Add Frigate, mask IPs in config - #255
Conversation
WalkthroughAdds Frigate video-surveillance: new Docker service and config, example env updates (IP redaction and Frigate env vars), documentation, and a script change to generalize masking of IP-like variables. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Camera as RTSP Camera
participant Frigate as Frigate Container
participant Storage as Host Storage (${STORAGE_FRIGATE})
participant Proxy as Traefik Proxy
participant Client as User (Browser)
rect rgb(221,238,255)
Note over Camera,Frigate: Video ingestion
Camera->>Frigate: RTSP streams (main/sub)
end
rect rgb(240,248,255)
Note over Frigate,Storage: Processing & persistence
Frigate->>Frigate: detection (OpenVINO), recording
Frigate->>Storage: write recordings & events
end
rect rgb(255,245,230)
Note over Client,Proxy: UI access and proxying
Client->>Proxy: HTTP(S) request
Proxy->>Frigate: route to Frigate UI port (Traefik)
Frigate-->>Client: UI + WebRTC/streams
end
Note right of Frigate: reads `FRIGATE_CAMERA_*` env, `config.yml`, tmpfs cache, shm_size
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (9)
config-example/docker/myhost/.env (2)
13-13: Consider maintaining alphabetical ordering.For better maintainability, storage variables are typically kept in alphabetical order. This variable could be placed before
STORAGE_KIWIX(line 11).
136-139: Address quote inconsistency and consider variable ordering.Static analysis has flagged two issues:
- Quote inconsistency: Lines 137-138 wrap placeholder values in quotes, but line 139 doesn't. For consistency with other placeholder values in this file, either add quotes to line 139 or remove them from lines 137-138.
- Variable ordering: Consider ordering these variables alphabetically (FRIGATE_CAMERA_IP, then PASSWORD, then USER) for better maintainability.
🔎 Proposed fix
### Frigate configuration -FRIGATE_CAMERA_USER="admin" -FRIGATE_CAMERA_PASSWORD="use-some-very-secure-value-here" -FRIGATE_CAMERA_IP=xxx.xxx.xxx.xxx +FRIGATE_CAMERA_IP="xxx.xxx.xxx.xxx" +FRIGATE_CAMERA_PASSWORD="use-some-very-secure-value-here" +FRIGATE_CAMERA_USER="admin"docker/security/frigate.yaml (1)
23-23: Consider pinning to a specific version for reproducibility.Using the
stabletag provides automatic updates but can lead to unexpected breaking changes in non-testing environments. If stricter version control is desired, consider pinning to a specific version (e.g.,ghcr.io/blakeblackshear/frigate:0.15.0). However, the:stabletag is a commonly supported approach for Frigate and acceptable for most deployments.docker/security/frigate/config.yml (2)
11-13: Consider explicitly disabling authentication.The commented section suggests authentication should be disabled when using Traefik + Authelia, but leaving it commented may rely on Frigate's default behavior. For clarity and to prevent surprises if defaults change, consider uncommenting and explicitly setting
enabled: false.🔎 Proposed change
-# Disable authentication (since we're using Traefik + Authelia) -# auth: -# enabled: false +# Disable authentication (since we're using Traefik + Authelia) +auth: + enabled: false
43-49: Confirm whether dual OpenVINO detectors are necessary for this single-camera setup.While Frigate supports multiple detectors for throughput optimization and load distribution across hardware accelerators, your single-camera configuration running at 5 fps may not require two identical
ov_0andov_1detectors. Verify whether both are intentional—if the setup is designed for future multi-camera expansion or specific hardware acceleration distribution, document the reasoning; otherwise, a single detector would reduce resource overhead.docs/PRPs/containers/frigate.md (3)
17-17: Fix hyphenation for compound adjective.The phrase "bare metal Debian-based" should use a hyphen: "bare-metal Debian-based" when used as a compound adjective before a noun.
Based on static analysis hints.
🔎 Proposed fix
-Docker with Docker Compose is the **recommended** installation approach for Frigate. The container runs best on bare metal Debian-based systems with low-overhead hardware access for accelerators. +Docker with Docker Compose is the **recommended** installation approach for Frigate. The container runs best on bare-metal Debian-based systems with low-overhead hardware access for accelerators.
