Frigate 0.14 with NGINX Proxy Manager

[MercianWhitey]

I'm trying to access Frigate using port 8971 instead of 5000 via NGINX Proxy manager but get a 502 Bad Gateway error. I can use https://frigate-ip:8971 in a browser which works. Could it be because Frigate has a self-assigned certificate? I thought that NPM would just ignore this, I'm sure it does with other services I access via NPM. I'm simply trying to use frigate.mydomain.com which has worked for a long time using port 5000

[NickM-27]

yes, you need to disable TLS in frigate for this to work

[NickM-27]

well, we can't help you if you don't provide any of this information. this is exactly how I have it setup and working

[mimainka]

Well im using NPM with frigates port 8971 as well.
Settings in NPM:
Details Page
Scheme: http
Forward Port: 8971
Cache Assets, Block Common Exploits, Websockets Support: All enabled

SSL Page
All four enabled.

In Frigates config:

tls:
  enabled: false

Works like a charm for me

id assume your https scheme doesnt work well with NPM.

[MercianWhitey]

I tried setting tls to false again and this time rebooted, it's now working. I'd still like to get this working without disabling tls, I've found some documentation but not had chance to try it yet

[NickM-27]

If npm is providing tls there's no reason to have Frigate provide it, that option is there for users who don't want to use a proxy

[Timgerr321]

Well im using NPM with frigates port 8971 as well. Settings in NPM: Details Page Scheme: http Forward Port: 8971 Cache Assets, Block Common Exploits, Websockets Support: All enabled

SSL Page All four enabled.

In Frigates config:

tls:
  enabled: false

Works like a charm for me

id assume your https scheme doesnt work well with NPM.

Tried exactly this with the same settings but I still get a "connection refused"... If i go tho the Frigate ip on port 8971 I see the "insecure" Frigate ssl certificate. Any suggestions?

[HarryTutt]

Hello
I have a very similar problem
I've had the frigate for just a few months, and I have it installed on an 8gb raspberry pi5, the software is on a 64gb sd and then I added an nvem 1T for recording storage. All very compact in an Argon ONE V3 M.2 box plus a GOOGLE CORAL USB ACCELERATOR and 5 Tapo cameras, 4 wired TC65 and 1 wifi TC70, all at 1080p. I'm very happy. Congratulations on your work.
I'm trying to configure external access with certificates and there's no way. It always gives me the warning that the certificate is insecure. I'm one of those who learns by trial and error. The thing is that on my home network I host a synolgy NAS with external access and configured with the reverse proxy and another raspberry pi4 with the home assistant also with external access and correct certificate without problems. Is it necessary to configure the reverse proxy for external access?
I have set up Synology DNS for the NAS and another Duckdns type for the Home Assistant
I have created another one for Frigate, Duckdns type, and I have opened port 4443 for Frigate. I can access it perfectly, but the annoying message says that the certificate is not secure and I have only managed to read the certificate that Frigate has. I don't know why it doesn't read Duckdns.

Could you shed some light on this for me? Thank you very much for your work.

[HarryTutt]

