,7 +91,7 @@ edgetpu_process_2 = ObjectDetectProcess(
 )
 
 for x in range(0, 10):
-    camera_process = mp.Process(
+    camera_process = FrigateProcess(
         target=start, args=(x, 300, detection_queue, events[str(x)])
     )
     camera_process.daemon = True

cspell.json

@@ -0,0 +1,22 @@
+{
+  "version": "0.2",
+  "ignorePaths": [
+    "Dockerfile",
+    "Dockerfile.*",
+    "CMakeLists.txt",
+    "*.db",
+    "node_modules",
+    "__pycache__",
+    "dist",
+    "/audio-labelmap.txt"
+  ],
+  "language": "en",
+  "dictionaryDefinitions": [
+    {
+      "name": "frigate-dictionary",
+      "path": "./.cspell/frigate-dictionary.txt",
+      "addWords": true
+    }
+  ],
+  "dictionaries": ["frigate-dictionary"]
+}

docker-compose.yml

@@ -1,8 +1,8 @@
-version: "3"
 services:
   devcontainer:
     container_name: frigate-devcontainer
-    # add groups from host for render, plugdev, video
+    # Check host system's actual render/video/plugdev group IDs with 'getent group render', 'getent group video', and 'getent group plugdev'
+    # Must add these exact IDs in container's group_add section or OpenVINO GPU acceleration will fail
     group_add:
       - "109" # render
       - "110" # render
@@ -14,17 +14,18 @@ services:
       dockerfile: docker/main/Dockerfile
       # Use target devcontainer-trt for TensorRT dev
       target: devcontainer
-    deploy:
-          resources:
-              reservations:
-                  devices:
-                      - driver: nvidia
-                        count: 1
-                        capabilities: [gpu]
+    ## Uncomment this block for nvidia gpu support
+    # deploy:
+    #       resources:
+    #           reservations:
+    #               devices:
+    #                   - driver: nvidia
+    #                     count: 1
+    #                     capabilities: [gpu]
     environment:
-      YOLO_MODELS: yolov7-320
-    devices:
-      - /dev/bus/usb:/dev/bus/usb
+      YOLO_MODELS: ""
+    # devices:
+      # - /dev/bus/usb:/dev/bus/usb # Uncomment for Google Coral USB
       # - /dev/dri:/dev/dri # for intel hwaccel, needs to be updated for your hardware
     volumes:
       - .:/workspace/frigate:cached
@@ -32,9 +33,10 @@ services:
       - /etc/localtime:/etc/localtime:ro
       - ./config:/config
       - ./debug:/media/frigate
-      - /dev/bus/usb:/dev/bus/usb
+     # - /dev/bus/usb:/dev/bus/usb # Uncomment for Google Coral USB
   mqtt:
     container_name: mqtt
-    image: eclipse-mosquitto:1.6
+    image: eclipse-mosquitto:2.0
+    command: mosquitto -c /mosquitto-no-auth.conf # enable no-auth mode
     ports:
       - "1883:1883"

docker/hailo8l/user_installation.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# Update package list and install dependencies
+sudo apt-get update
+sudo apt-get install -y build-essential cmake git wget
+
+hailo_version="4.21.0"
+arch=$(uname -m)
+
+if [[ $arch == "x86_64" ]]; then
+    sudo apt install -y linux-headers-$(uname -r);
+else
+    sudo apt install -y linux-modules-extra-$(uname -r);
+fi
+
+# Clone the HailoRT driver repository
+git clone --depth 1 --branch v${hailo_version} https://github.com/hailo-ai/hailort-drivers.git
+
+# Build and install the HailoRT driver
+cd hailort-drivers/linux/pcie
+sudo make all
+sudo make install
+
+# Load the Hailo PCI driver
+sudo modprobe hailo_pci
+
+if [ $? -ne 0 ]; then
+  echo "Unable to load hailo_pci module, common reasons for this are:"
+  echo "- Key was rejected by service: Secure Boot is enabling disallowing install."
+  echo "- Permissions are not setup correctly."
+  exit 1
+fi
+
+# Download and install the firmware
+cd ../../
+./download_firmware.sh
+
+# verify the firmware folder is present
+if [ ! -d /lib/firmware/hailo ]; then
+  sudo mkdir /lib/firmware/hailo
+fi
+sudo mv hailo8_fw.*.bin /lib/firmware/hailo/hailo8_fw.bin
+
+# Install udev rules
+sudo cp ./linux/pcie/51-hailo-udev.rules /etc/udev/rules.d/
+sudo udevadm control --reload-rules && sudo udevadm trigger
+
+echo "HailoRT driver installation complete."
+echo "reboot your system to load the firmware!"

docker/main/Dockerfile

@@ -3,14 +3,29 @@
 # https://askubuntu.com/questions/972516/debian-frontend-environment-variable
 ARG DEBIAN_FRONTEND=noninteractive
 
-ARG BASE_IMAGE=debian:11
-ARG SLIM_BASE=debian:11-slim
+# Globally set pip break-system-packages option to avoid having to specify it every time
+ARG PIP_BREAK_SYSTEM_PACKAGES=1
+
+ARG BASE_IMAGE=debian:12
+ARG SLIM_BASE=debian:12-slim
+
+# A hook that allows us to inject commands right after the base images
+ARG BASE_HOOK=
 
 FROM ${BASE_IMAGE} AS base
+ARG PIP_BREAK_SYSTEM_PACKAGES
+ARG BASE_HOOK
 
-FROM --platform=${BUILDPLATFORM} debian:11 AS base_host
+RUN sh -c "$BASE_HOOK"
+
+FROM --platform=${BUILDPLATFORM} debian:12 AS base_host
+ARG PIP_BREAK_SYSTEM_PACKAGES
 
 FROM ${SLIM_BASE} AS slim-base
+ARG PIP_BREAK_SYSTEM_PACKAGES
+ARG BASE_HOOK
+
+RUN sh -c "$BASE_HOOK"
 
 FROM slim-base AS wget
 ARG DEBIAN_FRONTEND
@@ -24,24 +39,34 @@ ARG DEBIAN_FRONTEND
 ENV CCACHE_DIR /root/.ccache
 ENV CCACHE_MAXSIZE 2G
 
-# bind /var/cache/apt to tmpfs to speed up nginx build
-RUN --mount=type=tmpfs,target=/tmp --mount=type=tmpfs,target=/var/cache/apt \
-    --mount=type=bind,source=docker/main/build_nginx.sh,target=/deps/build_nginx.sh \
-    --mount=type=cache,target=/root/.ccache \
+RUN --mount=type=bind,source=docker/main/build_nginx.sh,target=/deps/build_nginx.sh \
     /deps/build_nginx.sh
 
+FROM wget AS sqlite-vec
+ARG DEBIAN_FRONTEND
+
+# Build sqlite_vec from source
+COPY docker/main/build_sqlite_vec.sh /deps/build_sqlite_vec.sh
+RUN --mount=type=tmpfs,target=/tmp --mount=type=tmpfs,target=/var/cache/apt \
+    --mount=type=bind,source=docker/main/build_sqlite_vec.sh,target=/deps/build_sqlite_vec.sh \
+    --mount=type=cache,target=/root/.ccache \
+    /deps/build_sqlite_vec.sh
+
 FROM scratch AS go2rtc
 ARG TARGETARCH
 WORKDIR /rootfs/usr/local/go2rtc/bin
-ADD --link --chmod=755 "https://github.com/AlexxIT/go2rtc/releases/download/v1.8.1/go2rtc_linux_${TARGETARCH}" go2rtc
+ADD --link --chmod=755 "https://github.com/AlexxIT/go2rtc/releases/download/v1.9.10/go2rtc_linux_${TARGETARCH}" go2rtc
 
+FROM wget AS tempio
+ARG TARGETARCH
+RUN --mount=type=bind,source=docker/main/install_tempio.sh,target=/deps/install_tempio.sh \
+    /deps/install_tempio.sh
 
 ####
 #
 # OpenVino Support
 #
 # 1. Download and convert a model from Intel's Public Open Model Zoo
-# 2. Build libUSB without udev to handle NCS2 enumeration
 #
 ####
 # Download and Convert OpenVino model
@@ -51,17 +76,25 @@ ARG DEBIAN_FRONTEND
 # Install OpenVino Runtime and Dev library
 COPY docker/main/requirements-ov.txt /requirements-ov.txt
 RUN apt-get -qq update \
-    && apt-get -qq install -y wget python3 python3-distutils \
+    && apt-get -qq install -y wget python3 python3-dev python3-distutils gcc pkg-config libhdf5-dev \
     && wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
+    && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
     && python3 get-pip.py "pip" \
-    && pip install -r /requirements-ov.txt
+    && pip3 install -r /requirements-ov.txt
 
 # Get OpenVino Model
-RUN mkdir /models \
-    && cd /models && omz_downloader --name ssdlite_mobilenet_v2 \
-    && cd /models && omz_converter --name ssdlite_mobilenet_v2 --precision FP16
-
+RUN --mount=type=bind,source=docker/main/build_ov_model.py,target=/build_ov_model.py \
+    mkdir /models && cd /models \
+    && wget http://download.tensorflow.org/models/object_detection/ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz \
+    && tar -xvf ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz \
+    && python3 /build_ov_model.py
 
+####
+#
+# Coral Compatibility
+#
+# Builds libusb without udev. Needed for synology and other devices with USB coral
+####
 # libUSB - No Udev
 FROM wget as libusb-build
 ARG TARGETARCH
@@ -97,11 +130,12 @@ RUN wget -qO edgetpu_model.tflite https://github.com/google-coral/test_data/raw/
 RUN wget -qO cpu_model.tflite https://github.com/google-coral/test_data/raw/release-frogfish/ssdlite_mobiledet_coco_qat_postprocess.tflite
 COPY labelmap.txt .
 # Copy OpenVino model
-COPY --from=ov-converter /models/public/ssdlite_mobilenet_v2/FP16 openvino-model
+COPY --from=ov-converter /models/ssdlite_mobilenet_v2.xml openvino-model/
+COPY --from=ov-converter /models/ssdlite_mobilenet_v2.bin openvino-model/
 RUN wget -q https://github.com/openvinotoolkit/open_model_zoo/raw/master/data/dataset_classes/coco_91cl_bkgr.txt -O openvino-model/coco_91cl_bkgr.txt && \
     sed -i 's/truck/car/g' openvino-model/coco_91cl_bkgr.txt
 # Get Audio Model and labels
-RUN wget -qO cpu_audio_model.tflite https://tfhub.dev/google/lite-model/yamnet/classification/tflite/1?lite-format=tflite
+RUN wget -qO - https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download | tar xvz && mv 1.tflite cpu_audio_model.tflite
 COPY audio-labelmap.txt .
 
