mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-10-19 05:02:49 +03:00
Josh HawkinsandGitHub
275e18403e
* remove unreachable FileNotFoundError catches around frame_manager.get * clear the end time cache entry when a segment is moved The successful move returned before the end_time_cache pop at the bottom of move_segment, so every kept segment left its entry, keyframes list included, in the cache for the life of the process. Removing the cache file through drop_segment clears the entry with it. * drop the cache file when the recording destination already exists When the destination mp4 already existed, move_segment returned without removing the cache file, so the next pass probed and resolved the same segment again, forever. The leftover file is now dropped along with its end time cache entry, the same as the exception path. * pace restarts of exited record and audio ffmpeg processes The watchdog loop runs every second, and an exited record or audio ffmpeg was restarted on every pass with no backoff. A camera that refuses connections, such as one rebooting or rejecting credentials, got a reconnect attempt and a dump of ffmpeg's logs every second until it came back. The restart is now gated on can_restart like the stale segment and detect paths. * don't send a stray newline in the certsync tls probe The probe piped echo into openssl s_client, which sent the newline to nginx as a request after the handshake, so nginx logged an empty "" 400 line every 60 seconds on any install with TLS enabled. Reading stdin from /dev/null closes the connection right after the handshake. The fingerprint and the failure logging are unchanged. * require a record expire_interval of at least 1 An expire_interval of 0 or less made the cleanup loop iterate over an empty range, so the cleanup thread exited on startup and expired recordings, temp clips and previews were never removed. * remove the transcription temp wav when whisper raises The temp wav was only removed after a successful transcribe call, so every failed transcription left a file in the cache directory. * don't kill the ipc responder when a described event is gone handle_update_event_description used Event.get, so a GenAI description that finished after its event was deleted raised DoesNotExist on the inter-process REP thread. That thread died with a reply still owed, and every process waiting on the requestor hung until restart. A missing event is now skipped. * size the birdseye frame from the snapped canvas shape The birdseye writer sizes its shared memory with get_canvas_shape, which snaps an unsupported aspect ratio such as 1920x1200 to a supported one, but the tracked object processor read it with the raw config width and height. The sizes never matched, so get returned None on every call and /api/birdseye/latest.jpg returned a 500, which broke the Home Assistant birdseye entity's still image. The reader now uses the same canvas shape, and a missing frame during startup returns an error response instead of raising in cvtColor. * remove dead disconnect timer from the mse player The effect that scheduled a delayed disconnect when playback was disabled never ran its body. The connect effect's cleanup already calls onDisconnect, which clears wsRef before the later effect checks it. * remove partial output when a recording move fails A remux that failed partway, such as on a full disk, left a partial mp4 at the destination. The next pass saw the destination already existed and dropped the cache file instead of retrying, so the segment was never saved. The failed output is now removed so the next pass retries the move. Tests cover the success, existing destination and failed move paths of move_segment.
86 lines
2.5 KiB
Plaintext
Executable File
86 lines
2.5 KiB
Plaintext
Executable File
#!/command/with-contenv bash
|
|
# shellcheck shell=bash
|
|
# Start the CERTSYNC service
|
|
|
|
set -o errexit -o nounset -o pipefail
|
|
|
|
# Logs should be sent to stdout so that s6 can collect them
|
|
|
|
# Not `nginx -s reload`: that has root parse /tmp/nginx/conf, which the
|
|
# unprivileged nginx user can rewrite, and nginx chowns path directives on load.
|
|
function reload_nginx() {
|
|
local pid
|
|
|
|
if ! pid=$(cat /tmp/nginx/nginx.pid 2>/dev/null); then
|
|
echo "[ERROR] No nginx pid file found, not reloading"
|
|
return 0
|
|
fi
|
|
|
|
if [[ ! "$pid" =~ ^[0-9]+$ ]] || [[ "$(cat "/proc/${pid}/comm" 2>/dev/null)" != "nginx" ]]; then
|
|
echo "[ERROR] nginx pid file does not name a running nginx process, not reloading"
|
|
return 0
|
|
fi
|
|
|
|
kill -HUP "$pid"
|
|
}
|
|
|
|
echo "[INFO] Starting certsync..."
|
|
|
|
# Resolved once, and the condition must stay identical to the nginx run
|
|
# script's. Testing only fullchain.pem here would pick the mounted cert on a
|
|
# half-populated mount that nginx rejected, and the two fingerprints would then
|
|
# never agree, reloading nginx every cycle forever.
|
|
if [ -f /etc/letsencrypt/live/frigate/privkey.pem ] && [ -f /etc/letsencrypt/live/frigate/fullchain.pem ]; then
|
|
lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
|
|
else
|
|
lefile="/config/tls/fullchain.pem"
|
|
fi
|
|
|
|
tls_enabled=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .tls.enabled`
|
|
listen_external_port=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .listen.external_port`
|
|
|
|
while true
|
|
do
|
|
if [[ "$tls_enabled" == 'false' ]]; then
|
|
sleep 9999
|
|
continue
|
|
fi
|
|
|
|
if [ ! -e $lefile ]
|
|
then
|
|
echo "[ERROR] TLS certificate does not exist: $lefile"
|
|
fi
|
|
|
|
leprint=`openssl x509 -in $lefile -fingerprint -noout 2>&1 || echo 'failed'`
|
|
|
|
case "$leprint" in
|
|
*Fingerprint*)
|
|
;;
|
|
*)
|
|
echo "[ERROR] Missing fingerprint from $lefile"
|
|
;;
|
|
esac
|
|
|
|
liveprint=`openssl s_client -showcerts -connect 127.0.0.1:$listen_external_port </dev/null 2>&1 | openssl x509 -fingerprint 2>&1 | grep -i fingerprint || echo 'failed'`
|
|
|
|
case "$liveprint" in
|
|
*Fingerprint*)
|
|
;;
|
|
*)
|
|
echo "[ERROR] Missing fingerprint from current nginx TLS cert"
|
|
;;
|
|
esac
|
|
|
|
if [[ "$leprint" != "failed" && "$liveprint" != "failed" && "$leprint" != "$liveprint" ]]
|
|
then
|
|
echo "[INFO] Reloading nginx to refresh TLS certificate"
|
|
echo "$lefile: $leprint"
|
|
reload_nginx
|
|
fi
|
|
|
|
sleep 60
|
|
|
|
done
|
|
|
|
exit 0
|