64-68: Add language specifier to fenced code block.The calculation formula code block on Line 66 should specify a language for proper syntax highlighting and rendering. Consider using
textorplaintextas the language identifier.Based on static analysis hints.
🔎 Proposed fix
The default Docker shm-size is 64MB, but Frigate needs more. Calculate using: -``` +```text width × height × 1.5 × 20 + 270480 bytes, plus 40MB for logs</details> --- `157-157`: **Format URL as proper markdown link.** The URL on Line 157 should be formatted as a proper markdown link for better accessibility and documentation standards. Based on static analysis hints. <details> <summary>🔎 Proposed fix</summary> ```diff -See https://docs.frigate.video/configuration/ for full configuration reference. +See [Frigate configuration documentation](https://docs.frigate.video/configuration/) for full configuration reference.scripts/update-example-env.py (1)
32-44: Well-implemented word-boundary matching.The regex pattern correctly treats underscores as word boundaries, ensuring that
SERVER_IPmatchesIPwhile preventing false matches in words likeSTRIP. The function is well-documented with a clear docstring explaining the behavior.Consider adding inline examples in the docstring to illustrate the matching behavior:
🔎 Enhanced docstring
def get_generalized_value(variable_name: str) -> str | None: """Check if any generalization key appears as a discrete word in the variable name. Treats underscore as a word boundary, so SERVER_IP will match IP. + + Examples: + SERVER_IP -> matches IP (returns 'xxx.xxx.xxx.xxx') + MAIN_NODE_IP -> matches IP (returns 'xxx.xxx.xxx.xxx') + STRIP -> no match (returns None) + IPAD -> no match (returns None) + Returns the generalized value if a match is found, None otherwise. """
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
config-example/docker/.envconfig-example/docker/myhost/.envconfig-example/docker/myhost/.env.supabaseconfig-example/docker/myhost/services.yamldocker/security/frigate.yamldocker/security/frigate/config.ymldocs/PRPs/containers/frigate.mdscripts/update-example-env.py
🧰 Additional context used
📓 Path-based instructions (2)
**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
Python files must pass Ruff linting
Files:
scripts/update-example-env.py
**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
YAML files must pass YAML linting and validation
Files:
docker/security/frigate/config.ymlconfig-example/docker/myhost/services.yamldocker/security/frigate.yaml
🧬 Code graph analysis (1)
docs/PRPs/containers/frigate.md (1)
docs/web/update-docs.py (1)
process_docker_directory(135-194)
🪛 dotenv-linter (4.0.0)
config-example/docker/myhost/.env
[warning] 13-13: [UnorderedKey] The STORAGE_FRIGATE key should go before the STORAGE_KIWIX key
(UnorderedKey)
[warning] 137-137: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 138-138: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 138-138: [UnorderedKey] The FRIGATE_CAMERA_PASSWORD key should go before the FRIGATE_CAMERA_USER key
(UnorderedKey)
[warning] 139-139: [UnorderedKey] The FRIGATE_CAMERA_IP key should go before the FRIGATE_CAMERA_PASSWORD key
(UnorderedKey)
🪛 LanguageTool
docs/PRPs/containers/frigate.md
[grammar] ~17-~17: Use a hyphen to join words.
Context: ...Frigate. The container runs best on bare metal Debian-based systems with low-over...
(QB_NEW_EN_HYPHEN)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/frigate.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
66-66: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
157-157: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: check
🔇 Additional comments (13)
config-example/docker/myhost/.env.supabase (1)
108-108: Verify this change is intentional.This email address change appears unrelated to the PR objectives (adding Frigate and masking IPs). Is this an intentional update or an accidental inclusion?
config-example/docker/myhost/services.yaml (1)
18-19: LGTM!The Frigate service is correctly added to the security section with proper formatting.
config-example/docker/myhost/.env (1)
32-32: LGTM!IP masking is appropriate for example configuration files and aligns with the PR objectives.
config-example/docker/.env (1)
16-16: LGTM!IP address masking is appropriate for example configuration files and aligns with the PR objectives to prevent accidental exposure of real infrastructure details.