mqtt:
  host: 192.168.2.90
  port: 1883
  user: '{FRIGATE_MQTT_USER}'
  password: '{FRIGATE_MQTT_PASSWORD}'
tls:
  enabled: true
auth:
  enabled: true
  reset_admin_password: false
  failed_login_rate_limit: 1/second;5/minute;20/hour  
ffmpeg:
  hwaccel_args: preset-rpi-64-h264 #Enable Hardware Acceleration
detectors:
  coral:
    type: edgetpu
    device: usb
record:
  enabled: true
  retain:
    days: 20
    mode: all
  events:
    retain:
      default: 30
      mode: motion
detect:
  enabled: true
snapshots:
  enabled: true
  timestamp: false
  bounding_box: true
  retain:
    default: 30
birdseye:
  enabled: true
  mode: continuous  
  layout:
    scaling_factor: 3.0
objects:
  track:
    - person
    - dog
    - cat
    - car
  filters:
    dog:
      min_score: .5
      threshold: .7
      min_area: 700
      max_area: 25000
    cat:
      min_score: .5
      threshold: .7
      min_area: 700
      max_area: 15000
    person:
      min_score: .5
      threshold: .7
      min_area: 2000
      max_area: 40000
    car:
      min_score: .5
      threshold: .7
      min_area: 6000
      max_area: 150000
go2rtc:
  streams:
    Perimeter1:
      - rtsp://{FRIGATE_GO2RTC_RTSP_USERNAME}:{FRIGATE_GO2RTC_RTSP_PASSWORD}@192.168.2.46:554/cam/stream2
      - ffmpeg:Exterior1#audio-aac
    Perimeter2:
      - rtsp://{FRIGATE_GO2RTC_RTSP_USERNAME}:{FRIGATE_GO2RTC_RTSP_PASSWORD}@192.168.2.47:554/cam/stream2
      - ffmpeg:Exterior2#audio-aac
    Perimeter3:
      - rtsp://{FRIGATE_GO2RTC_RTSP_USERNAME}:{FRIGATE_GO2RTC_RTSP_PASSWORD}@192.168.2.48:554/cam/stream2
      - ffmpeg:Exterior3#audio-aac
    Perimeter4:
      - rtsp://{FRIGATE_GO2RTC_RTSP_USERNAME}:{FRIGATE_GO2RTC_RTSP_PASSWORD}@192.168.2.49:554/cam/stream2
      - ffmpeg:Exterior4#audio-aac
    Salon2:
      - rtsp://{FRIGATE_GO2RTC_RTSP_USERNAME}:{FRIGATE_GO2RTC_RTSP_PASSWORD}@192.168.2.42:554/cam/stream2
      - ffmpeg:Salon2#audio-aac
  webrtc:
    candidates:
      - 192.168.2.80:8555
      - stun:8555
cameras:
  Perimeter1: #Name for your comment
    ffmpeg:
      output_args:
        record: preset-record-generic-audio-aac
      inputs:
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.46/stream1
          roles:
            - detect
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.46/stream1
          roles:
            - record
    motion:
      threshold: 30
      contour_area: 10
      improve_contrast: 'true'
      mask: 0,0.043,0.321,0.044,0.323,0,0,0
    zones:
      Zona0:
        coordinates: 0.471,0.155,0.404,0.149,0.383,0.119,0.358,0.103,0.196,1,0.533,0.996
        loitering_time: 0
        objects: person
        inertia: 1
      Zona1:
        coordinates: 
          0.244,0.723,0.195,1,0,1,0,0.738,0.18,0.307,0.224,0.193,0.211,0.152,0.188,0.117,0.175,0.091,0.201,0.078,0.217,0.047,0.266,0.042,0.282,0.057,0.358,0.076,0.356,0.105,0.335,0.225
        loitering_time: 0
        objects: person
        inertia: 3
    objects:
      filters:
        car:
          mask: 0,1,1,1,1,0,0,0
    review:
      alerts:
        required_zones: Zona0
      detections:
        required_zones: Zona1
  Perimeter2: #Name for your comment
    ffmpeg:
      output_args:
        record: preset-record-generic-audio-aac
      inputs:
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.47/stream1
          roles:
            - detect
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.47/stream1
          roles:
            - record
    motion:
      threshold: 30
      contour_area: 10
      improve_contrast: 'true'
      mask: 0,0.04,0.321,0.039,0.322,0,0,0
    zones:
      Zona0:
        coordinates: 0.392,1,0.806,1,0.563,0.171,0.455,0.187
        loitering_time: 0
        objects: person
        inertia: 1
      Zona1:
        coordinates: 
          0.808,1,1,1,1,0.724,0.919,0.588,0.85,0.497,0.794,0.423,0.654,0.246,0.599,0.196,0.564,0.171,0.643,0.436
        loitering_time: 0
        objects: person
        inertia: 3
    objects:
      filters:
        car:
          mask: 0,1,1,1,1,0,0,0
    review:
      alerts:
        required_zones: Zona0
      detections:
        required_zones: Zona1
