update labels/faq (#23759 )

2026-09-09 20:19:47 -04:00 · 2026-07-18 11:19:12 -06:00
2173 changed files with 29187 additions and 267045 deletions
@@ -8,7 +8,6 @@ amdgpu
 analyzeduration
 Annke
 apexcharts
-Aqara
 arange
 argmax
 argmin
@@ -65,7 +64,6 @@ dsize
 dtype
 ECONNRESET
 edgetpu
-Eufy
 facenet
 fastapi
 faststart
@@ -84,7 +82,6 @@ frontdoor
 fstype
 fullchain
 fullscreen
-gatekeep
 genai
 generativeai
 genpts
@@ -165,7 +162,6 @@ mpegts
 mqtt
 mse
 msenc
-muxing
 namedtuples
 nbytes
 nchw
@@ -201,8 +197,6 @@ OWASP
 paddleocr
 paho
 passwordless
-PCMA
-PCMU
 popleft
 posthog
 postprocess
@@ -228,16 +222,13 @@ radeontop
 rawvideo
 rcond
 RDONLY
-realmonitor
 rebranded
-recvonly
 referer
 reindex
 Reolink
 restream
 restreamed
 restreaming
-RJSF
 rkmpp
 rknn
 rkrga
@@ -247,11 +238,8 @@ rocminfo
 rootfs
 rtmp
 RTSP
-rtsps
-rtspx
 ruamel
 scroller
-sendonly
 setproctitle
 setpts
 shms
@@ -262,7 +250,6 @@ SNDMORE
 socs
 sqliteq
 sqlitevecq
-Srtp
 ssdlite
 statm
 stimeout
@@ -10,11 +10,7 @@ body:

        Before submitting, read the [beta documentation][docs].

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
-        [docs]: https://docs-dev.frigate.video/
-        [discussions]: https://github.com/blakeblackshear/frigate/discussions
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
+        [docs]: https://deploy-preview-19787--frigate-docs.netlify.app/
  - type: textarea
    id: description
    attributes:
@@ -26,8 +22,8 @@ body:
    id: version
    attributes:
      label: Beta Version
-      description: Visible on the System Metrics page in the Web UI. Please include the full version including the build identifier (eg. 0.18.0-beta1, 0.18.0-8b72c7a, etc.)
-      placeholder: "0.18.0-beta1"
+      description: Visible on the System page in the Web UI. Please include the full version including the build identifier (eg. 0.17.0-beta1)
+      placeholder: "0.17.0-beta1"
    validations:
      required: true
  - type: dropdown
@@ -75,12 +71,11 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
+        - Proxmox via TTeck Script
        - Windows WSL2
    validations:
      required: true
@@ -8,12 +8,9 @@ body:

        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: textarea
    id: description
    attributes:
@@ -90,12 +87,11 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
+        - Proxmox via TTeck Script
        - Windows WSL2
    validations:
      required: true
@@ -8,12 +8,9 @@ body:

        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: textarea
    id: description
    attributes:
@@ -76,12 +73,11 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
+        - Proxmox via TTeck Script
        - Windows WSL2
    validations:
      required: true
@@ -8,12 +8,9 @@ body:

        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: textarea
    id: description
    attributes:
@@ -56,12 +53,11 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
+        - Proxmox via TTeck Script
        - Windows WSL2
    validations:
      required: true
@@ -8,12 +8,9 @@ body:

        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: textarea
    id: description
    attributes:
@@ -76,12 +73,11 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxmox via VM
+        - Proxmox via TTeck Script
        - Windows WSL2
    validations:
      required: true
@@ -8,12 +8,9 @@ body:

        Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: textarea
    id: description
    attributes:
@@ -72,12 +69,11 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
+        - Proxmox via TTeck Script
        - Windows WSL2
    validations:
      required: true
@@ -10,12 +10,9 @@ body:

        **If you are looking for support, start a new discussion and use a support category.**

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: textarea
    id: description
    attributes:
@@ -6,20 +6,17 @@ body:
      value: |
        Use this form to submit a reproducible bug in Frigate or Frigate's UI.

-        **⚠️ If you are running a beta version (0.18.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.**
+        **⚠️ If you are running a beta version (0.17.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.**

        Before submitting your bug report, please ask the AI with the "Ask AI" button on the [official documentation site][ai] about your issue, [search the discussions][discussions], look at recent open and closed [pull requests][prs], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your bug has already been fixed by the developers or reported by the community.

        **If you are unsure if your issue is actually a bug or not, please submit a support request first.**

-        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
-
        [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
        [prs]: https://www.github.com/blakeblackshear/frigate/pulls
        [docs]: https://docs.frigate.video
        [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
        [ai]: https://docs.frigate.video
-        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
  - type: checkboxes
    attributes:
      label: Checklist
@@ -119,13 +116,9 @@ body:
    attributes:
      label: Install method
      options:
-        - Home Assistant App
+        - Home Assistant Add-on
        - Docker Compose
        - Docker CLI
-        - Proxmox via Docker
-        - Proxmox via installation script
-        - Proxomox via VM
-        - Windows WSL2
    validations:
      required: true
  - type: dropdown
@@ -7,13 +7,6 @@ assignees: ''

 ---

-<!--
-  By posting here you agree to follow our AI policy:
-  https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
-
-  Requests that appear to be written by an AI on your behalf may be closed without a response.
-->
-
 **Describe what you are trying to accomplish and why in non technical terms**
 I want to be able to ... so that I can ... 