Also applies to: 19-19
docker/security/frigate.yaml (3)
1-19: Good documentation with actionable TODOs.The comments provide helpful context and links. The TODOs appropriately highlight configuration tasks that should be addressed during deployment.
34-42: LGTM!Volume configuration is appropriate:
- Read-only localtime mount for timezone sync
- Proper persistent storage for media and config
- tmpfs cache for performance (1GB should be sufficient for most setups)
43-54: Verify direct port exposure is intentional.The service exposes ports 8971 (UI), 8554 (RTSP), and 8555 (WebRTC) directly on the host, which allows access bypassing the Traefik reverse proxy and its
localaccessmiddleware. This means:
- Port 8971: Direct access to the UI bypasses authentication/access controls configured in Traefik
- Ports 8554, 8555: Direct RTSP/WebRTC access (likely needed for camera streaming)
If direct UI access is not needed, consider removing the port 8971 mapping and access Frigate exclusively through Traefik for consistent security controls. The RTSP/WebRTC ports are typically required for streaming functionality.
docker/security/frigate/config.yml (1)
51-63: Configuration looks correct.The model configuration and detect settings are properly configured for OpenVINO with SSDLite MobileNet V2. Version pinning to 0.16-0 is a good practice for reproducibility.
docs/PRPs/containers/frigate.md (3)
123-137: Excellent security guidance.The security considerations section provides comprehensive and important warnings about privileged mode, credential management, and network exposure. The emphasis on never exposing port 5000 externally is particularly important.
21-50: Well-structured Docker Compose example.The Docker Compose configuration example is comprehensive and includes important details like device mappings, tmpfs cache, and proper volume mounts. The inclusion of comments makes it easy to understand each component's purpose.
173-195: Helpful alternative deployment method.Providing both Docker Compose and
docker runcommand options accommodates different user preferences and deployment scenarios. The commands are properly equivalent to the Compose configuration.scripts/update-example-env.py (2)
2-2: Appropriate additions for IP masking functionality.The
reimport and newIPgeneralization entry align well with the PR objective to mask IP addresses in example configuration files. The generic placeholderxxx.xxx.xxx.xxxis clear and conventional.Also applies to: 23-24
46-64: Improved masking logic with flexible pattern matching.The updated logic correctly uses
get_generalized_valueto enable word-boundary matching instead of exact key matching. This allows variables likeMAIN_NODE_IPandSERVER_IPto be automatically generalized based on theIPkey, making the script more flexible and maintainable.
9b802ba to
a7f9cd1
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
config-example/docker/.envconfig-example/docker/myhost/.envconfig-example/docker/myhost/.env.supabaseconfig-example/docker/myhost/services.yamldocker/security/frigate.yamldocker/security/frigate/config.ymldocs/PRPs/containers/frigate.mdscripts/update-example-env.py
🚧 Files skipped from review as they are similar to previous changes (4)
- config-example/docker/myhost/services.yaml
- config-example/docker/.env
- docker/security/frigate.yaml
- scripts/update-example-env.py
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
YAML files must pass YAML linting and validation
Files:
docker/security/frigate/config.yml
🧬 Code graph analysis (1)
docs/PRPs/containers/frigate.md (1)
docs/web/update-docs.py (1)
process_docker_directory(135-194)
🪛 dotenv-linter (4.0.0)
config-example/docker/myhost/.env
[warning] 13-13: [UnorderedKey] The STORAGE_FRIGATE key should go before the STORAGE_KIWIX key
(UnorderedKey)
[warning] 137-137: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 138-138: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 138-138: [UnorderedKey] The FRIGATE_CAMERA_PASSWORD key should go before the FRIGATE_CAMERA_USER key
(UnorderedKey)
[warning] 139-139: [UnorderedKey] The FRIGATE_CAMERA_IP key should go before the FRIGATE_CAMERA_PASSWORD key
(UnorderedKey)
🪛 LanguageTool
docs/PRPs/containers/frigate.md
[grammar] ~17-~17: Use a hyphen to join words.
Context: ...Frigate. The container runs best on bare metal Debian-based systems with low-over...