  Perimeter3: #Name for your comment
    ffmpeg:
      output_args:
        record: preset-record-generic-audio-aac
      inputs:
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.48/stream1
          roles:
            - detect
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.48/stream1
          roles:
            - record
    objects:
      filters:
        car:
          mask: 1,1,0,1,0,0,1,0
    motion:
      threshold: 30
      contour_area: 10
      improve_contrast: 'true'
      mask: 0,0.043,0.319,0.044,0.321,0,0,0
    zones:
      Zona0:
        coordinates: 
          0.198,0.165,0.299,0.33,0.307,0.406,0.358,0.711,0.34,1,0.916,1,0.751,0.592,0.594,0.265,0.596,0.135,0.343,0.158,0.34,0.101,0.251,0.121,0.25,0.152
        loitering_time: 0
        objects: person
        inertia: 1
      Zona1:
        coordinates: 
          0.337,1,0.354,0.711,0.303,0.404,0.295,0.335,0.197,0.167,0.25,0.148,0.248,0.114,0.344,0.097,0.347,0.148,0.499,0.133,0.501,0,0.005,0.003,-0.001,0.126,0.027,0.154,0.039,0.181,0.034,0.246,0.002,0.358,0,1
        loitering_time: 0
        objects: person
        inertia: 3
      Zona2:
        coordinates: 
          0.595,0.257,0.598,0.158,0.705,0.256,0.703,0.312,0.836,0.464,0.825,0.539,0.988,0.771,0.98,0.811,1,0.85,1,1,0.918,1,0.748,0.576
        loitering_time: 0
        objects:
          - cat
          - dog
          - person
        inertia: 3
    review:
      alerts:
        required_zones: Zona0
      detections:
        required_zones: Zona1
  Perimeter4: #Name for your comment
    ffmpeg:
      output_args:
        record: preset-record-generic-audio-aac
      inputs:
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.49/stream1
          roles:
            - detect
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.49/stream1
          roles:
            - record
    motion:
      threshold: 30
      contour_area: 10
      improve_contrast: 'true'
      mask: 0.322,0.045,0.322,0,0,0,0,0.047
    zones:
      Zona0:
        coordinates: 
          0,0.487,0,0,0.238,0,0.517,0.275,0.585,0.336,0.784,0.538,0.653,1,0.546,0.874,0.456,0.953,0.335,0.761,0.149,0.446,0.026,0.56
        loitering_time: 0
        objects: person
        inertia: 1
      Zona1:
        coordinates: 0,0.493,0,1,0.652,1,0.543,0.877,0.457,0.961,0.147,0.447,0.027,0.559
        loitering_time: 0
        objects: person
      Zona2:
        coordinates: 0.786,0.536,0.841,0.283,0.609,0.131,0.607,0.097,0.42,0,0.237,0
        loitering_time: 0
        objects:
          - person
          - cat
        inertia: 3
    review:
      alerts:
        required_zones: Zona0
      detections:
        required_zones:
          - Zona1
          - Zona2
  Salon2: #Name for your comment
    ffmpeg:
      output_args:
        record: preset-record-generic-audio-aac
      inputs:
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.42/stream1
          roles:
            - detect
        - path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@192.168.2.42/stream1
          roles:
            - record
    onvif:
      host: 192.168.2.42
      port: 2020
      user: '{FRIGATE_RTSP_USER}'
      password: '{FRIGATE_RTSP_PASSWORD}'
    detect:
      enabled: true
    motion:
      mask:
        - 0,0.046,0.318,0.046,0.319,0,0,0
        - 0.376,0.373,0.566,0.284,0.566,0,0.358,0
        - 0.084,0.545,0.166,0.496,0.124,0.122,0.037,0.173
        - 0.786,0.179,0.786,0,0.667,0,0.664,0.233
        - 0.833,0,0.903,0,0.897,0.129,0.829,0.158
      threshold: 30
      contour_area: 10
      improve_contrast: 'true'
    zones:
      Zona3:
        coordinates: 0.149,1,0.061,0.566,0.281,0.435,0.297,0.45,0.352,0.413,0.351,0.39,1,0.079,1,1
        loitering_time: 0
        objects:
          - cat
          - dog
          - person
        inertia: 3
    review:
      alerts:
        required_zones: Zona3
    objects:
      filters:
        car:
          mask: 0,1,1,1,1,0,0,0
camera_groups:
  Perimetro:
    order: 1
    icon: LuExpand
    cameras:
      - Perimeter1
      - Perimeter2
      - Perimeter3
      - Perimeter4
  Interior:
    order: 2
    icon: LuView
    cameras: Salon2
version: 0.14