@@ -1 +0,0 @@
-AGENTS.md
@@ -0,0 +1,385 @@
+# GitHub Copilot Instructions for Frigate NVR
+
+This document provides coding guidelines and best practices for contributing to Frigate NVR, a complete and local NVR designed for Home Assistant with AI object detection.
+
+## Project Overview
+
+Frigate NVR is a realtime object detection system for IP cameras that uses:
+
+- **Backend**: Python 3.13+ with FastAPI, OpenCV, TensorFlow/ONNX
+- **Frontend**: React with TypeScript, Vite, TailwindCSS
+- **Architecture**: Multiprocessing design with ZMQ and MQTT communication
+- **Focus**: Minimal resource usage with maximum performance
+
+## Code Review Guidelines
+
+When reviewing code, do NOT comment on:
+
+- Missing imports - Static analysis tooling catches these
+- Code formatting - Ruff (Python) and Prettier (TypeScript/React) handle formatting
+- Minor style inconsistencies already enforced by linters
+
+## Python Backend Standards
+
+### Python Requirements
+
+- **Compatibility**: Python 3.13+
+- **Language Features**: Use modern Python features:
+  - Pattern matching
+  - Type hints (comprehensive typing preferred)
+  - f-strings (preferred over `%` or `.format()`)
+  - Dataclasses
+  - Async/await patterns
+
+### Code Quality Standards
+
+- **Formatting**: Ruff (configured in `pyproject.toml`)
+- **Linting**: Ruff with rules defined in project config
+- **Type Checking**: Use type hints consistently
+- **Testing**: unittest framework - use `python3 -u -m unittest` to run tests
+- **Language**: American English for all code, comments, and documentation
+
+### Logging Standards
+
+- **Logger Pattern**: Use module-level logger
+
+  ```python
+  import logging
+
+  logger = logging.getLogger(__name__)
+  ```
+
+- **Format Guidelines**:
+  - No periods at end of log messages
+  - No sensitive data (keys, tokens, passwords)
+  - Use lazy logging: `logger.debug("Message with %s", variable)`
+- **Log Levels**:
+  - `debug`: Development and troubleshooting information
+  - `info`: Important runtime events (startup, shutdown, state changes)
+  - `warning`: Recoverable issues that should be addressed
+  - `error`: Errors that affect functionality but don't crash the app
+  - `exception`: Use in except blocks to include traceback
+
+### Error Handling
+
+- **Exception Types**: Choose most specific exception available
+- **Try/Catch Best Practices**:
+  - Only wrap code that can throw exceptions
+  - Keep try blocks minimal - process data after the try/except
+  - Avoid bare exceptions except in background tasks
+
+  Bad pattern:
+
+  ```python
+  try:
+      data = await device.get_data()  # Can throw
+      # ❌ Don't process data inside try block
+      processed = data.get("value", 0) * 100
+      result = processed
+  except DeviceError:
+      logger.error("Failed to get data")
+  ```
+
+  Good pattern:
+
+  ```python
+  try:
+      data = await device.get_data()  # Can throw
+  except DeviceError:
+      logger.error("Failed to get data")
+      return
+
+  # ✅ Process data outside try block
+  processed = data.get("value", 0) * 100
+  result = processed
+  ```
+
+### Async Programming
+
+- **External I/O**: All external I/O operations must be async
+- **Best Practices**:
+  - Avoid sleeping in loops - use `asyncio.sleep()` not `time.sleep()`
+  - Avoid awaiting in loops - use `asyncio.gather()` instead
+  - No blocking calls in async functions
+  - Use `asyncio.create_task()` for background operations
+- **Thread Safety**: Use proper synchronization for shared state
+
+### Documentation Standards
+
+- **Module Docstrings**: Concise descriptions at top of files
+  ```python
+  """Utilities for motion detection and analysis."""
+  ```
+- **Function Docstrings**: Required for public functions and methods
+
+  ```python
+  async def process_frame(frame: ndarray, config: Config) -> Detection:
+      """Process a video frame for object detection.
+
+      Args:
+          frame: The video frame as numpy array
+          config: Detection configuration
+
+      Returns:
+          Detection results with bounding boxes
+      """
+  ```
+
+- **Comment Style**:
+  - Explain the "why" not just the "what"
+  - Keep lines under 88 characters when possible
+  - Use clear, descriptive comments
+
+### File Organization
+
+- **API Endpoints**: `frigate/api/` - FastAPI route handlers
+- **Configuration**: `frigate/config/` - Configuration parsing and validation
+- **Detectors**: `frigate/detectors/` - Object detection backends
+- **Events**: `frigate/events/` - Event management and storage
+- **Utilities**: `frigate/util/` - Shared utility functions
+
+## Frontend (React/TypeScript) Standards
+
+### Internationalization (i18n)
+
+- **CRITICAL**: Never write user-facing strings directly in components
+- **Always use react-i18next**: Import and use the `t()` function
+
+  ```tsx
+  import { useTranslation } from "react-i18next";
+
+  function MyComponent() {
+    const { t } = useTranslation(["views/live"]);
+    return <div>{t("camera_not_found")}</div>;
+  }
+  ```
+
+- **Translation Files**: Add English strings to the appropriate json files in `web/public/locales/en`
+- **Namespaces**: Organize translations by feature/view (e.g., `views/live`, `common`, `views/system`)
+
+### Code Quality
+
+- **Linting**: ESLint (see `web/.eslintrc.cjs`)
+- **Formatting**: Prettier with Tailwind CSS plugin
+- **Type Safety**: TypeScript strict mode enabled
+- **Testing**: Vitest for unit tests
+
+### Component Patterns
+
+- **UI Components**: Use Radix UI primitives (in `web/src/components/ui/`)
+- **Styling**: TailwindCSS with `cn()` utility for class merging
+- **State Management**: React hooks (useState, useEffect, useCallback, useMemo)
+- **Data Fetching**: Custom hooks with proper loading and error states
+
+### ESLint Rules
+
+Key rules enforced:
+
+- `react-hooks/rules-of-hooks`: error
+- `react-hooks/exhaustive-deps`: error
+- `no-console`: error (use proper logging or remove)
+- `@typescript-eslint/no-explicit-any`: warn (always use proper types instead of `any`)
+- Unused variables must be prefixed with `_`
+- Comma dangles required for multiline objects/arrays
+
+### File Organization
+
+- **Pages**: `web/src/pages/` - Route components
+- **Views**: `web/src/views/` - Complex view components
+- **Components**: `web/src/components/` - Reusable components
+- **Hooks**: `web/src/hooks/` - Custom React hooks
+- **API**: `web/src/api/` - API client functions
+- **Types**: `web/src/types/` - TypeScript type definitions
+
+## Testing Requirements
+
+### Backend Testing
+
+- **Framework**: Python unittest
+- **Run Command**: `python3 -u -m unittest`
+- **Location**: `frigate/test/`
+- **Coverage**: Aim for comprehensive test coverage of core functionality
+- **Pattern**: Use `TestCase` classes with descriptive test method names
+  ```python
+  class TestMotionDetection(unittest.TestCase):
+      def test_detects_motion_above_threshold(self):
+          # Test implementation
+  ```
+
+### Test Best Practices
+
+- Always have a way to test your work and confirm your changes
+- Write tests for bug fixes to prevent regressions
+- Test edge cases and error conditions
+- Mock external dependencies (cameras, APIs, hardware)
+- Use fixtures for test data
+
+## Development Commands
+
+### Python Backend
+
+```bash
+# Run all tests
+python3 -u -m unittest
+
+# Run specific test file
+python3 -u -m unittest frigate.test.test_ffmpeg_presets
+
+# Check formatting (Ruff)
+ruff format --check frigate/
+
+# Apply formatting
+ruff format frigate/
+
+# Run linter
+ruff check frigate/
+```
+
+### Frontend (from web/ directory)
+
+```bash
+# Start dev server (AI agents should never run this directly unless asked)
+npm run dev
+
+# Build for production
+npm run build
+
+# Run linter
+npm run lint
+
+# Fix linting issues
+npm run lint:fix
+
+# Format code
+npm run prettier:write
+```
+
+### Docker Development
+
+AI agents should never run these commands directly unless instructed.
+
+```bash
+# Build local image
+make local
+
+# Build debug image
+make debug
+```
+
+## Common Patterns
+
+### API Endpoint Pattern
+
+```python
+from fastapi import APIRouter, Request
+from frigate.api.defs.tags import Tags
+
+router = APIRouter(tags=[Tags.Events])
+
+@router.get("/events")
+async def get_events(request: Request, limit: int = 100):
+    """Retrieve events from the database."""
+    # Implementation
+```
+
+### Configuration Access
+
+```python
+# Access Frigate configuration
+config: FrigateConfig = request.app.frigate_config
+camera_config = config.cameras["front_door"]
+```
+
+### Database Queries
+
+```python
+from frigate.models import Event
+
+# Use Peewee ORM for database access
+events = (
+    Event.select()
+    .where(Event.camera == camera_name)
+    .order_by(Event.start_time.desc())
+    .limit(limit)
+)
+```
+
+## Common Anti-Patterns to Avoid
+
+### ❌ Avoid These
+
+```python
+# Blocking operations in async functions
+data = requests.get(url)  # ❌ Use async HTTP client
+time.sleep(5)  # ❌ Use asyncio.sleep()
+
+# Hardcoded strings in React components
+<div>Camera not found</div>  # ❌ Use t("camera_not_found")
+
+# Missing error handling
+data = await api.get_data()  # ❌ No exception handling
+
+# Bare exceptions in regular code
+try:
+    value = await sensor.read()
+except Exception:  # ❌ Too broad
+    logger.error("Failed")
+```
+
+### ✅ Use These Instead
+
+```python
+# Async operations
+import aiohttp
+async with aiohttp.ClientSession() as session:
+    async with session.get(url) as response:
+        data = await response.json()
+
+await asyncio.sleep(5)  # ✅ Non-blocking
+
+# Translatable strings in React
+const { t } = useTranslation();
+<div>{t("camera_not_found")}</div>  # ✅ Translatable
+
+# Proper error handling
+try:
+    data = await api.get_data()
+except ApiException as err:
+    logger.error("API error: %s", err)
+    raise
+
+# Specific exceptions
+try:
+    value = await sensor.read()
+except SensorException as err:  # ✅ Specific
+    logger.exception("Failed to read sensor")
+```
+
+## Project-Specific Conventions
+
+### Configuration Files
+
+- Main config: `config/config.yml`
+
+### Directory Structure
+
+- Backend code: `frigate/`
+- Frontend code: `web/`
+- Docker files: `docker/`
+- Documentation: `docs/`
+- Database migrations: `migrations/`
+
+### Code Style Conformance
+
+Always conform new and refactored code to the existing coding style in the project:
+
+- Follow established patterns in similar files
+- Match indentation and formatting of surrounding code
+- Use consistent naming conventions (snake_case for Python, camelCase for TypeScript)
+- Maintain the same level of verbosity in comments and docstrings
+
+## Additional Resources
+
+- Documentation: https://docs.frigate.video
+- Main Repository: https://github.com/blakeblackshear/frigate
+- Home Assistant Integration: https://github.com/blakeblackshear/frigate-hass-integration
@@ -1,18 +1,17 @@
-_Please read the [contributing guidelines](https://github.com/blakeblackshear/frigate/blob/dev/CONTRIBUTING.md) and the [AI policy](https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md) before submitting a PR. Every PR must be read and submitted by a person, and PRs that appear to be unreviewed AI output will be closed without review._
-
 ## Proposed change
-
 <!--
  Thank you!