 
@@ -114,59 +148,71 @@ RUN --mount=type=bind,source=docker/main/install_s6_overlay.sh,target=/deps/inst
 FROM base AS wheels
 ARG DEBIAN_FRONTEND
 ARG TARGETARCH
+ARG DEBUG=false
 
 # Use a separate container to build wheels to prevent build dependencies in final image
 RUN apt-get -qq update \
     && apt-get -qq install -y \
-    apt-transport-https \
-    gnupg \
-    wget \
-    # the key fingerprint can be obtained from https://ftp-master.debian.org/keys.html
-    && wget -qO- "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xA4285295FC7B1A81600062A9605C66F00D6C9793" | \
-    gpg --dearmor > /usr/share/keyrings/debian-archive-bullseye-stable.gpg \
-    && echo "deb [signed-by=/usr/share/keyrings/debian-archive-bullseye-stable.gpg] http://deb.debian.org/debian bullseye main contrib non-free" | \
-    tee /etc/apt/sources.list.d/debian-bullseye-nonfree.list \
+    apt-transport-https wget unzip \
     && apt-get -qq update \
     && apt-get -qq install -y \
-    python3.9 \
-    python3.9-dev \
+    python3.11 \
+    python3.11-dev \
     # opencv dependencies
     build-essential cmake git pkg-config libgtk-3-dev \
     libavcodec-dev libavformat-dev libswscale-dev libv4l-dev \
     libxvidcore-dev libx264-dev libjpeg-dev libpng-dev libtiff-dev \
     gfortran openexr libatlas-base-dev libssl-dev\
-    libtbb2 libtbb-dev libdc1394-22-dev libopenexr-dev \
+    libtbbmalloc2 libtbb-dev libdc1394-dev libopenexr-dev \
     libgstreamer-plugins-base1.0-dev libgstreamer1.0-dev \
+    # sqlite3 dependencies
+    tclsh \
     # scipy dependencies
     gcc gfortran libopenblas-dev liblapack-dev && \
     rm -rf /var/lib/apt/lists/*
 
-# Ensure python3 defaults to python3.9
-RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.9 1
+RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
 
 RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
+    && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
     && python3 get-pip.py "pip"
 
 COPY docker/main/requirements.txt /requirements.txt
+COPY docker/main/requirements-dev.txt /requirements-dev.txt
+
 RUN pip3 install -r /requirements.txt
 
-COPY docker/main/requirements-wheels.txt /requirements-wheels.txt
-RUN pip3 wheel --wheel-dir=/wheels -r /requirements-wheels.txt
+# Build pysqlite3 from source
+COPY docker/main/build_pysqlite3.sh /build_pysqlite3.sh
+RUN /build_pysqlite3.sh
 
+COPY docker/main/requirements-wheels.txt /requirements-wheels.txt
+RUN pip3 wheel --wheel-dir=/wheels -r /requirements-wheels.txt && \
+    if [ "$DEBUG" = "true" ]; then \
+        pip3 wheel --wheel-dir=/wheels -r /requirements-dev.txt; \
+    fi
+
+# Install HailoRT & Wheels
+RUN --mount=type=bind,source=docker/main/install_hailort.sh,target=/deps/install_hailort.sh \
+    /deps/install_hailort.sh
 
 # Collect deps in a single layer
 FROM scratch AS deps-rootfs
 COPY --from=nginx /usr/local/nginx/ /usr/local/nginx/
+COPY --from=sqlite-vec /usr/local/lib/ /usr/local/lib/
 COPY --from=go2rtc /rootfs/ /
 COPY --from=libusb-build /usr/local/lib /usr/local/lib
+COPY --from=tempio /rootfs/ /
 COPY --from=s6-overlay /rootfs/ /
 COPY --from=models /rootfs/ /
+COPY --from=wheels /rootfs/ /
 COPY docker/main/rootfs/ /
 
 
 # Frigate deps (ffmpeg, python, nginx, go2rtc, s6-overlay, etc)
 FROM slim-base AS deps
 ARG TARGETARCH
+ARG BASE_IMAGE
 
 ARG DEBIAN_FRONTEND
 # http://stackoverflow.com/questions/48162574/ddg#49462622
@@ -176,38 +222,67 @@ ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=DontWarn
 ENV NVIDIA_VISIBLE_DEVICES=all
 ENV NVIDIA_DRIVER_CAPABILITIES="compute,video,utility"
 
-ENV PATH="/usr/lib/btbn-ffmpeg/bin:/usr/local/go2rtc/bin:/usr/local/nginx/sbin:${PATH}"
+# Disable tokenizer parallelism warning
+# https://stackoverflow.com/questions/62691279/how-to-disable-tokenizers-parallelism-true-false-warning/72926996#72926996
+ENV TOKENIZERS_PARALLELISM=true
+# https://github.com/huggingface/transformers/issues/27214
+ENV TRANSFORMERS_NO_ADVISORY_WARNINGS=1
+
+# Set OpenCV ffmpeg loglevel to fatal: https://ffmpeg.org/doxygen/trunk/log_8h.html
+ENV OPENCV_FFMPEG_LOGLEVEL=8
+
+# Set NumPy to ignore getlimits warning
+ENV PYTHONWARNINGS="ignore:::numpy.core.getlimits"
+
+# Set HailoRT to disable logging
+ENV HAILORT_LOGGER_PATH=NONE
+
+# TensorFlow error only
+ENV TF_CPP_MIN_LOG_LEVEL=3
+
+ENV PATH="/usr/local/go2rtc/bin:/usr/local/tempio/bin:/usr/local/nginx/sbin:${PATH}"
 
 # Install dependencies
 RUN --mount=type=bind,source=docker/main/install_deps.sh,target=/deps/install_deps.sh \
     /deps/install_deps.sh
 
+ENV DEFAULT_FFMPEG_VERSION="7.0"
+ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:5.0"
+
+RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
+    && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
+    && python3 get-pip.py "pip"
+
 RUN --mount=type=bind,from=wheels,source=/wheels,target=/deps/wheels \
-    python3 -m pip install --upgrade pip && \
     pip3 install -U /deps/wheels/*.whl
 
+# Install MemryX runtime (requires libgomp (OpenMP) in the final docker image)
+RUN --mount=type=bind,source=docker/main/install_memryx.sh,target=/deps/install_memryx.sh \
+    bash -c "bash /deps/install_memryx.sh"
+
 COPY --from=deps-rootfs / /
 
 RUN ldconfig
 
 EXPOSE 5000
-EXPOSE 1935
 EXPOSE 8554
 EXPOSE 8555/tcp 8555/udp
 
 # Configure logging to prepend timestamps, log to stdout, keep 0 archives and rotate on 10MB
 ENV S6_LOGGING_SCRIPT="T 1 n0 s10000000 T"
+# Do not fail on long-running download scripts
+ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
 
 ENTRYPOINT ["/init"]
 CMD []
 
-HEALTHCHECK --start-period=120s --start-interval=5s --interval=15s --timeout=5s --retries=3 \
-    CMD curl --fail --silent --show-error http://127.0.0.1:5000/api/version || exit 1
+HEALTHCHECK --start-period=300s --start-interval=5s --interval=15s --timeout=5s --retries=3 \
+    CMD test -f /dev/shm/.frigate-is-stopping && exit 0; curl --fail --silent --show-error http://127.0.0.1:5000/api/version || exit 1
 
 # Frigate deps with Node.js and NPM for devcontainer
 FROM deps AS devcontainer
 
-# Do not start the actual Frigate service on devcontainer as it will be started by VSCode
+# Do not start the actual Frigate service on devcontainer as it will be started by VS Code
 # But start a fake service for simulating the logs
 COPY docker/main/fake_frigate_run /etc/s6-overlay/s6-rc.d/frigate/run
 
@@ -215,13 +290,13 @@ COPY docker/main/fake_frigate_run /etc/s6-overlay/s6-rc.d/frigate/run
 RUN mkdir -p /opt/frigate \
     && ln -svf /workspace/frigate/frigate /opt/frigate/frigate
 
-# Install Node 16
-RUN apt-get update \
-    && apt-get install wget -y \
-    && wget -qO- https://deb.nodesource.com/setup_16.x | bash - \
-    && apt-get install -y nodejs \
+# Install Node 20
+RUN curl -SLO https://deb.nodesource.com/nsolid_setup_deb.sh && \
+    chmod 500 nsolid_setup_deb.sh && \
+    ./nsolid_setup_deb.sh 20 && \
+    apt-get install nodejs -y \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@9
+    && npm install -g npm@10
 
 WORKDIR /workspace/frigate
 
@@ -232,12 +307,14 @@ RUN apt-get update \
 RUN --mount=type=bind,source=./docker/main/requirements-dev.txt,target=/workspace/frigate/requirements-dev.txt \
     pip3 install -r requirements-dev.txt
 
+HEALTHCHECK NONE
+
 CMD ["sleep", "infinity"]
 
 
 # Frigate web build
 # This should be architecture agnostic, so speed up the build on multiarch by not using QEMU.
-FROM --platform=$BUILDPLATFORM node:16 AS web-build
+FROM --platform=$BUILDPLATFORM node:20 AS web-build
 
 WORKDIR /work
 COPY web/package.json web/package-lock.json ./

docker/main/build_nginx.sh

@@ -2,15 +2,22 @@
 
 set -euxo pipefail
 
-NGINX_VERSION="1.25.3"
+NGINX_VERSION="1.27.4"
 VOD_MODULE_VERSION="1.31"
 SECURE_TOKEN_MODULE_VERSION="1.5"
-RTMP_MODULE_VERSION="1.2.2"
+SET_MISC_MODULE_VERSION="v0.33"
+NGX_DEVEL_KIT_VERSION="v0.3.3"
+
+source /etc/os-release
+
+if [[ "$VERSION_ID" == "12" ]]; then
+    sed -i '/^Types:/s/deb/& deb-src/' /etc/apt/sources.list.d/debian.sources
+else
+    cp /etc/apt/sources.list /etc/apt/sources.list.d/sources-src.list
+    sed -i 's|deb http|deb-src http|g' /etc/apt/sources.list.d/sources-src.list
+fi
 
-cp /etc/apt/sources.list /etc/apt/sources.list.d/sources-src.list
-sed -i 's|deb http|deb-src http|g' /etc/apt/sources.list.d/sources-src.list
 apt-get update
-
 apt-get -yqq build-dep nginx
 
 apt-get -yqq install --no-install-recommends ca-certificates wget
@@ -49,10 +56,16 @@ mkdir /tmp/nginx-secure-token-module
 wget https://github.com/kaltura/nginx-secure-token-module/archive/refs/tags/${SECURE_TOKEN_MODULE_VERSION}.tar.gz
 tar -zxf ${SECURE_TOKEN_MODULE_VERSION}.tar.gz -C /tmp/nginx-secure-token-module --strip-components=1
 rm ${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-mkdir /tmp/nginx-rtmp-module
-wget -nv https://github.com/arut/nginx-rtmp-module/archive/refs/tags/v${RTMP_MODULE_VERSION}.tar.gz
-tar -zxf v${RTMP_MODULE_VERSION}.tar.gz -C /tmp/nginx-rtmp-module --strip-components=1
-rm v${RTMP_MODULE_VERSION}.tar.gz
+
+mkdir /tmp/ngx_devel_kit
+wget https://github.com/vision5/ngx_devel_kit/archive/refs/tags/${NGX_DEVEL_KIT_VERSION}.tar.gz
+tar -zxf ${NGX_DEVEL_KIT_VERSION}.tar.gz -C /tmp/ngx_devel_kit --strip-components=1
+rm ${NGX_DEVEL_KIT_VERSION}.tar.gz
+
+mkdir /tmp/nginx-set-misc-module
+wget https://github.com/openresty/set-misc-nginx-module/archive/refs/tags/${SET_MISC_MODULE_VERSION}.tar.gz
+tar -zxf ${SET_MISC_MODULE_VERSION}.tar.gz -C /tmp/nginx-set-misc-module --strip-components=1
+rm ${SET_MISC_MODULE_VERSION}.tar.gz
 
 cd /tmp/nginx
 
@@ -60,10 +73,13 @@ cd /tmp/nginx
     --with-file-aio \
     --with-http_sub_module \
     --with-http_ssl_module \
+    --with-http_auth_request_module \
+    --with-http_realip_module \
     --with-threads \
+    --add-module=../ngx_devel_kit \
+    --add-module=../nginx-set-misc-module \
     --add-module=../nginx-vod-module \
     --add-module=../nginx-secure-token-module \
-    --add-module=../nginx-rtmp-module \
     --with-cc-opt="-O3 -Wno-error=implicit-fallthrough"
 
 make CC="ccache gcc" -j$(nproc) && make install

docker/main/build_ov_model.py

@@ -0,0 +1,11 @@
+import openvino as ov
+from openvino.tools import mo
+
+ov_model = mo.convert_model(
+    "/models/ssdlite_mobilenet_v2_coco_2018_05_09/frozen_inference_graph.pb",
+    compress_to_fp16=True,
+    transformations_config="/usr/local/lib/python3.11/dist-packages/openvino/tools/mo/front/tf/ssd_v2_support.json",
+    tensorflow_object_detection_api_pipeline_config="/models/ssdlite_mobilenet_v2_coco_2018_05_09/pipeline.config",
+    reverse_input_channels=True,
+)
+ov.save_model(ov_model, "/models/ssdlite_mobilenet_v2.xml")