[HarryTutt]

[HarryTutt]

[HarryTutt]

Just as I was leaving, I accidentally managed to get it to recognize the certificate I had created and the page now shows me a secure connection 😉

First, locate the folder where the certificate was stored (/data/compose/25/letsencrypt/live/npm-3/) and copy the 4 files (privkey1.pem; fullchain1.pem; chain1.pem; cert1.pem) to the folder that indicates the frigate documents, creating the corresponding folders “/etc/letsencrypt/live/frigate” and also create the folders for the file, all manually from the console with the following command “cp /data/compose/25/letsencrypt/live/npm-3/. /etc/letsencrypt/live/frigate” and the corresponding one for the file, all this with sudo su permissions
Modify the stack of the frigate so that it looks like this

• /etc/letsencrypt/live/frigate:/etc/letsencrypt/live/frigate:ro

  disabled the NPM and stopped the Stack in the portainer and it turns out that now if I get the certificate tomorrow I will look at it more calmly in my country it is 01:00 am and tomorrow it's reveille at 6:00 am thank you very much for the help a hug to all

[vuurvoske]

@HarryTutt i came across this post when fixing this in my k3s. but would you mind post your config indented properly? I'm really inspired by how you setup your config.

[NickM-27]

I fixed the formatting

[HarryTutt]

version: "3.9"
services:
frigate:
container_name: frigate
privileged: true # this may not be necessary for all setups
restart: unless-stopped
image: ghcr.io/blakeblackshear/frigate:stable
shm_size: "2048mb"
devices:
- /dev/bus/usb:/dev/bus/usb #Used for Coral if Available
- /dev/dri/renderD128:/dev/dri/renderD128 # For intel hwaccel, needs to be updated for your hardware
volumes:
- /data/compose/25/letsencrypt/live/npm-3:/data/compose/25/letsencrypt/live/npm-3:ro
- /data/compose/25/letsencrypt/archive/npm-3:/data/compose/25/letsencrypt/archive/npm-3:ro
- /etc/localtime:/etc/localtime:ro
- /home/frigate/frigate-nvr/config.yml:/config/config.yml
- /mnt/mydisk/frigate-nvr/storage:/media/frigate
- type: tmpfs #Remove this if using a Pi with 2GB or Less RAM
target: /tmp/cache
tmpfs:
size: 1000000000
ports:
- "192.168.2.80:4443:8971"
- "192.168.2.80:7000:5000"
- "192.168.2.80:1984:1984"
- "192.168.2.80:8554:8554" # RTSP feeds
- "192.168.2.80:8555:8555/tcp" # WebRTC over tcp
- "192.168.2.80:8555:8555/udp" # WebRTC over udp
environment:
- FRIGATE_JWT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
- PLUS_API_KEY=xxxxxxxxxxxxx
- FRIGATE_RTSP_USER=xxxxxxxxxxxxx
- FRIGATE_RTSP_PASSWORD=xxxxxxxxxxxxx
- FRIGATE_MQTT_USER=xxxxxxxxxxxxx
- FRIGATE_MQTT_PASSWORD=xxxxxxxxxxxxx
- FRIGATE_GO2RTC_RTSP_USERNAME=xxxxxxxxxxxxx
- FRIGATE_GO2RTC_RTSP_PASSWORD=xxxxxxxxxxxxx
#network_mode: host