-  Describe what this pull request does and how it will benefit users of Frigate.
-  Please describe in detail any considerations, breaking changes, etc.
-
  If you're introducing a new feature or significantly refactoring existing functionality,
  we encourage you to start a discussion first. This helps ensure your idea aligns with
  Frigate's development goals.
+
+  Describe what this pull request does and how it will benefit users of Frigate.
+  Please describe in detail any considerations, breaking changes, etc. that are
+  made in this pull request.
 -->

+
 ## Type of change

 - [ ] Dependency upgrade
@@ -26,45 +25,6 @@ _Please read the [contributing guidelines](https://github.com/blakeblackshear/fr

 - This PR fixes or closes issue: fixes #
 - This PR is related to issue:
- Link to discussion with maintainers (**required** for any large or "planned" features):
-
-## For new features
-
-<!--
-  Every new feature adds scope that maintainers must test, maintain, and support long-term.
-  We try to be thoughtful about what we take on, and sometimes that means saying no to
-  good code if the feature isn't the right fit — or saying yes to something we weren't sure
-  about. These calls are sometimes subjective, and we won't always get them right. We're
-  happy to discuss and reconsider.
-
-  Linking to an existing feature request or discussion with community interest helps us
-  understand demand, but a great idea is a great idea even without a crowd behind it.
-
-  You can delete this section for bugfixes and non-feature changes.
-->
-
- [ ] There is an existing feature request or discussion with community interest for this change.
-  - Link:
-
-## AI disclosure
-
-<!--
-  We welcome contributions that use AI tools, but we need to understand your relationship
-  with the code you're submitting. See our AI usage policy in CONTRIBUTING.md for details.
-
-  Be honest — this won't disqualify your PR. Trust matters more than method.
-->
-
- [ ] No AI tools were used in this PR.
- [ ] AI tools were used in this PR. Details below:
-
-**AI tool(s) used** (e.g., Claude, Copilot, ChatGPT, Cursor):
-
-**How AI was used** (e.g., code generation, code review, debugging, documentation):
-
-**Extent of AI involvement** (e.g., generated entire implementation, assisted with specific functions, suggested fixes):
-
-**Human oversight**: Describe what manual review, testing, and validation you performed on the AI-generated portions.