docker/main/build_pysqlite3.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+SQLITE3_VERSION="3.46.1"
+PYSQLITE3_VERSION="0.5.3"
+
+# Install libsqlite3-dev if not present (needed for some base images like NVIDIA TensorRT)
+if ! dpkg -l | grep -q libsqlite3-dev; then
+  echo "Installing libsqlite3-dev for compilation..."
+  apt-get update && apt-get install -y libsqlite3-dev && rm -rf /var/lib/apt/lists/*
+fi
+
+# Fetch the pre-built sqlite amalgamation instead of building from source
+if [[ ! -d "sqlite" ]]; then
+  mkdir sqlite
+  cd sqlite
+
+  # Download the pre-built amalgamation from sqlite.org
+  # For SQLite 3.46.1, the amalgamation version is 3460100
+  SQLITE_AMALGAMATION_VERSION="3460100"
+
+  wget https://www.sqlite.org/2024/sqlite-amalgamation-${SQLITE_AMALGAMATION_VERSION}.zip -O sqlite-amalgamation.zip
+  unzip sqlite-amalgamation.zip
+  mv sqlite-amalgamation-${SQLITE_AMALGAMATION_VERSION}/* .
+  rmdir sqlite-amalgamation-${SQLITE_AMALGAMATION_VERSION}
+  rm sqlite-amalgamation.zip
+
+  cd ../
+fi
+
+# Grab the pysqlite3 source code.
+if [[ ! -d "./pysqlite3" ]]; then
+  git clone https://github.com/coleifer/pysqlite3.git
+fi
+
+cd pysqlite3/
+git checkout ${PYSQLITE3_VERSION}
+
+# Copy the sqlite3 source amalgamation into the pysqlite3 directory so we can
+# create a self-contained extension module.
+cp "../sqlite/sqlite3.c" ./
+cp "../sqlite/sqlite3.h" ./
+
+# Create the wheel and put it in the /wheels dir.
+sed -i "s|name='pysqlite3-binary'|name=PACKAGE_NAME|g" setup.py
+python3 setup.py build_static
+pip3 wheel . -w /wheels

docker/main/build_sqlite_vec.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+SQLITE_VEC_VERSION="0.1.3"
+
+source /etc/os-release
+
+if [[ "$VERSION_ID" == "12" ]]; then
+    sed -i '/^Types:/s/deb/& deb-src/' /etc/apt/sources.list.d/debian.sources
+else
+    cp /etc/apt/sources.list /etc/apt/sources.list.d/sources-src.list
+    sed -i 's|deb http|deb-src http|g' /etc/apt/sources.list.d/sources-src.list
+fi
+
+apt-get update
+apt-get -yqq build-dep sqlite3 gettext git
+
+mkdir /tmp/sqlite_vec
+# Grab the sqlite_vec source code.
+wget -nv https://github.com/asg017/sqlite-vec/archive/refs/tags/v${SQLITE_VEC_VERSION}.tar.gz
+tar -zxf v${SQLITE_VEC_VERSION}.tar.gz -C /tmp/sqlite_vec
+
+cd /tmp/sqlite_vec/sqlite-vec-${SQLITE_VEC_VERSION}
+
+mkdir -p vendor
+wget -O sqlite-amalgamation.zip https://www.sqlite.org/2024/sqlite-amalgamation-3450300.zip
+unzip sqlite-amalgamation.zip
+mv sqlite-amalgamation-3450300/* vendor/
+rmdir sqlite-amalgamation-3450300
+rm sqlite-amalgamation.zip
+
+# build loadable module
+make loadable
+
+# install it
+cp dist/vec0.* /usr/local/lib
+

docker/main/install_deps.sh

@@ -6,72 +6,138 @@ apt-get -qq update
 
 apt-get -qq install --no-install-recommends -y \
     apt-transport-https \
+    ca-certificates \
     gnupg \
     wget \
+    lbzip2 \
     procps vainfo \
     unzip locales tzdata libxml2 xz-utils \
-    python3.9 \
-    python3-pip \
+    python3.11 \
     curl \
+    lsof \
     jq \
-    nethogs
+    nethogs \
+    libgl1 \
+    libglib2.0-0 \
+    libusb-1.0.0 \
+    python3-h2 \
+    libgomp1  # memryx detector
 
-# ensure python3 defaults to python3.9
-update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.9 1
+update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
 
 mkdir -p -m 600 /root/.gnupg
 
-# add coral repo
-curl -fsSLo - https://packages.cloud.google.com/apt/doc/apt-key.gpg | \
-    gpg --dearmor -o /etc/apt/trusted.gpg.d/google-cloud-packages-archive-keyring.gpg
-echo "deb https://packages.cloud.google.com/apt coral-edgetpu-stable main" | tee /etc/apt/sources.list.d/coral-edgetpu.list
-echo "libedgetpu1-max libedgetpu/accepted-eula select true" | debconf-set-selections
+# install coral runtime
+wget -q -O /tmp/libedgetpu1-max.deb "https://github.com/feranick/libedgetpu/releases/download/16.0TF2.17.1-1/libedgetpu1-max_16.0tf2.17.1-1.bookworm_${TARGETARCH}.deb"
+unset DEBIAN_FRONTEND
+yes | dpkg -i /tmp/libedgetpu1-max.deb && export DEBIAN_FRONTEND=noninteractive
+rm /tmp/libedgetpu1-max.deb
 
-# enable non-free repo in Debian
-if grep -q "Debian" /etc/issue; then
-    sed -i -e's/ main/ main contrib non-free/g' /etc/apt/sources.list
+# install mesa-teflon-delegate from bookworm-backports
+# Only available for arm64 at the moment
+if [[ "${TARGETARCH}" == "arm64" ]]; then
+    if [[ "${BASE_IMAGE}" == *"nvcr.io/nvidia/tensorrt"* ]]; then
+        echo "Info: Skipping apt-get commands because BASE_IMAGE includes 'nvcr.io/nvidia/tensorrt' for arm64."
+    else
+        echo "deb http://deb.debian.org/debian bookworm-backports main" | tee /etc/apt/sources.list.d/bookworm-backbacks.list
+        apt-get -qq update
+        apt-get -qq install --no-install-recommends --no-install-suggests -y mesa-teflon-delegate/bookworm-backports
+    fi
 fi
 
-# coral drivers
-apt-get -qq update
-apt-get -qq install --no-install-recommends --no-install-suggests -y \
-    libedgetpu1-max python3-tflite-runtime python3-pycoral
-
-# btbn-ffmpeg -> amd64
+# ffmpeg -> amd64
 if [[ "${TARGETARCH}" == "amd64" ]]; then
-    mkdir -p /usr/lib/btbn-ffmpeg
-    wget -qO btbn-ffmpeg.tar.xz "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
-    tar -xf btbn-ffmpeg.tar.xz -C /usr/lib/btbn-ffmpeg --strip-components 1
-    rm -rf btbn-ffmpeg.tar.xz /usr/lib/btbn-ffmpeg/doc /usr/lib/btbn-ffmpeg/bin/ffplay
+    mkdir -p /usr/lib/ffmpeg/5.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
+    rm -rf ffmpeg.tar.xz
+    mkdir -p /usr/lib/ffmpeg/7.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linux64-gpl-7.0.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
+    rm -rf ffmpeg.tar.xz
 fi
 
 # ffmpeg -> arm64
 if [[ "${TARGETARCH}" == "arm64" ]]; then
-    mkdir -p /usr/lib/btbn-ffmpeg
-    wget -qO btbn-ffmpeg.tar.xz "https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
-    tar -xf btbn-ffmpeg.tar.xz -C /usr/lib/btbn-ffmpeg --strip-components 1
-    rm -rf btbn-ffmpeg.tar.xz /usr/lib/btbn-ffmpeg/doc /usr/lib/btbn-ffmpeg/bin/ffplay
+    mkdir -p /usr/lib/ffmpeg/5.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
+    rm -f ffmpeg.tar.xz
+    mkdir -p /usr/lib/ffmpeg/7.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linuxarm64-gpl-7.0.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
+    rm -f ffmpeg.tar.xz
 fi
 
 # arch specific packages
 if [[ "${TARGETARCH}" == "amd64" ]]; then
-    # use debian bookworm for hwaccel packages
-    echo 'deb https://deb.debian.org/debian bookworm main contrib non-free' >/etc/apt/sources.list.d/debian-bookworm.list
+  # Install non-free version of i965 driver
+  sed -i -E "/^Components: main$/s/main/main contrib non-free non-free-firmware/" "/etc/apt/sources.list.d/debian.sources" \
+      && apt-get -qq update \
+      && apt-get install --no-install-recommends --no-install-suggests -y i965-va-driver-shaders \
+      && sed -i -E "/^Components: main contrib non-free non-free-firmware$/s/main contrib non-free non-free-firmware/main/" "/etc/apt/sources.list.d/debian.sources" \
+      && apt-get update
+
+    # install amd / intel-i965 driver packages
+    apt-get -qq install --no-install-recommends --no-install-suggests -y \
+        intel-gpu-tools onevpl-tools \
+        libva-drm2 \
+        mesa-va-drivers radeontop
+
+    # intel packages use zst compression so we need to update dpkg
+    apt-get install -y dpkg
+
+    # use intel apt intel packages
+    wget -qO - https://repositories.intel.com/gpu/intel-graphics.key | gpg --yes --dearmor --output /usr/share/keyrings/intel-graphics.gpg
+    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu jammy client" | tee /etc/apt/sources.list.d/intel-gpu-jammy.list
     apt-get -qq update
     apt-get -qq install --no-install-recommends --no-install-suggests -y \
-        intel-opencl-icd \
-        mesa-va-drivers radeontop libva-drm2 intel-media-va-driver-non-free i965-va-driver libmfx1 intel-gpu-tools
-    # something about this dependency requires it to be installed in a separate call rather than in the line above
-    apt-get -qq install --no-install-recommends --no-install-suggests -y \
-        i965-va-driver-shaders
-    rm -f /etc/apt/sources.list.d/debian-bookworm.list
+        intel-media-va-driver-non-free libmfx1 libmfxgen1 libvpl2
+
+    apt-get -qq install -y ocl-icd-libopencl1
+
+    # install libtbb12 for NPU support
+    apt-get -qq install -y libtbb12
+
+    rm -f /usr/share/keyrings/intel-graphics.gpg
+    rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list
+
+    # install legacy and standard intel icd and level-zero-gpu
+    # see https://github.com/intel/compute-runtime/blob/master/LEGACY_PLATFORMS.md for more info
+    # needed core package
+    wget https://github.com/intel/compute-runtime/releases/download/24.52.32224.5/libigdgmm12_22.5.5_amd64.deb
+    dpkg -i libigdgmm12_22.5.5_amd64.deb
+    rm libigdgmm12_22.5.5_amd64.deb
+
+    # legacy packages
+    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
+    # standard packages
+    wget https://github.com/intel/compute-runtime/releases/download/24.52.32224.5/intel-opencl-icd_24.52.32224.5_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.52.32224.5/intel-level-zero-gpu_1.6.32224.5_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.5.6/intel-igc-opencl-2_2.5.6+18417_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.5.6/intel-igc-core-2_2.5.6+18417_amd64.deb
+    # npu packages
+    wget https://github.com/oneapi-src/level-zero/releases/download/v1.21.9/level-zero_1.21.9+u22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.17.0/intel-driver-compiler-npu_1.17.0.20250508-14912879441_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.17.0/intel-fw-npu_1.17.0.20250508-14912879441_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.17.0/intel-level-zero-npu_1.17.0.20250508-14912879441_ubuntu22.04_amd64.deb
+
+    dpkg -i *.deb
+    rm *.deb
 fi
 
 if [[ "${TARGETARCH}" == "arm64" ]]; then
     apt-get -qq install --no-install-recommends --no-install-suggests -y \
-        libva-drm2 mesa-va-drivers
+        libva-drm2 mesa-va-drivers radeontop
 fi
 
+# install vulkan
+apt-get -qq install --no-install-recommends --no-install-suggests -y \
+    libvulkan1 mesa-vulkan-drivers
+
 apt-get purge gnupg apt-transport-https xz-utils -y
 apt-get clean autoclean -y
 apt-get autoremove --purge -y
@@ -79,6 +145,6 @@ rm -rf /var/lib/apt/lists/*
 