(QB_NEW_EN_HYPHEN)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/frigate.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
66-66: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
157-157: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: check
🔇 Additional comments (7)
config-example/docker/myhost/.env.supabase (1)
108-108: LGTM!The change to
root@localhostis appropriate for an example configuration file, particularly for local development and testing scenarios.config-example/docker/myhost/.env (3)
13-13: LGTM!The
STORAGE_FRIGATEvariable follows the established pattern for storage paths and is appropriately grouped with related media storage variables.
32-32: LGTM!IP redaction to
xxx.xxx.xxx.xxxis appropriate for an example configuration file and aligns with the PR's objective to mask sensitive information.
136-140: LGTM!The Frigate configuration section follows the established pattern with appropriate placeholder values. The variable ordering (USER, PASSWORD, IP) is semantically logical.
docker/security/frigate/config.yml (2)
16-28: LGTM!The camera configuration correctly uses single-slash RTSP paths and follows best practices by using the sub-stream for detection and main stream for recording to optimize performance.
29-41: LGTM!The detection and recording configuration is well-tuned with appropriate resolution (960x540) and frame rate (5 fps) for efficient detection, and the 7-day retention policy now correctly matches the comment.
docs/PRPs/containers/frigate.md (1)
1-208: Comprehensive and well-structured documentation.The documentation provides thorough coverage of Frigate deployment including:
- Clear installation instructions and examples
- Important security considerations
- Hardware acceleration guidance for multiple platforms
- Optimization recommendations
- Troubleshooting guidance through configuration examples
The minimal configuration example in the documentation (lines 143-155) intentionally differs from the actual
config.ymlin the repository, which is appropriate—the docs provide a getting-started template while the repo contains a working configuration.
a7f9cd1 to
3ce1278
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
scripts/update-example-env.py (1)
53-56: Verify the Ruff linting fix was applied.The past review flagged the unused
valuevariable at line 53 (RUF059). While marked as addressed, the current code still showsvariable, value = line.strip().split('=', 1). Please confirm Ruff passes or apply the fix to usevariable, _ = ....#!/bin/bash # Verify if Ruff linting passes on this file python3 -m ruff check scripts/update-example-env.py 2>/dev/null || echo "Ruff check failed or not available"
🧹 Nitpick comments (1)
docs/PRPs/containers/frigate.md (1)
66-68: Add language specifier to fenced code block.The formula code block is missing a language identifier, which triggers MD040. Consider using
textorplaintextfor non-code content.🔎 Proposed fix
-``` +```text width × height × 1.5 × 20 + 270480 bytes, plus 40MB for logs</details> </blockquote></details> </blockquote></details> <details> <summary>📜 Review details</summary> **Configuration used**: Path: .coderabbit.yaml **Review profile**: CHILL **Plan**: Pro <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between a7f9cd16bed43abaa94bfea2d3f8a0dc81021217 and 3ce1278d5932ea7c291abe0b78929243ba8c34a0. </details> <details> <summary>📒 Files selected for processing (8)</summary> * `config-example/docker/.env` * `config-example/docker/myhost/.env` * `config-example/docker/myhost/.env.supabase` * `config-example/docker/myhost/services.yaml` * `docker/security/frigate.yaml` * `docker/security/frigate/config.yml` * `docs/PRPs/containers/frigate.md` * `scripts/update-example-env.py` </details> <details> <summary>🚧 Files skipped from review as they are similar to previous changes (3)</summary> * config-example/docker/myhost/.env.supabase * docker/security/frigate/config.yml * config-example/docker/myhost/services.yaml </details> <details> <summary>🧰 Additional context used</summary> <details> <summary>📓 Path-based instructions (2)</summary> <details> <summary>**/*.py</summary> **📄 CodeRabbit inference engine (AGENTS.md)** > Python files must pass Ruff linting Files: - `scripts/update-example-env.py` </details> <details> <summary>**/*.