 ## Checklist

@@ -75,6 +35,5 @@ _Please read the [contributing guidelines](https://github.com/blakeblackshear/fr
 - [ ] The code change is tested and works locally.
 - [ ] Local tests pass. **Your PR cannot be merged unless tests pass**
 - [ ] There is no commented out code in this PR.
- [ ] I can explain every line of code in this PR if asked.
 - [ ] UI changes including text have used i18n keys and have been added to the `en` locale.
 - [ ] The code has been formatted using Ruff (`ruff format frigate`)
@@ -32,7 +32,7 @@ jobs:
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push amd64 standard build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/main/Dockerfile
@@ -42,383 +42,6 @@ jobs:
          tags: ${{ steps.setup.outputs.image-name }}-amd64
          cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64
          cache-to: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64,mode=max
-  smoke_test:
-    runs-on: ubuntu-22.04
-    name: AMD64 Smoke Test
-    needs:
-      - amd64_build
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - name: Set up QEMU and Buildx
-        id: setup
-        uses: ./.github/actions/setup
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Start container
-        run: |
-          mkdir -p /tmp/frigate-config /tmp/frigate-media
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config/config.yml
-          # simulate a root-era install: root-owned 0600 jwt secret pre-exists
-          docker run --rm -v /tmp/frigate-config:/config --entrypoint bash \
-            ${{ steps.setup.outputs.image-name }}-amd64 \
-            -c "python3 -c 'import secrets; open(\"/config/.jwt_secret\",\"w\").write(secrets.token_hex(64))' && chmod 600 /config/.jwt_secret && chown 0:0 /config/.jwt_secret"
-          docker run -d --name frigate --shm-size 256m \
-            -v /tmp/frigate-config:/config \
-            -v /tmp/frigate-media:/media/frigate \
-            --mount type=tmpfs,target=/tmp/cache,tmpfs-size=100000000 \
-            -p 5000:5000 -p 8971:8971 \
-            ${{ steps.setup.outputs.image-name }}-amd64
-      - name: Wait for API
-        run: |
-          for i in $(seq 1 60); do
-            curl -fs http://127.0.0.1:5000/api/version && exit 0
-            sleep 5
-          done
-          echo "API never came up"; docker logs frigate; exit 1
-      - name: Assert security headers and permissions
-        run: |
-          headers=$(curl -ksI https://127.0.0.1:8971/)
-          echo "$headers"
-          echo "$headers" | grep -qi "x-content-type-options: nosniff"
-          echo "$headers" | grep -qi "referrer-policy: strict-origin-when-cross-origin"
-          # server_tokens off: Server header must not include a version.
-          # written as an if rather than "! grep", because bash exempts a
-          # negated command from set -e and the assertion would never fail
-          if echo "$headers" | grep -qiE "^server: nginx/[0-9]"; then
-            echo "Server header leaks the nginx version; server_tokens is not off"
-            exit 1
-          fi
-          # Frigate never ships frame-ancestors: HA's Webpage card and iframe
-          # panels frame it cross-origin and it would break them silently
-          if echo "$headers" | grep -qi "frame-ancestors"; then
-            echo "response carries frame-ancestors, which breaks cross-origin iframe embedding"
-            exit 1
-          fi
-          # -t as root would chown the live cache and temp dirs to the `user`
-          # directive user; stdout discarded because -t reopens the config's
-          # /dev/stdout logs and the docker exec pipe is root-owned
-          docker exec frigate /command/s6-setuidgid frigate bash -c '/usr/local/nginx/sbin/nginx -e stderr -t -c /tmp/nginx/conf/nginx.conf >/dev/null'
-          docker exec frigate stat -c %a /config/tls/privkey.pem | grep -qx 600
-          docker exec frigate stat -c %a /dev/shm/go2rtc.yaml | grep -qx 640
-      - name: Assert services run as non-root
-        run: |
-          ps_out=$(docker exec frigate ps -eo user=,comm=)
-          echo "$ps_out"
-          assert_nonroot() {
-            # the process must exist AND no instance of it may run as root
-            echo "$ps_out" | grep -qw "$1" || { echo "$1 is not running"; exit 1; }
-            if echo "$ps_out" | grep -w "$1" | grep -q '^root'; then
-              echo "$1 is running as root"; exit 1
-            fi
-          }
-          assert_nonroot python3
-          assert_nonroot go2rtc
-          assert_nonroot nginx
-          # root-era jwt secret must have been captured by the sweep and the
-          # auth stack must be functional: wrong creds => clean 401, not 500
-          docker exec frigate stat -c %u /config/.jwt_secret | grep -qx "$(docker exec frigate id -u frigate)"
-          code=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:5000/api/login \
-            -H 'content-type: application/json' -d '{"user":"admin","password":"definitely-wrong"}')
-          [ "$code" = "401" ] || { echo "login endpoint returned $code"; exit 1; }
-          # a root nginx -t above would have chowned the runtime dirs to root
-          owners=$(docker exec frigate stat -c %U /tmp/nginx /dev/shm/nginx_cache)
-          echo "$owners"
-          if echo "$owners" | grep -qvx frigate; then
-            echo "nginx runtime dirs are not owned by frigate"; exit 1
-          fi
-          # runtime user can write recordings storage
-          docker exec frigate /command/s6-setuidgid frigate touch /media/frigate/.write-probe
-          docker exec frigate rm /media/frigate/.write-probe
-          # tmpfs mount per the docs: arrives root-owned, holds the ZMQ IPC sockets
-          docker exec frigate /command/s6-setuidgid frigate touch /tmp/cache/.write-probe
-          docker exec frigate rm /tmp/cache/.write-probe
-          # models are baked in as root and archive members can carry root-only modes
-          docker exec frigate /command/s6-setuidgid frigate sh -c '
-            for f in /cpu_model.tflite /edgetpu_model.tflite /cpu_audio_model.tflite \
-                     /labelmap.txt /audio-labelmap.txt /openvino-model/*; do
-              [ -e "$f" ] || continue
-              test -r "$f" || { echo "$f is not readable by the runtime user"; exit 1; }
-            done'
-      - name: Assert device access grants
-        run: |
-          # a fake accelerator node created after boot, then the oneshot re-run
-          docker exec frigate mknod /dev/apex_9 c 120 99
-          docker exec frigate /etc/s6-overlay/s6-rc.d/init-devices/run
-          acl=$(docker exec frigate getfacl -p /dev/apex_9)
-          echo "$acl"
-          echo "$acl" | grep -q "user:frigate:rw-"
-          echo "$acl" | grep -q "user:go2rtc:rw-"
-          # the usb tree gets recursive grants plus a default ACL that
-          # newly created nodes inherit (the Coral re-enumeration path)
-          docker exec frigate sh -c 'mkdir -p /dev/bus/usb/001 && mknod /dev/bus/usb/001/002 c 189 1'
-          docker exec frigate /etc/s6-overlay/s6-rc.d/init-devices/run
-          docker exec frigate getfacl -p /dev/bus/usb/001 | grep -q "user:frigate:rwx"
-          docker exec frigate sh -c 'mknod /dev/bus/usb/001/099 c 189 98 && chmod 664 /dev/bus/usb/001/099'
-          inherited=$(docker exec frigate getfacl -p /dev/bus/usb/001/099)
-          echo "$inherited"
-          echo "$inherited" | grep -q "user:frigate:rw-"
-          # getfacl prints granted perms even when the mask clamps them to
-          # nothing, with a trailing "#effective:" comment; a clamped ACL must
-          # fail this assertion, not sneak past it. The check is scoped to the
-          # runtime users because the inherited group:: entry is always clamped
-          # on a non-directory, so an unscoped grep could never pass.
-          if echo "$inherited" | grep -E "^user:(frigate|go2rtc):" | grep -q "effective"; then
-            echo "inherited ACL is mask-clamped and grants no real access"; exit 1
-          fi
-          # hardware that is absent must stay silent: the literal table entries
-          # are not globs, so nullglob does not drop them and only an existence
-          # check keeps them from warning on every boot
-          out=$(docker exec frigate /etc/s6-overlay/s6-rc.d/init-devices/run)
-          echo "$out"
-          if echo "$out" | grep -q "WARN"; then
-            echo "grant warned about device nodes that do not exist"; exit 1
-          fi
-      - name: Assert escape hatch restores root
-        run: |
-          mkdir -p /tmp/frigate-config-root
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-root/config.yml
-          # pre-seed so the absence check proves the rm -f, not a vacuous pass
-          echo "2:1000:1000" > /tmp/frigate-config-root/.permissions_version
-          docker run -d --name frigate-root --shm-size 256m \
-            -e FRIGATE_RUN_AS_ROOT=true \
-            -v /tmp/frigate-config-root:/config \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-root curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "escape hatch container never healthy"; docker logs frigate-root; exit 1; fi
-          ps_out=$(docker exec frigate-root ps -eo user=,comm=)
-          echo "$ps_out"
-          echo "$ps_out" | grep -w python3 | grep -q '^root'
-          echo "$ps_out" | grep -w go2rtc  | grep -q '^root'
-          echo "$ps_out" | grep -w nginx   | grep -q '^root'
-          # an if, not ! test: bash exempts negated commands from set -e
-          if docker exec frigate-root test -f /config/.permissions_version; then
-            echo "escape hatch did not delete the sweep sentinel"; exit 1
-          fi
-          docker rm -f frigate-root
-      - name: Assert granular root services
-        run: |
-          mkdir -p /tmp/frigate-config-granular /tmp/frigate-media-granular
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-granular/config.yml
-          docker run -d --name frigate-granular --shm-size 256m \
-            -e FRIGATE_ROOT_SERVICES=frigate \
-            -v /tmp/frigate-config-granular:/config \
-            -v /tmp/frigate-media-granular:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-granular curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "granular container never became healthy"; docker logs frigate-granular; exit 1; fi
-          ps_out=$(docker exec frigate-granular ps -eo user=,comm=)
-          echo "$ps_out"
-          # the listed service runs as root
-          echo "$ps_out" | grep -w python3 | grep -q '^root'
-          # unlisted services still drop; ifs because set -e exempts negated commands
-          if echo "$ps_out" | grep -w go2rtc | grep -q '^root'; then
-            echo "go2rtc is unexpectedly running as root"; exit 1
-          fi
-          if echo "$ps_out" | grep -w nginx | grep -q '^root'; then
-            echo "nginx is unexpectedly running as root"; exit 1
-          fi
-          # the sweep still ran and the sentinel records the mode
-          docker exec frigate-granular cat /config/.permissions_version | grep -qx "2:1000:1000:frigate"
-          # the root frigate process chowns the db it creates (first-boot immediacy)
-          docker exec frigate-granular stat -c %u /config/frigate.db | grep -qx 1000
-          # plant a root-owned straggler; the per-boot sweep must reclaim it on restart
-          docker exec frigate-granular sh -c 'mkdir -p /media/frigate/clips && touch /media/frigate/clips/straggler.webp'
-          docker restart frigate-granular
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-granular curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "granular container never came back after restart"; docker logs frigate-granular; exit 1; fi
-          docker exec frigate-granular stat -c %u /media/frigate/clips/straggler.webp | grep -qx 1000
-          docker rm -f frigate-granular
-      - name: Assert unknown root service fails fast
-        run: |
-          mkdir -p /tmp/frigate-config-badsvc
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-badsvc/config.yml
-          docker run -d --name frigate-badsvc --shm-size 256m \
-            -e FRIGATE_ROOT_SERVICES=frigatee \
-            -v /tmp/frigate-config-badsvc:/config \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          found=0
-          for i in $(seq 1 12); do
-            if docker logs frigate-badsvc 2>&1 | grep -q "unknown service 'frigatee'"; then found=1; break; fi
-            sleep 5
-          done
-          if [ "$found" -ne 1 ]; then
-            echo "no fail-fast error for an unknown service name"; docker logs frigate-badsvc; exit 1
-          fi
-          # the failed oneshot blocks startup through the dependency chain
-          if docker exec frigate-badsvc curl -fs http://127.0.0.1:5000/api/version; then
-            echo "container came up despite an invalid FRIGATE_ROOT_SERVICES"; exit 1
-          fi
-          docker rm -f frigate-badsvc
-      - name: Assert PUID/PGID remapping
-        run: |
-          mkdir -p /tmp/frigate-config-puid /tmp/frigate-media-puid
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-puid/config.yml
-          docker run -d --name frigate-puid --shm-size 256m \
-            -e PUID=1500 -e PGID=1500 \
-            -v /tmp/frigate-config-puid:/config \
-            -v /tmp/frigate-media-puid:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-puid curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "PUID container never became healthy"; docker logs frigate-puid; exit 1; fi
-          docker exec frigate-puid id -u frigate | grep -qx 1500