 # Install yq, for frigate-prepare and go2rtc echo source
 curl -fsSL \
-    "https://github.com/mikefarah/yq/releases/download/v4.33.3/yq_linux_$(dpkg --print-architecture)" \
+    "https://github.com/mikefarah/yq/releases/download/v4.48.2/yq_linux_$(dpkg --print-architecture)" \
     --output /usr/local/bin/yq
 chmod +x /usr/local/bin/yq

docker/main/install_hailort.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+hailo_version="4.21.0"
+
+if [[ "${TARGETARCH}" == "amd64" ]]; then
+    arch="x86_64"
+elif [[ "${TARGETARCH}" == "arm64" ]]; then
+    arch="aarch64"
+fi
+
+wget -qO- "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-debian12-${TARGETARCH}.tar.gz" | tar -C / -xzf -
+wget -P /wheels/ "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"

docker/main/install_memryx.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+set -e
+
+# Download the MxAccl for Frigate github release
+wget https://github.com/memryx/mx_accl_frigate/archive/refs/tags/v2.1.0.zip -O /tmp/mxaccl.zip
+unzip /tmp/mxaccl.zip -d /tmp
+mv /tmp/mx_accl_frigate-2.1.0 /opt/mx_accl_frigate
+rm /tmp/mxaccl.zip
+
+# Install Python dependencies
+pip3 install -r /opt/mx_accl_frigate/freeze
+
+# Link the Python package dynamically
+SITE_PACKAGES=$(python3 -c "import site; print(site.getsitepackages()[0])")
+ln -s /opt/mx_accl_frigate/memryx "$SITE_PACKAGES/memryx"
+
+# Copy architecture-specific shared libraries
+ARCH=$(uname -m)
+if [[ "$ARCH" == "x86_64" ]]; then
+    cp /opt/mx_accl_frigate/memryx/x86/libmemx.so* /usr/lib/x86_64-linux-gnu/
+    cp /opt/mx_accl_frigate/memryx/x86/libmx_accl.so* /usr/lib/x86_64-linux-gnu/
+elif [[ "$ARCH" == "aarch64" ]]; then
+    cp /opt/mx_accl_frigate/memryx/arm/libmemx.so* /usr/lib/aarch64-linux-gnu/
+    cp /opt/mx_accl_frigate/memryx/arm/libmx_accl.so* /usr/lib/aarch64-linux-gnu/
+else
+    echo "Unsupported architecture: $ARCH"
+    exit 1
+fi
+
+# Refresh linker cache
+ldconfig

docker/main/install_s6_overlay.sh

@@ -2,7 +2,7 @@
 
 set -euxo pipefail
 
-s6_version="3.1.5.0"
+s6_version="3.2.1.0"
 
 if [[ "${TARGETARCH}" == "amd64" ]]; then
     s6_arch="x86_64"

docker/main/install_tempio.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+tempio_version="2021.09.0"
+
+if [[ "${TARGETARCH}" == "amd64" ]]; then
+    arch="amd64"
+elif [[ "${TARGETARCH}" == "arm64" ]]; then
+    arch="aarch64"
+fi
+
+mkdir -p /rootfs/usr/local/tempio/bin
+
+wget -q -O /rootfs/usr/local/tempio/bin/tempio "https://github.com/home-assistant/tempio/releases/download/${tempio_version}/tempio_${arch}"
+chmod 755 /rootfs/usr/local/tempio/bin/tempio

docker/main/requirements-dev.txt

@@ -1,3 +1,4 @@
-black == 23.10.*
-isort
 ruff
+
+# types
+types-peewee == 3.17.*

docker/main/requirements-ov.txt

@@ -1,5 +1,3 @@
 numpy
-# Openvino Library - Custom built with MYRIAD support
-openvino @ https://github.com/NateMeyer/openvino-wheels/releases/download/multi-arch_2022.3.1/openvino-2022.3.1-1-cp39-cp39-manylinux_2_31_x86_64.whl; platform_machine == 'x86_64'
-openvino @ https://github.com/NateMeyer/openvino-wheels/releases/download/multi-arch_2022.3.1/openvino-2022.3.1-1-cp39-cp39-linux_aarch64.whl; platform_machine == 'aarch64'
-openvino-dev[tensorflow2] @ https://github.com/NateMeyer/openvino-wheels/releases/download/multi-arch_2022.3.1/openvino_dev-2022.3.1-1-py3-none-any.whl
+tensorflow
+openvino-dev>=2024.0.0

docker/main/requirements-wheels.txt

@@ -1,28 +1,85 @@
+aiofiles == 24.1.*
 click == 8.1.*
-Flask == 2.3.*
-imutils == 0.5.*
-matplotlib == 3.7.*
+# FastAPI
+aiohttp == 3.12.*
+starlette == 0.47.*
+starlette-context == 0.4.*
+fastapi[standard-no-fastapi-cloud-cli] == 0.116.*
+uvicorn == 0.35.*
+slowapi == 0.1.*
+joserfc == 1.2.*
+cryptography == 44.0.*
+pathvalidate == 3.3.*
+markupsafe == 3.0.*
+python-multipart == 0.0.20
+# Classification Model Training
+tensorflow == 2.19.* ; platform_machine == 'aarch64'
+tensorflow-cpu == 2.19.* ; platform_machine == 'x86_64'
+# General
 mypy == 1.6.1
-numpy == 1.23.*
-onvif_zeep == 0.2.12
-opencv-python-headless == 4.7.0.*
-paho-mqtt == 1.6.*
+onvif-zeep-async == 4.0.*
+paho-mqtt == 2.1.*
+pandas == 2.2.*
 peewee == 3.17.*
-peewee_migrate == 1.12.*
-psutil == 5.9.*
-pydantic == 1.10.*
+peewee_migrate == 1.13.*
+psutil == 7.1.*
+pydantic == 2.10.*
 git+https://github.com/fbcotter/py3nvml#egg=py3nvml
-PyYAML == 6.0.*
-pytz == 2023.3.post1
+pytz == 2025.*
+pyzmq == 26.2.*
 ruamel.yaml == 0.18.*
 tzlocal == 5.2
-types-PyYAML == 6.0.*
-requests == 2.31.*
-types-requests == 2.31.*
-scipy == 1.11.*
-norfair == 2.2.*
+requests == 2.32.*
+types-requests == 2.32.*
+norfair == 2.3.*
 setproctitle == 1.3.*
 ws4py == 0.5.*
-# Openvino Library - Custom built with MYRIAD support
-openvino @ https://github.com/NateMeyer/openvino-wheels/releases/download/multi-arch_2022.3.1/openvino-2022.3.1-1-cp39-cp39-manylinux_2_31_x86_64.whl; platform_machine == 'x86_64'
-openvino @ https://github.com/NateMeyer/openvino-wheels/releases/download/multi-arch_2022.3.1/openvino-2022.3.1-1-cp39-cp39-linux_aarch64.whl; platform_machine == 'aarch64'
+unidecode == 1.3.*
+titlecase == 2.4.*
+# Image Manipulation
+numpy == 1.26.*
+opencv-python-headless == 4.11.0.*
+opencv-contrib-python == 4.11.0.*
+scipy == 1.16.*
+# OpenVino & ONNX
+openvino == 2025.3.*
+onnxruntime == 1.22.*
+# Embeddings
+transformers == 4.45.*
+# Generative AI
+google-generativeai == 0.8.*
+ollama == 0.5.*
+openai == 1.65.*
+# push notifications
+py-vapid == 1.9.*
+pywebpush == 2.0.*
+# alpr
+pyclipper == 1.3.*
+shapely == 2.0.*
+rapidfuzz==3.12.*
+# HailoRT Wheels
+appdirs==1.4.*
+argcomplete==2.0.*
+contextlib2==0.6.*
+distlib==0.3.*
+filelock==3.8.*
+future==0.18.*
+importlib-metadata==5.1.*
+importlib-resources==5.1.*
+netaddr==0.8.*
+netifaces==0.10.*
+verboselogs==1.7.*
+virtualenv==20.17.*
+prometheus-client == 0.21.*
+# TFLite
+tflite_runtime @ https://github.com/frigate-nvr/TFlite-builds/releases/download/v2.17.1/tflite_runtime-2.17.1-cp311-cp311-linux_x86_64.whl; platform_machine == 'x86_64'
+tflite_runtime @ https://github.com/feranick/TFlite-builds/releases/download/v2.17.1/tflite_runtime-2.17.1-cp311-cp311-linux_aarch64.whl; platform_machine == 'aarch64'
+# audio transcription
+sherpa-onnx==1.12.*
+faster-whisper==1.1.*
+librosa==0.11.*
+soundfile==0.13.*
+# DeGirum detector
+degirum == 0.16.*
+# Memory profiling
+memray == 1.15.*

docker/main/requirements.txt

@@ -1,2 +1 @@
-scikit-build == 0.17.*
-nvidia-pyindex
+scikit-build == 0.18.*

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/consumer-for

@@ -0,0 +1 @@
+certsync

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/pipeline-name

@@ -0,0 +1 @@
+certsync-pipeline

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/run

@@ -0,0 +1,4 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+exec logutil-service /dev/shm/logs/certsync

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/type

@@ -0,0 +1 @@
+longrun

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/finish

@@ -0,0 +1,30 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+# Take down the S6 supervision tree when the service fails
+
+set -o errexit -o nounset -o pipefail
+
+# Logs should be sent to stdout so that s6 can collect them
+
+declare exit_code_container
+exit_code_container=$(cat /run/s6-linux-init-container-results/exitcode)
+readonly exit_code_container
+readonly exit_code_service="${1}"
+readonly exit_code_signal="${2}"
+readonly service="CERTSYNC"
+
+echo "[INFO] Service ${service} exited with code ${exit_code_service} (by signal ${exit_code_signal})"
+
+if [[ "${exit_code_service}" -eq 256 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo $((128 + exit_code_signal)) >/run/s6-linux-init-container-results/exitcode
+  fi
+  if [[ "${exit_code_signal}" -eq 15 ]]; then
+    exec /run/s6/basedir/bin/halt
+  fi
+elif [[ "${exit_code_service}" -ne 0 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo "${exit_code_service}" >/run/s6-linux-init-container-results/exitcode
+  fi
+  exec /run/s6/basedir/bin/halt
+fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/producer-for

@@ -0,0 +1 @@
+certsync-log

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/run

@@ -0,0 +1,58 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+# Start the CERTSYNC service
+
+set -o errexit -o nounset -o pipefail
+
+# Logs should be sent to stdout so that s6 can collect them
+
+echo "[INFO] Starting certsync..."
+
+lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
+
+tls_enabled=`python3 /usr/local/nginx/get_listen_settings.py | jq -r .tls.enabled`
+
+while true
+do
+    if [[ "$tls_enabled" == 'false' ]]; then
+        sleep 9999
+        continue
+    fi
+
+    if [ ! -e $lefile ]
+    then
+        echo "[ERROR] TLS certificate does not exist: $lefile"
+    fi
+
+    leprint=`openssl x509 -in $lefile -fingerprint -noout 2>&1 || echo 'failed'`
+
+    case "$leprint" in
+        *Fingerprint*)
+            ;;
+        *)
+            echo "[ERROR] Missing fingerprint from $lefile"
+            ;;
+    esac
+
+    liveprint=`echo | openssl s_client -showcerts -connect 127.0.0.1:8971 2>&1 | openssl x509 -fingerprint 2>&1 | grep -i fingerprint  || echo 'failed'`
+
+    case "$liveprint" in
+        *Fingerprint*)
+            ;;
+        *)
+            echo "[ERROR] Missing fingerprint from current nginx TLS cert"
+            ;;
+    esac
+
+    if [[ "$leprint" != "failed" && "$liveprint" != "failed" && "$leprint" != "$liveprint" ]]
+    then
+        echo "[INFO] Reloading nginx to refresh TLS certificate"
+        echo "$lefile: $leprint"
+        /usr/local/nginx/sbin/nginx -s reload
+    fi
+
+    sleep 60
+
+done
+
+exit 0

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/timeout-kill

@@ -0,0 +1 @@
+30000

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync/type

@@ -0,0 +1 @@
+longrun

docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run

@@ -4,47 +4,25 @@
 
 set -o errexit -o nounset -o pipefail
 
+# opt out of openvino telemetry
+if [ -e /usr/local/bin/opt_in_out ]; then
+  /usr/local/bin/opt_in_out --opt_out > /dev/null 2>&1
+fi
+
 # Logs should be sent to stdout so that s6 can collect them
 
