mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-10-19 21:22:50 +03:00
Josh HawkinsandGitHub
e61ad52b67
CI / AMD64 Build (push) Canceled after 0s
CI / AMD64 Smoke Test (push) Canceled after 0s
CI / ARM Build (push) Canceled after 0s
CI / Jetson Jetpack 6 (push) Canceled after 0s
CI / AMD64 Extra Build (push) Canceled after 0s
CI / ARM Extra Build (push) Canceled after 0s
CI / Synaptics Build (push) Canceled after 0s
CI / Assemble and push default build (push) Canceled after 0s
go2rtc's create_config.py imported frigate.config.env, which ran the frigate.config package init and loaded every detector plugin. Since the onnxruntime 1.30 bump, importing onnxruntime takes about 5s on some hosts, so go2rtc started after Frigate's cameras and every ffmpeg process failed to connect to the restream until it came up. The env helpers now live in frigate.util.env, so go2rtc's config script no longer imports onnxruntime.
71 lines
2.5 KiB
Python
71 lines
2.5 KiB
Python
from pydantic import Field, field_validator
|
|
|
|
from frigate.util.env import EnvString
|
|
|
|
from .base import FrigateBaseModel
|
|
|
|
__all__ = ["ProxyConfig", "HeaderMappingConfig"]
|
|
|
|
|
|
class HeaderMappingConfig(FrigateBaseModel):
|
|
user: str = Field(
|
|
default=None,
|
|
title="User header",
|
|
description="Header containing the authenticated username provided by the upstream proxy.",
|
|
)
|
|
role: str = Field(
|
|
default=None,
|
|
title="Role header",
|
|
description="Header containing the authenticated user's role or groups from the upstream proxy.",
|
|
)
|
|
role_map: dict[str, list[str]] | None = Field(
|
|
default_factory=dict,
|
|
title=("Role mapping"),
|
|
description="Map upstream group values to Frigate roles (for example map admin groups to the admin role).",
|
|
)
|
|
|
|
|
|
class ProxyConfig(FrigateBaseModel):
|
|
header_map: HeaderMappingConfig = Field(
|
|
default_factory=HeaderMappingConfig,
|
|
title="Header mapping",
|
|
description="Map incoming proxy headers to Frigate user and role fields for proxy-based auth.",
|
|
)
|
|
logout_url: str | None = Field(
|
|
default=None,
|
|
title="Logout URL",
|
|
description="URL to redirect users to when logging out via the proxy.",
|
|
)
|
|
auth_secret: EnvString | None = Field(
|
|
default=None,
|
|
title="Proxy secret",
|
|
description="Optional secret checked against the X-Proxy-Secret header to verify trusted proxies.",
|
|
)
|
|
default_role: str | None = Field(
|
|
default="viewer",
|
|
title="Default role",
|
|
description="Default role assigned to proxy-authenticated users when no role mapping applies. Set to 'none' to deny access to unmapped users.",
|
|
)
|
|
separator: str | None = Field(
|
|
default=",",
|
|
title="Separator character",
|
|
description="Character used to split multiple values provided in proxy headers.",
|
|
)
|
|
|
|
@field_validator("default_role", mode="before")
|
|
@classmethod
|
|
def normalize_deny_sentinel(cls, v):
|
|
# Fail closed on capitalization: an unnormalized "None" would miss the
|
|
# sentinel and fall back to viewer, granting the access it was meant to
|
|
# deny. Other role names stay case-sensitive.
|
|
if isinstance(v, str) and v.strip().lower() == "none":
|
|
return "none"
|
|
return v
|
|
|
|
@field_validator("separator", mode="before")
|
|
@classmethod
|
|
def validate_separator_length(cls, v):
|
|
if v is not None and len(v) != 1:
|
|
raise ValueError("Separator must be exactly one character")
|
|
return v
|