-          docker exec frigate-puid id -g frigate | grep -qx 1500
-          docker exec frigate-puid cat /config/.permissions_version | grep -qx "2:1500:1500"
-          # second boot must skip the sweep (sentinel hit). Poll rather than
-          # sleep: the string can only come from the second boot (the first
-          # had no sentinel), so grepping the full log is unambiguous.
-          docker restart frigate-puid
-          ok=0
-          for i in $(seq 1 30); do
-            docker logs frigate-puid 2>&1 | grep -q "already applied" && ok=1 && break
-            sleep 2
-          done
-          if [ "$ok" -ne 1 ]; then echo "sentinel skip never logged"; docker logs frigate-puid; exit 1; fi
-          docker rm -f frigate-puid
-      - name: Assert read-only rootfs with --user works
-        run: |
-          mkdir -p /tmp/frigate-config-ro /tmp/frigate-media-ro
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-ro/config.yml
-          sudo chown -R 1000:1000 /tmp/frigate-config-ro /tmp/frigate-media-ro
-          # /run must allow exec: S6_READ_ONLY_ROOT has s6 copy its service
-          # scripts there and run them, and --tmpfs defaults to noexec
-          docker run -d --name frigate-ro --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            --user 1000:1000 \
-            --security-opt no-new-privileges:true \
-            -v /tmp/frigate-config-ro:/config \
-            -v /tmp/frigate-media-ro:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-ro curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "read-only container never healthy"; docker logs frigate-ro; exit 1; fi
-          # an if, not "! grep": bash exempts a negated command from set -e and
-          # the assertion would never fail
-          if docker logs frigate-ro 2>&1 | grep -i "read-only file system"; then
-            echo "a service tried to write to the read-only rootfs"; exit 1
-          fi
-          # the self-signed cert has to land in /config, the only writable path
-          docker exec frigate-ro test -f /config/tls/privkey.pem
-          # and nginx must serve it, which is what proves the templated cert path
-          docker exec frigate-ro curl -ksSI https://127.0.0.1:8971/ >/dev/null
-          # logging must work via the s6-log fallback (no logutil-service as non-root)
-          docker exec frigate-ro test -s /dev/shm/logs/frigate/current
-          # runtime user can write recordings storage
-          docker exec frigate-ro touch /media/frigate/.write-probe
-          docker exec frigate-ro rm /media/frigate/.write-probe
-          docker rm -f frigate-ro
-      - name: Assert PUID with read-only fails fast with clear error
-        run: |
-          docker run -d --name frigate-ro-puid --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            -e PUID=1500 -e PGID=1500 \
-            -v /tmp/frigate-config-ro:/config \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          found=0
-          for i in $(seq 1 12); do
-            if docker logs frigate-ro-puid 2>&1 | grep -q "not compatible with read_only"; then found=1; break; fi
-            sleep 5
-          done
-          if [ "$found" -ne 1 ]; then
-            echo "no fail-fast error for PUID with a read-only rootfs"; docker logs frigate-ro-puid; exit 1
-          fi
-          docker rm -f frigate-ro-puid
-      - name: Assert EXTRA_GROUPS with read-only fails fast with clear error
-        run: |
-          docker run -d --name frigate-ro-groups --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            -e EXTRA_GROUPS=44 \
-            -v /tmp/frigate-config-ro:/config \
-            -v /tmp/frigate-media-ro:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          found=0
-          for i in $(seq 1 12); do
-            if docker logs frigate-ro-groups 2>&1 | grep -q "EXTRA_GROUPS needs a writable /etc"; then found=1; break; fi
-            sleep 5
-          done
-          if [ "$found" -ne 1 ]; then
-            echo "no fail-fast error for EXTRA_GROUPS with a read-only rootfs"; docker logs frigate-ro-groups; exit 1
-          fi
-          docker rm -f frigate-ro-groups
-      - name: Assert read-only rootfs in the default mode works
-        run: |
-          mkdir -p /tmp/frigate-config-rod /tmp/frigate-media-rod
-          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-rod/config.yml
-          docker run -d --name frigate-rod --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            --security-opt no-new-privileges:true \
-            -v /tmp/frigate-config-rod:/config \
-            -v /tmp/frigate-media-rod:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-rod curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "read-only default-mode container never healthy"; docker logs frigate-rod; exit 1; fi
-          if docker logs frigate-rod 2>&1 | grep -i "read-only file system"; then
-            echo "a service tried to write to the read-only rootfs"; exit 1
-          fi
-          # the point of this mode over docker's user:: the drop still happens
-          # and go2rtc still gets its own separate user
-          ps_out=$(docker exec frigate-rod ps -eo user=,comm=)
-          echo "$ps_out"
-          for svc in python3 nginx; do
-            if echo "$ps_out" | grep -w "$svc" | grep -q '^root'; then
-              echo "$svc is running as root"; exit 1
-            fi
-          done
-          echo "$ps_out" | grep -w go2rtc | grep -q '^go2rtc'
-          # the ownership sweep still ran and recorded itself in /config
-          docker exec frigate-rod cat /config/.permissions_version | grep -qx "2:1000:1000"
-          # setfacl under a read-only rootfs, which nothing else covers:
-          # init-devices exits early under --user, so that path is never reached
-          docker exec frigate-rod mknod /dev/apex_9 c 120 99
-          docker exec frigate-rod /etc/s6-overlay/s6-rc.d/init-devices/run
-          docker exec frigate-rod getfacl -p /dev/apex_9 | grep -q "user:frigate:rw-"
-          docker rm -f frigate-rod
-      - name: "Assert switching that install to user: still starts"
-        run: |
-          # the config dir above now holds a go2rtc-owned go2rtc_homekit.yml,
-          # which user: keeps readable but not writable (no supplementary groups)
-          docker run -d --name frigate-rod-user --shm-size 256m \
-            --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \
-            --user 1000:1000 \
-            -v /tmp/frigate-config-rod:/config \
-            -v /tmp/frigate-media-rod:/media/frigate \
-            ${{ steps.setup.outputs.image-name }}-amd64
-          up=0
-          for i in $(seq 1 60); do
-            docker exec frigate-rod-user curl -fs http://127.0.0.1:5000/api/version && up=1 && break
-            sleep 5
-          done
-          if [ "$up" -ne 1 ]; then echo "container did not survive the switch to user:"; docker logs frigate-rod-user; exit 1; fi
-          docker logs frigate-rod-user 2>&1 | grep -q "HomeKit pairing changes will not persist"
-          docker rm -f frigate-rod-user
-      - name: Teardown
-        if: always()
-        run: docker rm -f frigate || true
  arm64_build:
    runs-on: ubuntu-22.04-arm
    name: ARM Build
@@ -433,7 +56,7 @@ jobs:
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push arm64 standard build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/main/Dockerfile
@@ -444,7 +67,7 @@ jobs:
            ${{ steps.setup.outputs.image-name }}-standard-arm64
          cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-arm64
      - name: Build and push RPi build
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@v6
        with:
          source: .
          push: true
@@ -473,7 +96,7 @@ jobs:
          BASE_IMAGE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu
          SLIM_BASE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu
          TRT_BASE: nvcr.io/nvidia/tensorrt:23.12-py3-igpu
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@v6
        with:
          source: .
          push: true
@@ -501,7 +124,7 @@ jobs:
      - name: Build and push TensorRT (x86 GPU)
        env:
          COMPUTE_LEVEL: "50 60 70 80 90"
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@v6
        with:
          source: .
          push: true
@@ -514,7 +137,7 @@ jobs:
      - name: AMD/ROCm general build
        env:
          HSA_OVERRIDE: 0
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@v6
        with:
          source: .
          push: true
@@ -540,7 +163,7 @@ jobs:
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Rockchip build
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@v6
        with:
          source: .
          push: true
@@ -565,7 +188,7 @@ jobs:
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Synaptics build
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@v6
        with:
          source: .
          push: true
@@ -1,120 +0,0 @@
-name: PR template check
-
-on:
-  pull_request_target:
-    types: [opened, edited]
-
-permissions:
-  pull-requests: write
-
-jobs:
-  check_template:
-    name: Validate PR description
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check PR description against template
-        uses: actions/github-script@v9
-        with:
-          script: |
-            const maintainers = ['blakeblackshear', 'NickM-27', 'hawkeye217', 'dependabot[bot]', 'weblate'];
-            const author = context.payload.pull_request.user.login;
-
-            if (maintainers.includes(author)) {
-              console.log(`Skipping template check for maintainer: ${author}`);
-              return;
-            }
-
-            const body = context.payload.pull_request.body || '';
-            const errors = [];
-
-            // Check that key template sections exist
-            const requiredSections = [
-              '## Proposed change',
-              '## Type of change',
-              '## AI disclosure',
-              '## Checklist',
-            ];
-
-            for (const section of requiredSections) {
-              if (!body.includes(section)) {
-                errors.push(`Missing section: **${section}**`);
-              }
-            }
-
-            // Check that "Proposed change" has content beyond the default HTML comment
-            const proposedChangeMatch = body.match(
-              /## Proposed change\s*(?:<!--[\s\S]*?-->\s*)?([\s\S]*?)(?=\n## )/
-            );
-            const proposedContent = proposedChangeMatch
-              ? proposedChangeMatch[1].trim()
-              : '';
-            if (!proposedContent) {
-              errors.push(
-                'The **Proposed change** section is empty. Please describe what this PR does.'
-              );
-            }
-
-            // Check that at least one "Type of change" checkbox is checked
-            const typeSection = body.match(
-              /## Type of change\s*([\s\S]*?)(?=\n## )/
-            );
-            if (typeSection && !/- \[x\]/i.test(typeSection[1])) {
-              errors.push(
-                'No **Type of change** selected. Please check at least one option.'
-              );
-            }
-
-            // Check that at least one AI disclosure checkbox is checked
-            const aiSection = body.match(
-              /## AI disclosure\s*([\s\S]*?)(?=\n## )/
-            );
-            if (aiSection && !/- \[x\]/i.test(aiSection[1])) {
-              errors.push(
-                'No **AI disclosure** option selected. Please indicate whether AI tools were used.'
-              );
-            }
-
-            // Check that at least one checklist item is checked
-            const checklistSection = body.match(
-              /## Checklist\s*([\s\S]*?)$/
-            );
-            if (checklistSection && !/- \[x\]/i.test(checklistSection[1])) {
-              errors.push(
-                'No **Checklist** items checked. Please review and check the items that apply.'
-              );
-            }
-
-            if (errors.length === 0) {
-              console.log('PR description passes template validation.');
-              return;
-            }
-
-            const prNumber = context.payload.pull_request.number;
-            const message = [
-              '## PR template validation failed',
-              '',
-              'This PR was automatically closed because the description does not follow the [pull request template](https://github.com/blakeblackshear/frigate/blob/dev/.github/pull_request_template.md).',
-              '',
-              '**Issues found:**',
-              ...errors.map((e) => `- ${e}`),
-              '',
-              'Please update your PR description to include all required sections from the template, then reopen this PR.',
-              '',
-              '> If you used an AI tool to generate this PR, please see our [contributing guidelines](https://github.com/blakeblackshear/frigate/blob/dev/CONTRIBUTING.md) for details.',
-            ].join('\n');
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: prNumber,
-              body: message,
-            });
-
-            await github.rest.pulls.update({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: prNumber,
-              state: 'closed',
-            });
-
-            core.setFailed('PR description does not follow the template.');
@@ -27,9 +27,6 @@ jobs:
      - name: Lint
        run: npm run lint
        working-directory: ./web
-      - name: Check i18n keys
-        run: npm run i18n:extract:ci
-        working-directory: ./web