 # Tell S6-Overlay not to restart this service
 s6-svc -O .
 
-function migrate_db_path() {
-    # Find config file in yaml or yml, but prefer yaml
-    local config_file="${CONFIG_FILE:-"/config/config.yml"}"
-    local config_file_yaml="${config_file//.yml/.yaml}"
-    if [[ -f "${config_file_yaml}" ]]; then
-        config_file="${config_file_yaml}"
-    elif [[ ! -f "${config_file}" ]]; then
-        echo "[ERROR] Frigate config file not found"
-        return 1
-    fi
-    unset config_file_yaml
-
-    # Use yq to check if database.path is set
-    local user_db_path
-    user_db_path=$(yq eval '.database.path' "${config_file}")
-
-    if [[ "${user_db_path}" == "null" ]]; then
-        local previous_db_path="/media/frigate/frigate.db"
-        local new_db_dir="/config"
-        if [[ -f "${previous_db_path}" ]]; then
-            if mountpoint --quiet "${new_db_dir}"; then
-                # /config is a mount point, move the db
-                echo "[INFO] Moving db from '${previous_db_path}' to the '${new_db_dir}' dir..."
-                # Move all files that starts with frigate.db to the new directory
-                mv -vf "${previous_db_path}"* "${new_db_dir}"
-            else
-                echo "[ERROR] Trying to migrate the db path from '${previous_db_path}' to the '${new_db_dir}' dir, but '${new_db_dir}' is not a mountpoint, please mount the '${new_db_dir}' dir"
-                return 1
-            fi
-        fi
-    fi
+function set_libva_version() {
+    local ffmpeg_path
+    ffmpeg_path=$(python3 /usr/local/ffmpeg/get_ffmpeg_path.py)
+    LIBAVFORMAT_VERSION_MAJOR=$("$ffmpeg_path" -version | grep -Po "libavformat\W+\K\d+")
+    export LIBAVFORMAT_VERSION_MAJOR
 }
 
 echo "[INFO] Preparing Frigate..."
-migrate_db_path
-export LIBAVFORMAT_VERSION_MAJOR=$(ffmpeg -version | grep -Po 'libavformat\W+\K\d+')
+set_libva_version
 
 echo "[INFO] Starting Frigate..."
 

docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc/run

@@ -43,19 +43,69 @@ function get_ip_and_port_from_supervisor() {
     export FRIGATE_GO2RTC_WEBRTC_CANDIDATE_INTERNAL="${ip_address}:${webrtc_port}"
 }
 
-export LIBAVFORMAT_VERSION_MAJOR=$(ffmpeg -version | grep -Po 'libavformat\W+\K\d+')
+function set_libva_version() {
+    local ffmpeg_path
+    ffmpeg_path=$(python3 /usr/local/ffmpeg/get_ffmpeg_path.py)
+    LIBAVFORMAT_VERSION_MAJOR=$("$ffmpeg_path" -version | grep -Po "libavformat\W+\K\d+")
+    export LIBAVFORMAT_VERSION_MAJOR
+}
+
+function setup_homekit_config() {
+    local config_path="$1"
+
+    if [[ ! -f "${config_path}" ]]; then
+        echo "[INFO] Creating empty HomeKit config file..."
+        echo '{}' > "${config_path}"
+    fi
+
+    # Convert YAML to JSON for jq processing
+    local temp_json="/tmp/cache/homekit_config.json"
+    yq eval -o=json "${config_path}" > "${temp_json}" 2>/dev/null || {
+        echo "[WARNING] Failed to convert HomeKit config to JSON, skipping cleanup"
+        return 0
+    }
+
+    # Use jq to filter and keep only the homekit section
+    local cleaned_json="/tmp/cache/homekit_cleaned.json"
+    jq '
+        # Keep only the homekit section if it exists, otherwise empty object
+        if has("homekit") then {homekit: .homekit} else {homekit: {}} end
+    ' "${temp_json}" > "${cleaned_json}" 2>/dev/null || echo '{"homekit": {}}' > "${cleaned_json}"
+
+    # Convert back to YAML and write to the config file
+    yq eval -P "${cleaned_json}" > "${config_path}" 2>/dev/null || {
+        echo "[WARNING] Failed to convert cleaned config to YAML, creating minimal config"
+        echo '{"homekit": {}}' > "${config_path}"
+    }
+
+    # Clean up temp files
+    rm -f "${temp_json}" "${cleaned_json}"
+}
+
+set_libva_version
+
+if [[ -f "/dev/shm/go2rtc.yaml" ]]; then
+    echo "[INFO] Removing stale config from last run..."
+    rm /dev/shm/go2rtc.yaml
+fi
 
 if [[ ! -f "/dev/shm/go2rtc.yaml" ]]; then
-    echo "[INFO] Preparing go2rtc config..."
+    echo "[INFO] Preparing new go2rtc config..."
 
     if [[ -n "${SUPERVISOR_TOKEN:-}" ]]; then
-        # Running as a Home Assistant add-on, infer the IP address and port
+        # Running as a Home Assistant Add-on, infer the IP address and port
         get_ip_and_port_from_supervisor
     fi
 
     python3 /usr/local/go2rtc/create_config.py
+else
+    echo "[WARNING] Unable to remove existing go2rtc config. Changes made to your frigate config file may not be recognized. Please remove the /dev/shm/go2rtc.yaml from your docker host manually."
 fi
 
+# HomeKit configuration persistence setup
+readonly homekit_config_path="/config/go2rtc_homekit.yml"
+setup_homekit_config "${homekit_config_path}"
+
 readonly config_path="/config"
 
 if [[ -x "${config_path}/go2rtc" ]]; then
@@ -68,5 +118,7 @@ fi
 echo "[INFO] Starting go2rtc..."
 
 # Replace the bash process with the go2rtc process, redirecting stderr to stdout
+# Use HomeKit config as the primary config so writebacks go there
+# The main config from Frigate will be loaded as a secondary config
 exec 2>&1
-exec "${binary_path}" -config=/dev/shm/go2rtc.yaml
+exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml

docker/main/rootfs/etc/s6-overlay/s6-rc.d/log-prepare/run

@@ -4,7 +4,7 @@
 
 set -o errexit -o nounset -o pipefail
 
-dirs=(/dev/shm/logs/frigate /dev/shm/logs/go2rtc /dev/shm/logs/nginx)
+dirs=(/dev/shm/logs/frigate /dev/shm/logs/go2rtc /dev/shm/logs/nginx /dev/shm/logs/certsync)
 
 mkdir -p "${dirs[@]}"
 chown nobody:nogroup "${dirs[@]}"

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/data/check

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -e
+
+# Wait for PID file to exist.
+while ! test -f /run/nginx.pid; do sleep 1; done

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/notification-fd

@@ -0,0 +1 @@
+3

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -8,6 +8,89 @@ set -o errexit -o nounset -o pipefail
 
 echo "[INFO] Starting NGINX..."
 
+# Taken from https://github.com/felipecrs/cgroup-scripts/commits/master/get_cpus.sh
+function get_cpus() {
+    local quota=""
+    local period=""
+
+    if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
+        if [ -f /sys/fs/cgroup/cpu.max ]; then
+            read -r quota period </sys/fs/cgroup/cpu.max
+            if [ "$quota" = "max" ]; then
+                quota=""
+                period=""
+            fi
+        else
+            echo "[WARN] /sys/fs/cgroup/cpu.max not found. Falling back to /proc/cpuinfo." >&2
+        fi
+    else
+        if [ -f /sys/fs/cgroup/cpu/cpu.cfs_quota_us ] && [ -f /sys/fs/cgroup/cpu/cpu.cfs_period_us ]; then
+            quota=$(cat /sys/fs/cgroup/cpu/cpu.cfs_quota_us)
+            period=$(cat /sys/fs/cgroup/cpu/cpu.cfs_period_us)
+
+            if [ "$quota" = "-1" ]; then
+                quota=""
+                period=""
+            fi
+        else
+            echo "[WARN] /sys/fs/cgroup/cpu/cpu.cfs_quota_us or /sys/fs/cgroup/cpu/cpu.cfs_period_us not found. Falling back to /proc/cpuinfo." >&2
+        fi
+    fi
+
+    local cpus
+    if [ "${period}" != "0" ] && [ -n "${quota}" ] && [ -n "${period}" ]; then
+        cpus=$((quota / period))
+        if [ "$cpus" -eq 0 ]; then
+            cpus=1
+        fi
+    else
+        cpus=$(grep -c ^processor /proc/cpuinfo)
+    fi
+
+    printf '%s' "$cpus"
+}
+
+function set_worker_processes() {
+    # Capture number of assigned CPUs to calculate worker processes
+    local cpus
+
+    cpus=$(get_cpus)
+    if [[ "${cpus}" -gt 4 ]]; then
+        cpus=4
+    fi
+
+    # we need to catch any errors because sed will fail if user has bind mounted a custom nginx file
+    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /usr/local/nginx/conf/nginx.conf || true
+}
+
+set_worker_processes
+
+# ensure the directory for ACME challenges exists
+mkdir -p /etc/letsencrypt/www
+
+# Create self signed certs if needed
+letsencrypt_path=/etc/letsencrypt/live/frigate
+mkdir -p $letsencrypt_path
+
+if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
+    echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
+    openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
+        -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
+        -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
+fi
+
+# build templates for optional FRIGATE_BASE_PATH environment variable
+python3 /usr/local/nginx/get_base_path.py | \
+    tempio -template /usr/local/nginx/templates/base_path.gotmpl \
+       -out /usr/local/nginx/conf/base_path.conf
+
+# build templates for optional TLS support
+python3 /usr/local/nginx/get_listen_settings.py | \
+    tempio  -template /usr/local/nginx/templates/listen.gotmpl \
+            -out /usr/local/nginx/conf/listen.conf
+
 # Replace the bash process with the NGINX process, redirecting stderr to stdout
 exec 2>&1
-exec nginx
+exec \
+    s6-notifyoncheck -t 30000 -n 1 \
+    nginx