{yaml,yml}</summary> **📄 CodeRabbit inference engine (AGENTS.md)** > YAML files must pass YAML linting and validation Files: - `docker/security/frigate.yaml` </details> </details><details> <summary>🧬 Code graph analysis (1)</summary> <details> <summary>docs/PRPs/containers/frigate.md (1)</summary><blockquote> <details> <summary>docs/web/update-docs.py (1)</summary> * `process_docker_directory` (135-194) </details> </blockquote></details> </details><details> <summary>🪛 dotenv-linter (4.0.0)</summary> <details> <summary>config-example/docker/myhost/.env</summary> [warning] 13-13: [UnorderedKey] The STORAGE_FRIGATE key should go before the STORAGE_KIWIX key (UnorderedKey) --- [warning] 137-137: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) --- [warning] 138-138: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) --- [warning] 138-138: [UnorderedKey] The FRIGATE_CAMERA_PASSWORD key should go before the FRIGATE_CAMERA_USER key (UnorderedKey) --- [warning] 139-139: [UnorderedKey] The FRIGATE_CAMERA_IP key should go before the FRIGATE_CAMERA_PASSWORD key (UnorderedKey) </details> </details> <details> <summary>🪛 LanguageTool</summary> <details> <summary>docs/PRPs/containers/frigate.md</summary> [grammar] ~17-~17: Use a hyphen to join words. Context: ...Frigate. The container runs best on bare metal Debian-based systems with low-over... (QB_NEW_EN_HYPHEN) </details> </details> <details> <summary>🪛 markdownlint-cli2 (0.18.1)</summary> <details> <summary>docs/PRPs/containers/frigate.md</summary> 4-4: Bare URL used (MD034, no-bare-urls) --- 5-5: Bare URL used (MD034, no-bare-urls) --- 6-6: Bare URL used (MD034, no-bare-urls) --- 66-66: Fenced code blocks should have a language specified (MD040, fenced-code-language) --- 157-157: Bare URL used (MD034, no-bare-urls) </details> </details> </details> <details> <summary>⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)</summary> * GitHub Check: check </details> <details> <summary>🔇 Additional comments (7)</summary><blockquote> <details> <summary>scripts/update-example-env.py (1)</summary><blockquote> `32-43`: **Well-designed word-boundary matching for IP generalization.** The regex pattern `(?<![a-zA-Z0-9]){key}(?![a-zA-Z0-9])` correctly treats underscores as word boundaries, enabling proper matching of `SERVER_IP`, `LOCAL_NODE_IP`, etc., while avoiding false positives like `IPADDRESS` or `MYIP`. </blockquote></details> <details> <summary>config-example/docker/.env (1)</summary><blockquote> `16-19`: **IP redaction correctly applied.** The placeholder values `xxx.xxx.xxx.xxx` align with the new IP generalization logic in `update-example-env.py`, ensuring no real IPs are committed to the example configuration. </blockquote></details> <details> <summary>docs/PRPs/containers/frigate.md (1)</summary><blockquote> `123-137`: **Good security guidance.** The security considerations section appropriately warns about privileged mode, RTSP password defaults, and the critical importance of not exposing port 5000 externally. This provides valuable operational guidance. </blockquote></details> <details> <summary>config-example/docker/myhost/.env (2)</summary><blockquote> `13-13`: **LGTM - Frigate storage path added.** The new `STORAGE_FRIGATE` variable correctly references the local media storage path and aligns with the volume mapping in `frigate.yaml`. The dotenv-linter ordering warning is a stylistic preference; alphabetical ordering is not functionally required. --- `136-139`: **Frigate configuration section properly added.** The Frigate environment variables align with the service definition in `docker/security/frigate.yaml`. The camera IP is correctly masked with the placeholder value. The quoted values for user/password are appropriate for strings that may contain special characters. </blockquote></details> <details> <summary>docker/security/frigate.yaml (2)</summary><blockquote> `21-47`: **Well-configured Frigate service.** Good security practice: unlike the documentation example, `privileged: true` is not set here. The TODO comments appropriately defer hardware acceleration device mappings for user-specific configuration. The tmpfs cache and shm_size settings align with the documentation recommendations. --- `50-59`: **Appropriate access controls configured.** The Traefik labels correctly route to the authenticated UI port (8971) and apply `localaccess@file` middleware for network restriction. Port 5000 (unauthenticated internal access) is correctly not exposed. </blockquote></details> </blockquote></details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
Summary by CodeRabbit
New Features
Documentation
Chores
✏️ Tip: You can customize this high-level summary in your review settings.