  web_test:
    name: Web - Test
@@ -50,37 +47,6 @@ jobs:
      #   run: npm run test
      #   working-directory: ./web

-  web_e2e:
-    name: Web - E2E Tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 20.x
-      - run: npm install
-        working-directory: ./web
-      - name: Install Playwright Chromium
-        run: npx playwright install chromium --with-deps
-        working-directory: ./web
-      - name: Build web for E2E
-        run: npm run e2e:build
-        working-directory: ./web
-      - name: Run E2E tests
-        run: npm run e2e
-        working-directory: ./web
-      - name: Upload test artifacts
-        uses: actions/upload-artifact@v7
-        if: failure()
-        with:
-          name: playwright-report
-          path: |
-            web/test-results/
-            web/playwright-report/
-          retention-days: 7
-
  python_checks:
    runs-on: ubuntu-latest
    name: Python Checks
@@ -125,7 +91,5 @@ jobs:
        run: devcontainer up --workspace-folder .
      - name: Run mypy in devcontainer
        run: devcontainer exec --workspace-folder . bash -lc "python3 -u -m mypy --config-file frigate/mypy.ini frigate"
-      - name: Check API spec is up to date
-        run: devcontainer exec --workspace-folder . bash -lc "python3 generate_api_auth_spec.py --check"
      - name: Run unit tests in devcontainer
        run: devcontainer exec --workspace-folder . bash -lc "python3 -u -m unittest"
@@ -18,9 +18,9 @@ jobs:
          close-issue-message: ""
          days-before-stale: 30
          days-before-close: 3
-          exempt-draft-pr: false
-          exempt-issue-labels: "planned,security"
-          exempt-pr-labels: "planned,security,dependencies"
+          exempt-draft-pr: true
+          exempt-issue-labels: "pinned,security"
+          exempt-pr-labels: "pinned,security,dependencies"
          operations-per-run: 120
      - name: Print outputs
        env:
@@ -3,8 +3,6 @@ __pycache__
 .mypy_cache
 *.swp
 debug
-.claude/*
-.mcp.json
 .vscode/*
 !.vscode/launch.json
 config/*
@@ -12,7 +10,6 @@ config/*
 models
 *.mp4
 *.db
-*.db-*
 *.csv
 frigate/version.py
 web/build
@@ -22,13 +19,4 @@ web/.env
 core
 !/web/**/*.ts
 .idea/*
-.ipynb_checkpoints
-
-# Auto-generated Docker Compose Generator config files
-docs/src/components/DockerComposeGenerator/config/devices.ts
-docs/src/components/DockerComposeGenerator/config/hardware.ts
-docs/src/components/DockerComposeGenerator/config/ports.ts
-
-# GenAI review prompt tester local data (frames from real cameras)
-testing-scripts/genai-review-examples/*
-!testing-scripts/genai-review-examples/README.md
+.ipynb_checkpoints
@@ -6,23 +6,6 @@
      "type": "debugpy",
      "request": "launch",
      "module": "frigate"
-    },
-    {
-      "type": "editor-browser",
-      "request": "launch",
-      "name": "Vite: Launch in integrated browser",
-      "url": "http://localhost:5173"
-    },
-    {
-      "type": "editor-browser",
-      "request": "launch",
-      "name": "Nginx: Launch in integrated browser",
-      "url": "http://localhost:5000"
-    },
-    {
-      "type": "editor-browser",
-      "request": "attach",
-      "name": "Attach to integrated browser"
    }
  ]
 }
@@ -1,450 +0,0 @@
-# Agent Instructions for Frigate NVR
-
-This document provides coding guidelines and best practices for contributing to Frigate NVR, a complete and local NVR designed for Home Assistant with AI object detection.
-
-## Project Overview
-
-Frigate NVR is a realtime object detection system for IP cameras that uses:
-
- **Backend**: Python 3.13+ with FastAPI, OpenCV, TensorFlow/ONNX
- **Frontend**: React with TypeScript, Vite, TailwindCSS
- **Architecture**: Multiprocessing design with ZMQ and MQTT communication
- **Focus**: Minimal resource usage with maximum performance
-
-## Code Review Guidelines
-
-When reviewing code, do NOT comment on:
-
- Missing imports - Static analysis tooling catches these
- Code formatting - Ruff (Python) and Prettier (TypeScript/React) handle formatting
- Minor style inconsistencies already enforced by linters
-
-## Python Backend Standards
-
-### Python Requirements
-
- **Compatibility**: Python 3.13+
- **Language Features**: Use modern Python features:
-  - Pattern matching
-  - Type hints (comprehensive typing preferred)
-  - f-strings (preferred over `%` or `.format()`)
-  - Dataclasses
-  - Async/await patterns
-
-### Code Quality Standards
-
- **Formatting**: Ruff (configured in `pyproject.toml`)
- **Linting**: Ruff with rules defined in project config
- **Type Checking**: Use type hints consistently
- **Testing**: unittest framework - use `python3 -u -m unittest` to run tests
- **Language**: American English for all code, comments, and documentation
- **Punctuation**: Do not use em dashes in documentation, comments, or strings; reword with standard punctuation (commas, colons, parentheses, or separate sentences)
-
-### Logging Standards
-
- **Logger Pattern**: Use module-level logger
-
-  ```python
-  import logging
-
-  logger = logging.getLogger(__name__)
-  ```
-
- **Format Guidelines**:
-  - No periods at end of log messages
-  - No sensitive data (keys, tokens, passwords)
-  - Use lazy logging: `logger.debug("Message with %s", variable)`
- **Log Levels**:
-  - `debug`: Development and troubleshooting information
-  - `info`: Important runtime events (startup, shutdown, state changes)
-  - `warning`: Recoverable issues that should be addressed
-  - `error`: Errors that affect functionality but don't crash the app
-  - `exception`: Use in except blocks to include traceback
-
-### Error Handling
-
- **Exception Types**: Choose most specific exception available
- **Try/Catch Best Practices**:
-  - Only wrap code that can throw exceptions
-  - Keep try blocks minimal - process data after the try/except
-  - Avoid bare exceptions except in background tasks
-
-  Bad pattern:
-
-  ```python
-  try:
-      data = await device.get_data()  # Can throw
-      # ❌ Don't process data inside try block
-      processed = data.get("value", 0) * 100
-      result = processed
-  except DeviceError:
-      logger.error("Failed to get data")
-  ```
-
-  Good pattern:
-
-  ```python
-  try:
-      data = await device.get_data()  # Can throw
-  except DeviceError:
-      logger.error("Failed to get data")
-      return
-
-  # ✅ Process data outside try block
-  processed = data.get("value", 0) * 100
-  result = processed
-  ```
-
-### Async Programming
-
- **External I/O**: All external I/O operations must be async
- **Best Practices**:
-  - Avoid sleeping in loops - use `asyncio.sleep()` not `time.sleep()`
-  - Avoid awaiting in loops - use `asyncio.gather()` instead
-  - No blocking calls in async functions
-  - Use `asyncio.create_task()` for background operations
- **Thread Safety**: Use proper synchronization for shared state
-
-### Documentation Standards
-
- **Module Docstrings**: Concise descriptions at top of files
-  ```python
-  """Utilities for motion detection and analysis."""
-  ```
- **Function Docstrings**: Required for public functions and methods
-
-  ```python
-  async def process_frame(frame: ndarray, config: Config) -> Detection:
-      """Process a video frame for object detection.
-
-      Args:
-          frame: The video frame as numpy array
-          config: Detection configuration
-
-      Returns:
-          Detection results with bounding boxes
-      """
-  ```
-
- **Comment Style**:
-  - Explain the "why" not just the "what"
-  - Keep lines under 88 characters when possible
-  - Use clear, descriptive comments
-
-### File Organization
-
- **API Endpoints**: `frigate/api/` - FastAPI route handlers
- **Configuration**: `frigate/config/` - Configuration parsing and validation
- **Detectors**: `frigate/detectors/` - Object detection backends
- **Events**: `frigate/events/` - Event management and storage
- **Utilities**: `frigate/util/` - Shared utility functions
-
-## Frontend (React/TypeScript) Standards
-
-### Internationalization (i18n)
-
- **CRITICAL**: Never write user-facing strings directly in components
- **Always use react-i18next**: Import and use the `t()` function
-
-  ```tsx
-  import { useTranslation } from "react-i18next";
-
-  function MyComponent() {
-    const { t } = useTranslation(["views/live"]);
-    return <div>{t("camera_not_found")}</div>;
-  }
-  ```
-
- **Translation Files**: Add English strings to the appropriate json files in `web/public/locales/en`
- **Namespaces**: Organize translations by feature/view (e.g., `views/live`, `common`, `views/system`)
-
-### Code Quality
-
- **Linting**: ESLint (see `web/.eslintrc.cjs`)
- **Formatting**: Prettier with Tailwind CSS plugin
- **Type Safety**: TypeScript strict mode enabled
-
-### Component Patterns
-
- **UI Components**: Use Radix UI primitives (in `web/src/components/ui/`)
- **Styling**: TailwindCSS with `cn()` utility for class merging
- **State Management**: React hooks (useState, useEffect, useCallback, useMemo)
- **Data Fetching**: Custom hooks with proper loading and error states
-
-### ESLint Rules
-
-Key rules enforced:
-
- `react-hooks/rules-of-hooks`: error
- `react-hooks/exhaustive-deps`: error
- `no-console`: error (use proper logging or remove)
- `@typescript-eslint/no-explicit-any`: warn (always use proper types instead of `any`)
- Unused variables must be prefixed with `_`
- Comma dangles required for multiline objects/arrays
-
-### File Organization
-
- **Pages**: `web/src/pages/` - Route components
- **Views**: `web/src/views/` - Complex view components
- **Components**: `web/src/components/` - Reusable components
- **Hooks**: `web/src/hooks/` - Custom React hooks
- **API**: `web/src/api/` - API client functions
- **Types**: `web/src/types/` - TypeScript type definitions
-
-## Testing Requirements
-
-### Backend Testing
-
- **Framework**: Python unittest
- **Run Command**: `python3 -u -m unittest`
- **Location**: `frigate/test/`