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run

@@ -0,0 +1,146 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+# Do preparation tasks before starting the main services
+
+set -o errexit -o nounset -o pipefail
+
+function migrate_addon_config_dir() {
+    local home_assistant_config_dir="/homeassistant"
+
+    if ! mountpoint --quiet "${home_assistant_config_dir}"; then
+        # Not running as a Home Assistant Add-on
+        return 0
+    fi
+
+    local config_dir="/config"
+    local new_config_file="${config_dir}/config.yml"
+    local new_config_file_yaml="${new_config_file//.yml/.yaml}"
+    if [[ -f "${new_config_file_yaml}" || -f "${new_config_file}" ]]; then
+        # Already migrated
+        return 0
+    fi
+
+    local old_config_file="${home_assistant_config_dir}/frigate.yml"
+    local old_config_file_yaml="${old_config_file//.yml/.yaml}"
+    if [[ -f "${old_config_file}" ]]; then
+        :
+    elif [[ -f "${old_config_file_yaml}" ]]; then
+        old_config_file="${old_config_file_yaml}"
+        new_config_file="${new_config_file_yaml}"
+    else
+        # Nothing to migrate
+        return 0
+    fi
+    unset old_config_file_yaml new_config_file_yaml
+
+    echo "[INFO] Starting migration from Home Assistant config dir to Add-on config dir..." >&2
+
+    local db_path
+    db_path=$(yq -r '.database.path' "${old_config_file}")
+    if [[ "${db_path}" == "null" ]]; then
+        db_path="${config_dir}/frigate.db"
+    fi
+    if [[ "${db_path}" == "${config_dir}/"* ]]; then
+        # replace /config/ prefix with /homeassistant/
+        local old_db_path="${home_assistant_config_dir}/${db_path:8}"
+
+        if [[ -f "${old_db_path}" ]]; then
+            local new_db_dir
+            new_db_dir="$(dirname "${db_path}")"
+            echo "[INFO] Migrating database from '${old_db_path}' to '${new_db_dir}' dir..." >&2
+            mkdir -vp "${new_db_dir}"
+            mv -vf "${old_db_path}" "${new_db_dir}"
+            local db_file
+            for db_file in "${old_db_path}"-shm "${old_db_path}"-wal; do
+                if [[ -f "${db_file}" ]]; then
+                    mv -vf "${db_file}" "${new_db_dir}"
+                fi
+            done
+            unset db_file
+        fi
+    fi
+
+    local config_entry
+    for config_entry in .model.path .model.labelmap_path .ffmpeg.path .mqtt.tls_ca_certs .mqtt.tls_client_cert .mqtt.tls_client_key; do
+        local config_entry_path
+        config_entry_path=$(yq -r "${config_entry}" "${old_config_file}")
+        if [[ "${config_entry_path}" == "${config_dir}/"* ]]; then
+            # replace /config/ prefix with /homeassistant/
+            local old_config_entry_path="${home_assistant_config_dir}/${config_entry_path:8}"
+
+            if [[ -f "${old_config_entry_path}" ]]; then
+                local new_config_entry_entry
+                new_config_entry_entry="$(dirname "${config_entry_path}")"
+                echo "[INFO] Migrating ${config_entry} from '${old_config_entry_path}' to '${config_entry_path}'..." >&2
+                mkdir -vp "${new_config_entry_entry}"
+                mv -vf "${old_config_entry_path}" "${config_entry_path}"
+            fi
+        fi
+    done
+
+    local old_model_cache_path="${home_assistant_config_dir}/model_cache"
+    if [[ -d "${old_model_cache_path}" ]]; then
+        echo "[INFO] Migrating '${old_model_cache_path}' to '${config_dir}'..." >&2
+        mv -f "${old_model_cache_path}" "${config_dir}"
+    fi
+
+    echo "[INFO] Migrating other files from '${home_assistant_config_dir}' to '${config_dir}'..." >&2
+    local file
+    for file in .exports .jwt_secret .timeline .vacuum go2rtc; do
+        file="${home_assistant_config_dir}/${file}"
+        if [[ -f "${file}" ]]; then
+            mv -vf "${file}" "${config_dir}"
+        fi
+    done
+
+    echo "[INFO] Migrating config file from '${old_config_file}' to '${new_config_file}'..." >&2
+    mv -vf "${old_config_file}" "${new_config_file}"
+
+    echo "[INFO] Migration from Home Assistant config dir to Add-on config dir completed." >&2
+}
+
+function migrate_db_from_media_to_config() {
+    # Find config file in yml or yaml, but prefer yml
+    local config_file="${CONFIG_FILE:-"/config/config.yml"}"
+    local config_file_yaml="${config_file//.yml/.yaml}"
+    if [[ -f "${config_file}" ]]; then
+        :
+    elif [[ -f "${config_file_yaml}" ]]; then
+        config_file="${config_file_yaml}"
+    else
+        # Frigate will create the config file on startup
+        return 0
+    fi
+    unset config_file_yaml
+
+    local user_db_path
+    user_db_path=$(yq -r '.database.path' "${config_file}")
+    if [[ "${user_db_path}" == "null" ]]; then
+        local old_db_path="/media/frigate/frigate.db"
+        local new_db_dir="/config"
+        if [[ -f "${old_db_path}" ]]; then
+            echo "[INFO] Migrating database from '${old_db_path}' to '${new_db_dir}' dir..." >&2
+            if mountpoint --quiet "${new_db_dir}"; then
+                # /config is a mount point, move the db
+                mv -vf "${old_db_path}" "${new_db_dir}"
+                local db_file
+                for db_file in "${old_db_path}"-shm "${old_db_path}"-wal; do
+                    if [[ -f "${db_file}" ]]; then
+                        mv -vf "${db_file}" "${new_db_dir}"
+                    fi
+                done
+                unset db_file
+            else
+                echo "[ERROR] Trying to migrate the database path from '${old_db_path}' to '${new_db_dir}' dir, but '${new_db_dir}' is not a mountpoint, please mount the '${new_db_dir}' dir" >&2
+                return 1
+            fi
+        fi
+    fi
+}
+
+# remove leftover from last run, not normally needed, but just in case
+# used by the docker healthcheck
+rm -f /dev/shm/.frigate-is-stopping
+
+migrate_addon_config_dir
+migrate_db_from_media_to_config

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/type

@@ -0,0 +1 @@
+oneshot

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/prepare/run

docker/main/rootfs/labelmap/coco-80.txt

@@ -0,0 +1,80 @@
+0  person
+1  bicycle
+2  car
+3  motorcycle
+4  airplane
+5  car
+6  train
+7  car
+8  boat
+9  traffic light
+10  fire hydrant
+11  stop sign
+12  parking meter
+13  bench
+14  bird
+15  cat
+16  dog
+17  horse
+18  sheep
+19  cow
+20  elephant
+21  bear
+22  zebra
+23  giraffe
+24  backpack
+25  umbrella
+26  handbag
+27  tie
+28  suitcase
+29  frisbee
+30  skis
+31  snowboard
+32  sports ball
+33  kite
+34  baseball bat
+35  baseball glove
+36  skateboard
+37  surfboard
+38  tennis racket
+39  bottle
+40  wine glass
+41  cup
+42  fork
+43  knife
+44  spoon
+45  bowl
+46  banana
+47  apple
+48  sandwich
+49  orange
+50  broccoli
+51  carrot
+52  hot dog
+53  pizza
+54  donut
+55  cake
+56  chair
+57  couch
+58  potted plant
+59  bed
+60  dining table
+61  toilet
+62  tv
+63  laptop
+64  mouse
+65  remote
+66  keyboard
+67  cell phone
+68  microwave
+69  oven
+70  toaster
+71  sink
+72  refrigerator
+73  book
+74  clock
+75  vase
+76  scissors
+77  teddy bear
+78  hair drier
+79  toothbrush

docker/main/rootfs/labelmap/coco.txt

@@ -0,0 +1,91 @@
+0  person
+1  bicycle
+2  car
+3  motorcycle
+4  airplane
+5  bus
+6  train
+7  car
+8  boat
+9  traffic light
+10  fire hydrant
+11  street sign
+12  stop sign
+13  parking meter
+14  bench
+15  bird
+16  cat
+17  dog
+18  horse
+19  sheep
+20  cow
+21  elephant
+22  bear
+23  zebra
+24  giraffe
+25  hat
+26  backpack
+27  umbrella
+28  shoe
+29  eye glasses
+30  handbag
+31  tie
+32  suitcase
+33  frisbee
+34  skis
+35  snowboard
+36  sports ball
+37  kite
+38  baseball bat
+39  baseball glove
+40  skateboard
+41  surfboard
+42  tennis racket
+43  bottle
+44  plate
+45  wine glass
+46  cup
+47  fork
+48  knife
+49  spoon
+50  bowl
+51  banana
+52  apple
+53  sandwich
+54  orange
+55  broccoli
+56  carrot
+57  hot dog
+58  pizza
+59  donut
+60  cake
+61  chair
+62  couch
+63  potted plant
+64  bed
+65  mirror
+66  dining table
+67  window
+68  desk
+69  toilet
+70  door
+71  tv
+72  laptop
+73  mouse
+74  remote
+75  keyboard
+76  cell phone
+77  microwave
+78  oven
+79  toaster
+80  sink
+81  refrigerator
+82  blender
+83  book
+84  clock
+85  vase
+86  scissors
+87  teddy bear
+88  hair drier
+89  toothbrush
+90  hair brush

docker/main/rootfs/usr/local/ffmpeg/get_ffmpeg_path.py

@@ -0,0 +1,37 @@
+import json
+import sys
+from typing import Any
+
+from ruamel.yaml import YAML
+
+sys.path.insert(0, "/opt/frigate")
+from frigate.const import (
+    DEFAULT_FFMPEG_VERSION,
+    INCLUDED_FFMPEG_VERSIONS,
+)
+from frigate.util.config import find_config_file
+
+sys.path.remove("/opt/frigate")
+
+yaml = YAML()
+
+config_file = find_config_file()
+
+try:
+    with open(config_file) as f:
+        raw_config = f.read()
+
+    if config_file.endswith((".yaml", ".yml")):
+        config: dict[str, Any] = yaml.load(raw_config)
+    elif config_file.endswith(".json"):
+        config: dict[str, Any] = json.loads(raw_config)
+except FileNotFoundError:
+    config: dict[str, Any] = {}
+
+path = config.get("ffmpeg", {}).get("path", "default")
+if path == "default":
+    print(f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg")
+elif path in INCLUDED_FFMPEG_VERSIONS:
+    print(f"/usr/lib/ffmpeg/{path}/bin/ffmpeg")
+else:
+    print(f"{path}/bin/ffmpeg")

docker/main/rootfs/usr/local/go2rtc/create_config.py

@@ -4,43 +4,47 @@ import json
 import os
 import sys
 from pathlib import Path
+from typing import Any
 
-import yaml
+from ruamel.yaml import YAML
 
 sys.path.insert(0, "/opt/frigate")
-from frigate.const import BIRDSEYE_PIPE  # noqa: E402
-from frigate.ffmpeg_presets import (  # noqa: E402
-    parse_preset_hardware_acceleration_encode,
+from frigate.const import (
+    BIRDSEYE_PIPE,
+    DEFAULT_FFMPEG_VERSION,
+    INCLUDED_FFMPEG_VERSIONS,
+    LIBAVFORMAT_VERSION_MAJOR,
 )
+from frigate.ffmpeg_presets import parse_preset_hardware_acceleration_encode
+from frigate.util.config import find_config_file
 
 sys.path.remove("/opt/frigate")
 
+yaml = YAML()
 
 FRIGATE_ENV_VARS = {k: v for k, v in os.environ.items() if k.startswith("FRIGATE_")}
 # read docker secret files as env vars too
 if os.path.isdir("/run/secrets"):
     for secret_file in os.listdir("/run/secrets"):
         if secret_file.startswith("FRIGATE_"):
-            FRIGATE_ENV_VARS[secret_file] = Path(
-                os.path.join("/run/secrets", secret_file)
-            ).read_text()
+            FRIGATE_ENV_VARS[secret_file] = (
+                Path(os.path.join("/run/secrets", secret_file)).read_text().strip()
+            )
 
-config_file = os.environ.get("CONFIG_FILE", "/config/config.yml")
+config_file = find_config_file()
 
-# Check if we can use .yaml instead of .yml
-config_file_yaml = config_file.replace(".yml", ".yaml")
-if os.path.isfile(config_file_yaml):
-    config_file = config_file_yaml
-
-with open(config_file) as f:
+try:
+    with open(config_file) as f:
         raw_config = f.read()
 
-if config_file.endswith((".yaml", ".yml")):
-    config: dict[str, any] = yaml.safe_load(raw_config)
-elif config_file.endswith(".json"):
-    config: dict[str, any] = json.loads(raw_config)
+    if config_file.endswith((".yaml", ".yml")):
+        config: dict[str, Any] = yaml.load(raw_config)
+    elif config_file.endswith(".json"):
+        config: dict[str, Any] = json.loads(raw_config)
+except FileNotFoundError:
+    config: dict[str, Any] = {}
 
-go2rtc_config: dict[str, any] = config.get("go2rtc", {})
+go2rtc_config: dict[str, Any] = config.get("go2rtc", {})
 
 # Need to enable CORS for go2rtc so the frigate integration / card work automatically
 if go2rtc_config.get("api") is None:
@@ -50,7 +54,7 @@ elif go2rtc_config["api"].get("origin") is None:
 
 # Need to set default location for HA config
 if go2rtc_config.get("hass") is None:
-    go2rtc_config["hass"] = {"config": "/config"}
+    go2rtc_config["hass"] = {"config": "/homeassistant"}
 
 # we want to ensure that logs are easy to read
 if go2rtc_config.get("log") is None:
@@ -58,52 +62,52 @@ if go2rtc_config.get("log") is None:
 elif go2rtc_config["log"].get("format") is None:
     go2rtc_config["log"]["format"] = "text"
 
-if not go2rtc_config.get("webrtc", {}).get("candidates", []):
+# ensure there is a default webrtc config
+if go2rtc_config.get("webrtc") is None:
+    go2rtc_config["webrtc"] = {}
+
+if go2rtc_config["webrtc"].get("candidates") is None:
     default_candidates = []
     # use internal candidate if it was discovered when running through the add-on
-    internal_candidate = os.environ.get(
-        "FRIGATE_GO2RTC_WEBRTC_CANDIDATE_INTERNAL", None
-    )
+    internal_candidate = os.environ.get("FRIGATE_GO2RTC_WEBRTC_CANDIDATE_INTERNAL")
     if internal_candidate is not None:
         default_candidates.append(internal_candidate)
     # should set default stun server so webrtc can work
     default_candidates.append("stun:8555")
 
-    go2rtc_config["webrtc"] = {"candidates": default_candidates}
-else:
-    print(
-        "[INFO] Not injecting WebRTC candidates into go2rtc config as it has been set manually",
-    )
+    go2rtc_config["webrtc"]["candidates"] = default_candidates
 
