Configure Frigate, Traefik, backup, agent guidelines

[bubacoder]

Summary by CodeRabbit

• Documentation

  • Added explicit Git contribution guidelines and expanded deployment/operational notes.

• Configuration

  • Security camera: enabled snapshots, extended motion retention to 14 days, and optimized stream handling.
  • Backups: exclude version-control data and remove older backups automatically.
  • Service routing and service metadata updated.
  • Build/service listing output path adjusted.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Adds a Git guideline to AGENTS.md, updates backup Taskfile to exclude .git and prune old backups, tweaks Frigate camera input ordering and motion retention, changes Traefik qbittorrent middleware, adjusts Taskfile.web output path, and updates qbittorrent homepage description.

Changes

Cohort / File(s)	Summary
Agent documentation AGENTS.md	Added a Git Guidelines section forbidding creating branches or committing changes unless explicitly requested; guidance duplicated/expanded later in the file with added emphasis.
Backup & task configs Taskfile.yaml, docs/web/Taskfile.web.yaml	Taskfile.yaml: exclude .git from backup tar and add step to remove old backups (`tail -n +31
Security — Frigate config docker/security/frigate/config.yml	Reordered FFmpeg inputs to list high-res h265Preview_01_main first (record role), added low-res h264Preview_01_sub with detect role, enabled camera snapshots, and increased motion retention from 7 to 14 days.
Traefik & qbittorrent docker/security/traefik/dynamic/external-services.yml, docker/fileshare/qbittorrent.yaml	Switched qbittorrent router middleware label from localaccess-sso@file to localaccess@file; updated qbittorrent homepage.description from "[SSO] BitTorrent client" to "BitTorrent client".

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Refine task descriptions #163: Overlaps Taskfile.yaml backup-config changes (archive/exclusion and cleanup steps).
• Update documentation #167: Touches docs/web/Taskfile.web.yaml and related documentation generation tasks.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title covers multiple distinct changes across different systems (Frigate, Traefik, backup, agent guidelines) but accurately reflects the main configuration updates in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feature/config

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docker/security/traefik/dynamic/external-services.yml (1)

19-23: Resolve qbittorrent middleware inconsistency: two conflicting configurations.

Qbittorrent is configured with different middlewares in two places:

• docker/fileshare/qbittorrent.yaml (line 38): localaccess-sso@file (IP allowlist + Authelia SSO)
• docker/security/traefik/dynamic/external-services.yml (line 23): localaccess@file (IP allowlist only)

The dynamic config route uses localaccess@file which removes SSO authentication, creating a security regression. Choose one authoritative configuration:

• If SSO should remain enforced: remove qbittorrent from external-services.yml
• If IP-only access is intentional: update qbittorrent.yaml to match

🔒 Suggested fix to restore SSO protection

-        - localaccess@file
+        - localaccess-sso@file

🤖 Fix all issues with AI agents

In `@docker/security/frigate/config.yml`:
- Around line 21-42: The config uses an unsupported stream role "rtmp" on the
camera stream entry; remove the "rtmp" role from the roles list (leave only
detect/record/audio as appropriate) and, if you need live/restreaming, wire the
source into go2rtc and map it via cameras.<name>.live.streams instead of adding
rtmp here; also verify that the substream name h264Preview_01_sub actually
outputs 960x540 (or adjust detect.width/detect.height to match the substream) so
Frigate's detect settings aren't causing scaling or ignored frames.