- **Coverage**: Aim for comprehensive test coverage of core functionality
- **Pattern**: Use `TestCase` classes with descriptive test method names
-  ```python
-  class TestMotionDetection(unittest.TestCase):
-      def test_detects_motion_above_threshold(self):
-          # Test implementation
-  ```
-
-### Test Best Practices
-
- Always have a way to test your work and confirm your changes
- Write tests for bug fixes to prevent regressions
- Test edge cases and error conditions
- Mock external dependencies (cameras, APIs, hardware)
- Use fixtures for test data
-
-## Development Commands
-
-### Python Backend
-
-```bash
-# Run all tests
-python3 -u -m unittest
-
-# Run specific test file
-python3 -u -m unittest frigate.test.test_ffmpeg_presets
-
-# Check formatting (Ruff)
-ruff format --check frigate/
-
-# Apply formatting
-ruff format frigate/
-
-# Run linter
-ruff check frigate/
-
-# Type check
-python3 -u -m mypy --config-file frigate/mypy.ini frigate
-
-# Regenerate the OpenAPI spec after adding, changing, or removing an API
-# endpoint or its auth dependency — outputs docs/static/frigate-api.yaml,
-# annotated with each endpoint's auth requirement (admin / any / camera /
-# public). NEVER edit that file by hand. CI runs the --check variant and fails
-# if it is out of date. (from repo root)
-python3 generate_api_auth_spec.py
-python3 generate_api_auth_spec.py --check
-```
-
-### Frontend (from web/ directory)
-
-```bash
-# Start dev server (AI agents should never run this directly unless asked)
-npm run dev
-
-# Build for production
-npm run build
-
-# Run linter
-npm run lint
-
-# Fix linting issues
-npm run lint:fix
-
-# Format code
-npm run prettier:write
-
-# E2E: first-time setup
-npm install
-npx playwright install chromium
-
-# E2E: build the app and run all tests
-npm run e2e:build && npm run e2e
-
-# E2E: interactive UI for debugging
-npm run e2e:ui
-
-# E2E: run a specific spec
-npx playwright test --config e2e/playwright.config.ts e2e/specs/live.spec.ts
-
-# E2E: filter by name, or run only desktop/mobile
-npx playwright test --config e2e/playwright.config.ts --grep="severity tab"
-npx playwright test --config e2e/playwright.config.ts --project=desktop
-
-# E2E: regenerate mock data after backend model changes (from repo root)
-PYTHONPATH=. python3 web/e2e/fixtures/mock-data/generate-mock-data.py
-
-# Regenerate config translations from Pydantic models — outputs to
-# web/public/locales/en/config/{global,cameras}.json. NEVER edit those
-# JSON files by hand; change the Pydantic field title/description and
-# re-run this script. (from repo root)
-python3 generate_config_translations.py
-
-# Extract i18n keys from source into the locale files after adding
-# new t() calls. Use the :ci variant to verify the locale files are
-# in sync with source (fails if extraction would change anything).
-npm run i18n:extract
-npm run i18n:extract:ci
-```
-
-### Docker Development
-
-AI agents should never run these commands directly unless instructed.
-
-```bash
-# Build local image
-make local
-
-# Build debug image
-make debug
-```
-
-## Common Patterns
-
-### API Endpoint Pattern
-
-```python
-from fastapi import APIRouter, Request
-from frigate.api.defs.tags import Tags
-
-router = APIRouter(tags=[Tags.Events])
-
-@router.get("/events")
-async def get_events(request: Request, limit: int = 100):
-    """Retrieve events from the database."""
-    # Implementation
-```
-
-After adding, changing, or removing an endpoint (or its auth dependency), regenerate the OpenAPI spec with `python3 generate_api_auth_spec.py` so `docs/static/frigate-api.yaml` stays in sync and the endpoint's auth requirement is documented. CI enforces this via the `--check` variant; never edit that file by hand.
-
-### Configuration Access
-
-```python
-# Access Frigate configuration
-config: FrigateConfig = request.app.frigate_config
-camera_config = config.cameras["front_door"]
-```
-
-### Database Queries
-
-```python
-from frigate.models import Event
-
-# Use Peewee ORM for database access
-events = (
-    Event.select()
-    .where(Event.camera == camera_name)
-    .order_by(Event.start_time.desc())
-    .limit(limit)
-)
-```
-
-## Common Anti-Patterns to Avoid
-
-### ❌ Avoid These
-
-```python
-# Blocking operations in async functions
-data = requests.get(url)  # ❌ Use async HTTP client
-time.sleep(5)  # ❌ Use asyncio.sleep()
-
-# Hardcoded strings in React components
-<div>Camera not found</div>  # ❌ Use t("camera_not_found")
-
-# Missing error handling
-data = await api.get_data()  # ❌ No exception handling
-
-# Bare exceptions in regular code
-try:
-    value = await sensor.read()
-except Exception:  # ❌ Too broad
-    logger.error("Failed")
-
-# Returning exceptions in JSON responses
-except ValueError as e:
-    return JSONResponse(
-        content={"success": False, "message": str(e)},
-    )
-```
-
-### ✅ Use These Instead
-
-```python
-# Async operations
-import aiohttp
-async with aiohttp.ClientSession() as session:
-    async with session.get(url) as response:
-        data = await response.json()
-
-await asyncio.sleep(5)  # ✅ Non-blocking
-
-# Translatable strings in React
-const { t } = useTranslation();
-<div>{t("camera_not_found")}</div>  # ✅ Translatable
-
-# Proper error handling
-try:
-    data = await api.get_data()
-except ApiException as err:
-    logger.error("API error: %s", err)
-    raise
-
-# Specific exceptions
-try:
-    value = await sensor.read()
-except SensorException as err:  # ✅ Specific
-    logger.exception("Failed to read sensor")
-
-# Safe error responses
-except ValueError:
-    logger.exception("Invalid parameters for API request")
-    return JSONResponse(
-        content={
-            "success": False,
-            "message": "Invalid request parameters",
-        },
-    )
-```
-
-## WebSocket Broadcasts
-
-Outbound WebSocket broadcasts go through a per-recipient classifier in `frigate/comms/ws.py` that enforces camera-level access. **The classifier is fail-closed: any topic it doesn't recognize is dropped for every client.** New outbound topics must be classified there or they'll silently disappear.
-
-## Project-Specific Conventions
-
-### Configuration Files
-
- Main config: `config/config.yml`
-
-### Directory Structure
-
- Backend code: `frigate/`
- Frontend code: `web/`
- Docker files: `docker/`
- Documentation: `docs/`
- Database migrations: `migrations/`
-
-### Code Style Conformance
-
-Always conform new and refactored code to the existing coding style in the project:
-
- Follow established patterns in similar files
- Match indentation and formatting of surrounding code
- Use consistent naming conventions (snake_case for Python, camelCase for TypeScript)
- Maintain the same level of verbosity in comments and docstrings
-
-## Additional Resources
-
- Documentation: https://docs.frigate.video
- Main Repository: https://github.com/blakeblackshear/frigate
- Home Assistant Integration: https://github.com/blakeblackshear/frigate-hass-integration
@@ -1,126 +0,0 @@
-# Frigate AI Policy
-
-## TL;DR
-
- **Use AI tools if they help you.** We do too. This is about what you post, not which tools you use to write it.
- **A person has to read it and send it.** Don't wire a bot or an agent up to post on your behalf.
- **Write your posts yourself.** Your own words, the template filled in, and you answering maintainers rather than your assistant.
- **Don't paste an AI's guess at the cause as though it were a diagnosis.** Tell us what you actually observed.
- **Read your code before you submit it.** Disclose that AI was used, and be ready to explain every line.
- **If we misjudge something you wrote, just say so.** We'll take you at your word.
-
-The rest of this document explains each of these, and why.
-
-## Scope
-
-AI tools are a reality of modern development and we're not opposed to their use. You are responsible for anything you submit, however it was produced, and we are responsible for anything we merge and release. We hold a high bar for both.
-
-This policy applies everywhere this project is discussed: issues, discussions, pull requests, code reviews, and commit comments.
-
-## Why this exists
-
-Frigate is built and supported by a small group of maintainers and a community of volunteers who read every post and review every pull request. Nobody here is paid to do it, and time spent reading a post is time not spent fixing bugs or building features.
-
-We're not opposed to AI tools. We use them too. But content generated by an AI and submitted without review costs a real person real time, and usually gives them less to work with than a few honest sentences would have. That is the problem this policy addresses.
-
-## A person has to be in the loop
-
-Every issue, discussion, comment, and pull request here must be read and submitted by a person. Using an AI tool to help you write is fine. Wiring one up to post on your behalf is not.
-
-Specifically, do not:
-
- Connect a bot or agent to GitHub that opens issues, discussions, or pull requests without you reading them first
- Post output from a tool you have not read
- Use tooling to file bulk or drive-by contributions across the repository
-
-We will close anything we believe was posted without a person reading it, and we may mark it as spam. Posts that skip the templates are the most common sign of this.
-
-## Issues, discussions, and comments
-
-We do not mind if you use AI tools to help you write. Do not have tools post unreviewed content on your behalf. We may hide any comment we believe to be unreviewed AI output.
-
-Keep posts to what is needed to communicate your point. A long, confidently written, AI-padded post is harder to help with than a short direct one, not easier, and it is usually obvious.
-
-**Describe your actual problem in your own words.** Tell us what you did, what you expected, and what actually happened. That is the information we need, and only you have it.