-# sets default RTSP response to be equivalent to ?video=h264,h265&audio=aac
-# this means user does not need to specify audio codec when using restream
-# as source for frigate and the integration supports HLS playback
-if go2rtc_config.get("rtsp") is None:
-    go2rtc_config["rtsp"] = {"default_query": "mp4"}
-else:
-    if go2rtc_config["rtsp"].get("default_query") is None:
-        go2rtc_config["rtsp"]["default_query"] = "mp4"
-
-    if go2rtc_config["rtsp"].get("username") is not None:
+if go2rtc_config.get("rtsp", {}).get("username") is not None:
     go2rtc_config["rtsp"]["username"] = go2rtc_config["rtsp"]["username"].format(
         **FRIGATE_ENV_VARS
     )
 
-    if go2rtc_config["rtsp"].get("password") is not None:
+if go2rtc_config.get("rtsp", {}).get("password") is not None:
     go2rtc_config["rtsp"]["password"] = go2rtc_config["rtsp"]["password"].format(
         **FRIGATE_ENV_VARS
     )
 
+# ensure ffmpeg path is set correctly
+path = config.get("ffmpeg", {}).get("path", "default")
+if path == "default":
+    ffmpeg_path = f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg"
+elif path in INCLUDED_FFMPEG_VERSIONS:
+    ffmpeg_path = f"/usr/lib/ffmpeg/{path}/bin/ffmpeg"
+else:
+    ffmpeg_path = f"{path}/bin/ffmpeg"
+
+if go2rtc_config.get("ffmpeg") is None:
+    go2rtc_config["ffmpeg"] = {"bin": ffmpeg_path}
+elif go2rtc_config["ffmpeg"].get("bin") is None:
+    go2rtc_config["ffmpeg"]["bin"] = ffmpeg_path
+
 # need to replace ffmpeg command when using ffmpeg4
-if int(os.environ["LIBAVFORMAT_VERSION_MAJOR"]) < 59:
+if LIBAVFORMAT_VERSION_MAJOR < 59:
+    rtsp_args = "-fflags nobuffer -flags low_delay -stimeout 10000000 -user_agent go2rtc/ffmpeg -rtsp_transport tcp -i {input}"
     if go2rtc_config.get("ffmpeg") is None:
-        go2rtc_config["ffmpeg"] = {
-            "rtsp": "-fflags nobuffer -flags low_delay -stimeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_transport tcp -i {input}"
-        }
+        go2rtc_config["ffmpeg"] = {"rtsp": rtsp_args}
     elif go2rtc_config["ffmpeg"].get("rtsp") is None:
-        go2rtc_config["ffmpeg"][
-            "rtsp"
-        ] = "-fflags nobuffer -flags low_delay -stimeout 5000000 -user_agent go2rtc/ffmpeg -rtsp_transport tcp -i {input}"
+        go2rtc_config["ffmpeg"]["rtsp"] = rtsp_args
 
 for name in go2rtc_config.get("streams", {}):
     stream = go2rtc_config["streams"][name]
@@ -131,10 +135,10 @@ for name in go2rtc_config.get("streams", {}):
 
 # add birdseye restream stream if enabled
 if config.get("birdseye", {}).get("restream", False):
-    birdseye: dict[str, any] = config.get("birdseye")
+    birdseye: dict[str, Any] = config.get("birdseye")
 
     input = f"-f rawvideo -pix_fmt yuv420p -video_size {birdseye.get('width', 1280)}x{birdseye.get('height', 720)} -r 10 -i {BIRDSEYE_PIPE}"
-    ffmpeg_cmd = f"exec:{parse_preset_hardware_acceleration_encode(config.get('ffmpeg', {}).get('hwaccel_args'), input, '-rtsp_transport tcp -f rtsp {output}')}"
+    ffmpeg_cmd = f"exec:{parse_preset_hardware_acceleration_encode(ffmpeg_path, config.get('ffmpeg', {}).get('hwaccel_args', ''), input, '-rtsp_transport tcp -f rtsp {output}')}"
 
     if go2rtc_config.get("streams"):
         go2rtc_config["streams"]["birdseye"] = ffmpeg_cmd

docker/main/rootfs/usr/local/nginx/conf/auth_location.conf

@@ -0,0 +1,43 @@
+set $upstream_auth http://127.0.0.1:5001/auth;
+
+## Virtual endpoint created by nginx to forward auth requests.
+location /auth {
+    ## Essential Proxy Configuration
+    internal;
+    proxy_pass $upstream_auth;
+
+    ## Headers
+
+    # First strip out all the request headers
+    # Note: This is important to ensure that upgrade requests for secure
+    #       websockets dont cause the backend to fail
+    proxy_pass_request_headers off;
+    # Pass info about the request
+    proxy_set_header X-Original-Method $request_method;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Server-Port $server_port;
+    proxy_set_header Content-Length "";
+    # Pass along auth related info
+    proxy_set_header Authorization $http_authorization;
+    proxy_set_header Cookie $http_cookie;
+    proxy_set_header X-CSRF-TOKEN "1";
+
+    # include headers from common auth proxies
+    include proxy_trusted_headers.conf;
+
+    ## Basic Proxy Configuration
+    proxy_pass_request_body off;
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
+    proxy_redirect http:// $scheme://;
+    proxy_http_version 1.1;
+    proxy_cache_bypass $cookie_session;
+    proxy_no_cache $cookie_session;
+    proxy_buffers 4 32k;
+    client_body_buffer_size 128k;
+
+    ## Advanced Proxy Configuration
+    send_timeout 5m;
+    proxy_read_timeout 240;
+    proxy_send_timeout 240;
+    proxy_connect_timeout 240;
+}

docker/main/rootfs/usr/local/nginx/conf/auth_request.conf

@@ -0,0 +1,24 @@
+## Send a subrequest to verify if the user is authenticated and has permission to access the resource.
+auth_request /auth;
+
+## Save the upstream metadata response headers from the auth request to variables
+auth_request_set $user $upstream_http_remote_user;
+auth_request_set $role $upstream_http_remote_role;
+auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
+
+## Inject the metadata response headers from the variables into the request made to the backend.
+proxy_set_header Remote-User $user;
+proxy_set_header Remote-Role $role;
+proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Email $email;
+proxy_set_header Remote-Name $name;
+
+## Refresh the cookie as needed
+auth_request_set $auth_cookie $upstream_http_set_cookie;
+add_header Set-Cookie $auth_cookie;
+
+## Pass the location header back up if it exists
+auth_request_set $redirection_url $upstream_http_location;
+add_header Location $redirection_url;

docker/main/rootfs/usr/local/nginx/conf/go2rtc_upstream.conf

@@ -0,0 +1,4 @@
+upstream go2rtc {
+    server 127.0.0.1:1984;
+    keepalive 1024;
+}

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -10,12 +10,16 @@ events {
 }
 
 http {
+    map_hash_bucket_size 256;
+
     include mime.types;
     default_type application/octet-stream;
 
     log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
-                        '"$http_user_agent" "$http_x_forwarded_for"';
+                        '"$http_user_agent" "$http_x_forwarded_for" '
+                        'request_time="$request_time" upstream_response_time="$upstream_response_time"';
+
 
     access_log /dev/stdout main;
 
@@ -28,12 +32,17 @@ http {
 
     gzip on;
     gzip_comp_level 6;
-    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/javascript image/svg+xml image/x-icon image/bmp image/png image/gif image/jpeg image/jpg;
+    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/javascript image/svg+xml image/x-icon image/bmp;
     gzip_proxied no-cache no-store private expired auth;
     gzip_vary on;
 
     proxy_cache_path /dev/shm/nginx_cache levels=1:2 keys_zone=api_cache:10m max_size=10m inactive=1m use_temp_path=off;
 
+    map $sent_http_content_type $should_not_cache {
+        'application/json' 0;
+        default 1;
+    }
+
     upstream frigate_api {
         server 127.0.0.1:5001;
         keepalive 1024;
@@ -49,13 +58,10 @@ http {
         keepalive 1024;
     }
 
-    upstream go2rtc {
-        server 127.0.0.1:1984;
-        keepalive 1024;
-    }
+    include go2rtc_upstream.conf;
 
     server {
-        listen 5000;
+        include listen.conf;
 
         # vod settings
         vod_base_url '';
@@ -67,6 +73,8 @@ http {
         vod_manifest_segment_durations_mode accurate;
         vod_ignore_edit_list on;
         vod_segment_duration 10000;
+
+        # MPEG-TS settings (not used when fMP4 is enabled, kept for reference)
         vod_hls_mpegts_align_frames off;
         vod_hls_mpegts_interleave_frames on;
 
@@ -77,6 +85,9 @@ http {
         open_file_cache_errors on;
         aio on;
 
+        # file upload size
+        client_max_body_size 20M;
+
         # https://github.com/kaltura/nginx-vod-module#vod_open_file_thread_pool
         vod_open_file_thread_pool default;
 
@@ -88,18 +99,37 @@ http {
         gzip on;
         gzip_types application/vnd.apple.mpegurl;
 
+        include auth_location.conf;
+        include base_path.conf;
+
         location /vod/ {
+            include auth_request.conf;
             aio threads;
             vod hls;
 
+            # Use fMP4 (fragmented MP4) instead of MPEG-TS for better performance
+            # Smaller segments, faster generation, better browser compatibility
+            vod_hls_container_format fmp4;
+
             secure_token $args;
             secure_token_types application/vnd.apple.mpegurl;
 
             add_header Cache-Control "no-store";
             expires off;
+
+            keepalive_disable safari;
+
+            # vod module returns 502 for non-existent media
+            # https://github.com/kaltura/nginx-vod-module/issues/468
+            error_page 502 =404 /vod-not-found;
+        }
+
+        location = /vod-not-found {
+            return 404;
         }
 
         location /stream/ {
+            include auth_request.conf;
             add_header Cache-Control "no-store";
             expires off;
 
@@ -114,12 +144,14 @@ http {
         }
 
         location /clips/ {
-
+            include auth_request.conf;
             types {
                 video/mp4 mp4;
                 image/jpeg jpg;
             }
 
+            expires 7d;
+            add_header Cache-Control "public";
             autoindex on;
             root /media/frigate;
         }
@@ -130,6 +162,7 @@ http {
         }
 
         location /recordings/ {
+            include auth_request.conf;
             types {
                 video/mp4 mp4;
             }
@@ -140,6 +173,7 @@ http {
         }
 
         location /exports/ {
+            include auth_request.conf;
             types {
                 video/mp4 mp4;
             }
@@ -150,38 +184,75 @@ http {
         }
 
         location /ws {
+            include auth_request.conf;
             proxy_pass http://mqtt_ws/;
             include proxy.conf;
         }
 
         location /live/jsmpeg/ {
+            include auth_request.conf;
             proxy_pass http://jsmpeg/;
             include proxy.conf;
         }
 
-        location /live/mse/ {
-            proxy_pass http://go2rtc/;
+        # frigate lovelace card uses this path
+        location /live/mse/api/ws {
+            include auth_request.conf;
+            limit_except GET {
+                deny  all;
+            }
+            proxy_pass http://go2rtc/api/ws;
             include proxy.conf;
         }
 
-        location /live/webrtc/ {
-            proxy_pass http://go2rtc/;
+        location /live/webrtc/api/ws {
+            include auth_request.conf;
+            limit_except GET {
+                deny  all;
+            }
+            proxy_pass http://go2rtc/api/ws;
             include proxy.conf;
         }
 
-        location ~* /api/go2rtc([/]?.*)$ {
-            proxy_pass http://go2rtc;
-            rewrite ^/api/go2rtc(.*)$ /api$1 break;
+        # pass through go2rtc player
+        location /live/webrtc/webrtc.html {
+            include auth_request.conf;
+            limit_except GET {
+                deny  all;
+            }
+            proxy_pass http://go2rtc/webrtc.html;
             include proxy.conf;
         }
 
-        location ~* /api/.*\.(jpg|jpeg|png)$ {
-            rewrite ^/api/(.*)$ $1 break;
+        # frontend uses this to fetch the version
+        location /api/go2rtc/api {
+            include auth_request.conf;
+            limit_except GET {
+                deny  all;
+            }
+            proxy_pass http://go2rtc/api;
+            include proxy.conf;
+        }
+
+        # integration uses this to add webrtc candidate
+        location /api/go2rtc/webrtc {
+            include auth_request.conf;
+            limit_except POST {
+                deny  all;
+            }
+            proxy_pass http://go2rtc/api/webrtc;
+            include proxy.conf;
+        }
+
+        location ~* /api/.*\.(jpg|jpeg|png|webp|gif)$ {
+            include auth_request.conf;
+            rewrite ^/api/(.*)$ /$1 break;
             proxy_pass http://frigate_api;
             include proxy.conf;
         }
 
         location /api/ {
+            include auth_request.conf;
             add_header Cache-Control "no-store";
             expires off;
             proxy_pass http://frigate_api/;
@@ -192,30 +263,54 @@ http {
             proxy_cache_use_stale updating;
             proxy_cache_valid 200 5s;
             proxy_cache_bypass $http_x_cache_bypass;
+            proxy_no_cache $should_not_cache;
             add_header X-Cache-Status $upstream_cache_status;
 
             location /api/vod/ {
+                include auth_request.conf;
                 proxy_pass http://frigate_api/vod/;
                 include proxy.conf;
                 proxy_cache off;
             }
 
+            location /api/login {
+                auth_request off;
+                rewrite ^/api(/.*)$ $1 break;
+                proxy_pass http://frigate_api;
+                include proxy.conf;
+            }
+
+            # Allow unauthenticated access to the first_time_login endpoint
+            # so the login page can load help text before authentication.
+            location /api/auth/first_time_login {
+                auth_request off;
+                limit_except GET {
+                    deny all;
+                }
+                rewrite ^/api(/.*)$ $1 break;
+                proxy_pass http://frigate_api;
+                include proxy.conf;
+            }
+
             location /api/stats {
+                include auth_request.conf;
                 access_log off;
-                rewrite ^/api/(.*)$ $1 break;
+                rewrite ^/api(/.*)$ $1 break;
                 proxy_pass http://frigate_api;
                 include proxy.conf;
             }
 
             location /api/version {
+                include auth_request.conf;
                 access_log off;
-                rewrite ^/api/(.*)$ $1 break;
+                rewrite ^/api(/.*)$ $1 break;
                 proxy_pass http://frigate_api;
                 include proxy.conf;
             }
         }
 
         location / {
+            # do not require auth for static assets
             add_header Cache-Control "no-store";
             expires off;
 
@@ -225,11 +320,35 @@ http {
                 add_header Cache-Control "public";
             }
 
+            location /fonts/ {
+                access_log off;
+                expires 1y;
+                add_header Cache-Control "public";
+            }
+
+            location /locales/ {
+                access_log off;
+                add_header Cache-Control "public";
+            }
+
+            location ~ ^/.*-([A-Za-z0-9]+)\.webmanifest$ {
+                access_log off;
+                expires 1y;
+                add_header Cache-Control "public";
+                default_type application/json;
+                proxy_set_header Accept-Encoding "";
+                sub_filter_once off;
+                sub_filter_types application/json;
+                sub_filter '"start_url": "/BASE_PATH/"' '"start_url" : "$http_x_ingress_path/"';
+                sub_filter '"src": "/BASE_PATH/' '"src": "$http_x_ingress_path/';
+            }
+
             sub_filter 'href="/BASE_PATH/' 'href="$http_x_ingress_path/';
             sub_filter 'url(/BASE_PATH/' 'url($http_x_ingress_path/';
             sub_filter '"/BASE_PATH/dist/' '"$http_x_ingress_path/dist/';
             sub_filter '"/BASE_PATH/js/' '"$http_x_ingress_path/js/';
             sub_filter '"/BASE_PATH/assets/' '"$http_x_ingress_path/assets/';
+            sub_filter '"/BASE_PATH/locales/' '"$http_x_ingress_path/locales/';
             sub_filter '"/BASE_PATH/monacoeditorwork/' '"$http_x_ingress_path/assets/';
             sub_filter 'return"/BASE_PATH/"' 'return window.baseUrl';
             sub_filter '<body>' '<body><script>window.baseUrl="$http_x_ingress_path/";</script>';
@@ -237,22 +356,7 @@ http {
             sub_filter_once off;
 
             root /opt/frigate/web;
-            try_files $uri $uri/ /index.html;
-        }
-    }
-}
-
-rtmp {
-    server {
-        listen 1935;
-        chunk_size 4096;
-        allow publish 127.0.0.1;
-        deny publish all;
-        allow play all;
-        application live {
-            live on;
-            record off;
-            meta copy;
+            try_files $uri $uri.html $uri/ /index.html;
         }
     }
 }

docker/main/rootfs/usr/local/nginx/conf/proxy.conf

@@ -1,4 +1,26 @@
-proxy_http_version 1.1;
+## Headers
+proxy_set_header Host $host;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "Upgrade";
-proxy_set_header Host $host;
+proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host $http_host;
+proxy_set_header X-Forwarded-URI $request_uri;
+proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Real-IP $remote_addr;
+
+## Basic Proxy Configuration
+client_body_buffer_size 128k;
+proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
+proxy_redirect  http://  $scheme://;
+proxy_http_version 1.1;
+proxy_cache_bypass $cookie_session;
+proxy_no_cache $cookie_session;
+proxy_buffers 64 256k;
+
+## Advanced Proxy Configuration
+send_timeout 5m;
+proxy_read_timeout 360;
+proxy_send_timeout 360;
+proxy_connect_timeout 360;

docker/main/rootfs/usr/local/nginx/conf/proxy_trusted_headers.conf

@@ -0,0 +1,25 @@
+# Header used to validate reverse proxy trust
+proxy_set_header X-Proxy-Secret $http_x_proxy_secret;
+
+# these headers will be copied to the /auth request and are available
+# to be mapped in the config to Frigate's remote-user header
+
+# List of headers sent by common authentication proxies:
+# - Authelia
+# - Traefik forward auth
+# - oauth2_proxy
+# - Authentik
+
+proxy_set_header Remote-User $http_remote_user;
+proxy_set_header Remote-Groups $http_remote_groups;
+proxy_set_header Remote-Email $http_remote_email;
+proxy_set_header Remote-Name $http_remote_name;
+proxy_set_header X-Forwarded-User $http_x_forwarded_user;
+proxy_set_header X-Forwarded-Groups $http_x_forwarded_groups;
+proxy_set_header X-Forwarded-Email $http_x_forwarded_email;
+proxy_set_header X-Forwarded-Preferred-Username $http_x_forwarded_preferred_username;
+proxy_set_header X-authentik-username $http_x_authentik_username;
+proxy_set_header X-authentik-groups $http_x_authentik_groups;
+proxy_set_header X-authentik-email $http_x_authentik_email;
+proxy_set_header X-authentik-name $http_x_authentik_name;
+proxy_set_header X-authentik-uid $http_x_authentik_uid;

docker/main/rootfs/usr/local/nginx/get_base_path.py

@@ -0,0 +1,11 @@
+"""Prints the base path as json to stdout."""
+
+import json
+import os
+from typing import Any
+
+base_path = os.environ.get("FRIGATE_BASE_PATH", "")
+
+result: dict[str, Any] = {"base_path": base_path}
+
+print(json.dumps(result))

docker/main/rootfs/usr/local/nginx/get_listen_settings.py

@@ -0,0 +1,35 @@
+"""Prints the tls config as json to stdout."""
+
+import json
+import sys
+from typing import Any
+
+from ruamel.yaml import YAML
+
+sys.path.insert(0, "/opt/frigate")
+from frigate.util.config import find_config_file
+
+sys.path.remove("/opt/frigate")
+
+yaml = YAML()
+
+config_file = find_config_file()
+
+try:
+    with open(config_file) as f:
+        raw_config = f.read()
+
+    if config_file.endswith((".yaml", ".yml")):
+        config: dict[str, Any] = yaml.load(raw_config)
+    elif config_file.endswith(".json"):
+        config: dict[str, Any] = json.loads(raw_config)
+except FileNotFoundError:
+    config: dict[str, Any] = {}
+
+tls_config: dict[str, any] = config.get("tls", {"enabled": True})
+networking_config = config.get("networking", {})
+ipv6_config = networking_config.get("ipv6", {"enabled": False})
+
+output = {"tls": tls_config, "ipv6": ipv6_config}
+
+print(json.dumps(output))

docker/main/rootfs/usr/local/nginx/templates/base_path.gotmpl

@@ -0,0 +1,19 @@
+{{ if .base_path }}
+location = {{ .base_path }} {
+    return 302 {{ .base_path }}/;
+}
+
+location ^~ {{ .base_path }}/ {
+    # remove base_url from the path before passing upstream
+    rewrite ^{{ .base_path }}/(.*) /$1 break;
+
+    proxy_pass $scheme://127.0.0.1:8971;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Ingress-Path {{ .base_path }};
+
+    access_log off;
+}
+{{ end }}

docker/main/rootfs/usr/local/nginx/templates/listen.gotmpl

@@ -0,0 +1,45 @@
+
+# Internal (IPv4 always; IPv6 optional)
+listen 5000;
+{{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:5000;{{ end }}{{ end }}
+
+
+# intended for external traffic, protected by auth
+{{ if .tls }}
+    {{ if .tls.enabled }}
+        # external HTTPS (IPv4 always; IPv6 optional)
+        listen 8971 ssl;
+        {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971 ssl;{{ end }}{{ end }}
+
+        ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;
+
+        # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
+        # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+        ssl_session_tickets off;
+
+        # modern configuration
+        ssl_protocols TLSv1.3;
+        ssl_prefer_server_ciphers off;
+
+        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
+        # ACME challenge location
+        location /.well-known/acme-challenge/ {
+                default_type "text/plain";
+                root /etc/letsencrypt/www;
+        }
+    {{ else }}
+        # external HTTP (IPv4 always; IPv6 optional)
+        listen 8971;
+        {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
+    {{ end }}
+{{ else }}
+    # (No tls section) default to HTTP (IPv4 always; IPv6 optional)
+    listen 8971;
+    {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
+{{ end }}
+

docker/memryx/user_installation.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+set -e  # Exit immediately if any command fails
+set -o pipefail
+
+echo "Starting MemryX driver and runtime installation..."
+
+# Detect architecture
+arch=$(uname -m)
+
+# Purge existing packages and repo
+echo "Removing old MemryX installations..."
+# Remove any holds on MemryX packages (if they exist)
+sudo apt-mark unhold memx-* mxa-manager || true
+sudo apt purge -y memx-* mxa-manager || true
+sudo rm -f /etc/apt/sources.list.d/memryx.list /etc/apt/trusted.gpg.d/memryx.asc
+
+# Install kernel headers
+echo "Installing kernel headers for: $(uname -r)"
+sudo apt update
+sudo apt install -y dkms linux-headers-$(uname -r)
+
+# Add MemryX key and repo
+echo "Adding MemryX GPG key and repository..."
+wget -qO- https://developer.memryx.com/deb/memryx.asc | sudo tee /etc/apt/trusted.gpg.d/memryx.asc >/dev/null
+echo 'deb https://developer.memryx.com/deb stable main' | sudo tee /etc/apt/sources.list.d/memryx.list >/dev/null
+
+# Update and install specific SDK 2.1 packages
+echo "Installing MemryX SDK 2.1 packages..."
+sudo apt update
+sudo apt install -y memx-drivers=2.1.* memx-accl=2.1.* mxa-manager=2.1.*
+
+# Hold packages to prevent automatic upgrades
+sudo apt-mark hold memx-drivers memx-accl mxa-manager
+
+# ARM-specific board setup
+if [[ "$arch" == "aarch64" || "$arch" == "arm64" ]]; then
+    echo "Running ARM board setup..."
+    sudo mx_arm_setup
+fi
+
+echo -e "\n\n\033[1;31mYOU MUST RESTART YOUR COMPUTER NOW\033[0m\n\n"
+
+echo "MemryX SDK 2.1 installation complete!"
+

docker/rockchip/COCO/coco_subset_20.txt

@@ -0,0 +1,20 @@
+./subset/000000005001.jpg
+./subset/000000038829.jpg
+./subset/000000052891.jpg
+./subset/000000075612.jpg
+./subset/000000098261.jpg
+./subset/000000181542.jpg
+./subset/000000215245.jpg
+./subset/000000277005.jpg
+./subset/000000288685.jpg
+./subset/000000301421.jpg
+./subset/000000334371.jpg
+./subset/000000348481.jpg
+./subset/000000373353.jpg
+./subset/000000397681.jpg
+./subset/000000414673.jpg
+./subset/000000419312.jpg
+./subset/000000465822.jpg
+./subset/000000475732.jpg
+./subset/000000559707.jpg
+./subset/000000574315.jpg