-
-**Do not paste an AI's guess at the cause as though it were a diagnosis.** It is frequently wrong in ways that send everyone down the wrong path, and it buries the details that would have led to the real answer. We would rather see what you observed than what a model inferred.
-
-**Fill in the template completely.** The templates ask for logs, config, version, and hardware because those are the things needed to help you. An AI cannot supply them for you, and a post missing them cannot be acted on.
-
-**Answer maintainers yourself.** If we ask you a question, we are asking _you_, not your AI assistant. These are the spaces where we build trust and understanding with the community, and that only works if we're talking to each other. Using AI to fix your grammar or clarity is fine, but the substance has to be yours.
-
-This applies to pull request descriptions and review replies as much as it does to bug reports and discussions.
-
-### Quoting AI output
-
-If you want to include something an AI told you, it must be:
-
- In a quote block, using `>`
- Disclosed as AI output, saying which tool it came from
- Accompanied by your own comment explaining why you think it is relevant
-
-Keep the excerpt short. Do not paste long transcripts.
-
-### Non-native English speakers
-
-AI is genuinely useful for participating in a project that operates in English, and we would rather hear from you through a translation tool than not hear from you at all. Using AI to improve the grammar or clarity of something you wrote yourself is fine.
-
-If you are translating your posts, make sure the translation says what you meant. Including your original text in a `<details>` block helps us verify the translation if something reads oddly, and keeps the thread readable.
-
-## Code contributions
-
-We need to understand your relationship with the code you're submitting. The more AI was involved, the more important it is that you've genuinely reviewed, tested, and understood what it produced.
-
-Because of the long-term maintenance burden every merged change creates, we require a human in the loop who understands the work the AI produced. Pull requests that appear to be unreviewed AI output will be closed without review.
-
-### Requirements when AI is used
-
-If AI is used to generate any portion of the code, contributors must adhere to the following requirements:
-
-1. **Explicitly disclose the manner in which AI was employed.** The PR template asks for this. Be honest, this won't automatically disqualify your PR. We'd rather have an honest disclosure than find out later. Trust matters more than method.
-2. **Perform a comprehensive manual review prior to submitting the pull request.** Don't submit code you haven't read carefully and tested locally.
-3. **Be prepared to explain every line of code you submitted when asked about it by a maintainer.** If you can't explain why something works the way it does, you're not ready to submit it.
-4. **Check for an existing pull request addressing the same change.** If one exists, comment there and work with its author instead of opening a duplicate.
-5. **It is strictly prohibited to use AI to write your posts for you** (bug reports, feature requests, pull request descriptions, GitHub discussions, responding to humans, etc.). We need to hear from _you_, not your AI assistant. These are the spaces where we build trust and understanding with contributors, and that only works if we're talking to each other.
-
-### Established contributors
-
-Contributors with a long history of thoughtful, quality contributions to Frigate have earned trust through that track record. The level of scrutiny we apply to AI usage naturally reflects that trust. This isn't a formal exemption, it's just how trust works. If you've been around, we know how you think and how you work. If you're new, we're still getting to know you, and clear disclosure helps build that relationship.
-
-### What this means in practice
-
-We're not trying to gatekeep how you write code. Use whatever tools make you productive. But there's a difference between using AI as a tool to implement something you understand and handing a feature request to an AI and submitting whatever comes back. The former is fine. The latter creates maintenance risk for the project.
-
-Some honest context: when we review a PR, we're not just evaluating whether the code works today. We're evaluating whether we can maintain it, debug it, and extend it long-term, often without the original author's involvement. Code that the author doesn't deeply understand is code that nobody understands, and that's a liability.
-
-One more thing worth saying directly: most maintainers already have access to the same AI tools you do. A PR that's entirely AI-generated, where the author can't explain the design, debug issues independently, or engage substantively in design discussions, doesn't offer something we couldn't produce ourselves. What makes a contribution genuinely valuable is the human judgment and domain understanding behind it, as well as the engagement during review that shapes it into something we can confidently take on long-term.
-
-## Our use of AI
-
-The Frigate documentation site has an "Ask AI" search that answers questions from the docs, and we may use AI tooling to help with triage and project management. Like any automated tooling, it is not always right.
-
-If an AI tool leaves a comment on your contribution, treat it the way you would any other comment. If you think it is wrong, say so, and a brief explanation is enough. Maintainers always have the final say.
-
-## Enforcement
-
-Contributions and posts that do not follow this policy will be closed. Depending on the situation, maintainers may also:
-
- Hide or delete comments that appear to be unreviewed AI output
- Mark automated content as spam
- Close an issue, discussion, or pull request without further review
- Lock a conversation
- Temporarily or permanently block an account from participating in the project
-
-Repeated violations may result in being blocked from contributing to Frigate.
-
-### When we get it wrong
-
-There is no reliable way to detect this, and we're not going to pretend otherwise. Whether something reads as unreviewed AI output is a judgment call, usually made quickly, by a volunteer with limited time and no way to know for certain. These calls are subjective and we won't always get them right.
-
-If it happens to you, just say so. A short reply telling us you wrote it yourself is enough, and we'll take you at your word and pick the conversation back up. We would much rather occasionally reopen something we misjudged than treat everyone who posts here as a suspect.
-
-We'd ask for some understanding in return. These calls get made quickly because the volume is real, and time spent second-guessing them is time not spent helping the person in the next thread.
-
-## Attribution
-
-Portions of this policy are adapted from the [Open Home Foundation AI Policy](https://developers.home-assistant.io/docs/ai_policy/).
@@ -1 +0,0 @@
-AGENTS.md
@@ -1,135 +0,0 @@
-# Contributing to Frigate
-
-Thank you for your interest in contributing to Frigate. This document covers the expectations and guidelines for contributions. Please read it before submitting a pull request.
-
-All participation in this project, including pull requests, issues, and discussions, is covered by our [AI policy](AI_POLICY.md).
-
-## Before you start
-
-### Bugfixes
-
-If you've found a bug and want to fix it, go for it. Link to the relevant issue in your PR if one exists, or describe the bug in the PR description.
-
-### New features
-
-A pull request is more than just code — it's a request for the maintainers to review, integrate, and support the change long-term. We're selective about what we take on, and prioritize changes that align with the project's direction and can be responsibly maintained in the long term.
-
-**Large or highly-requested features** raise the bar even higher. Popularity signals demand, but it doesn't pre-approve any particular implementation. The bigger the change, the higher the long-term cost, and the more important it is that we're aligned on scope and approach before any code is written. A large PR that lands without prior discussion is unlikely to be merged as-is, no matter how well it's implemented.
-
-Before writing code for a new feature:
-
-1. **Check for existing discussion.** Search [feature requests](https://github.com/blakeblackshear/frigate/issues) and [discussions](https://github.com/blakeblackshear/frigate/discussions) to see if it's been proposed or discussed. Feature requests tagged with "planned" are on our radar — we plan to get to them, but we don't maintain a public roadmap or timeline. Check in with us first if you have interest in contributing to one.
-2. **Start a discussion or feature request first.** This helps ensure your idea aligns with Frigate's direction before you invest time building it. Community interest in a feature request helps us gauge demand, though a great idea is a great idea even without a crowd behind it.
-
-## AI usage policy
-
-AI tools are a reality of modern development and we're not opposed to their use. But we need to understand your relationship with the code you're submitting, and we need to hear from you rather than from your AI assistant.
-
-**Read the [AI policy](AI_POLICY.md) before you open a pull request.** It is short, and it applies to everything you post here. The parts that most often catch people out:
-
- A person has to be in the loop. Don't wire a bot or agent up to open pull requests, issues, or discussions on your behalf.
- Disclose how AI was used. The PR template asks for this. Be honest, it won't automatically disqualify your PR.
- Review and test everything you submit, and be prepared to explain every line when asked.
- Don't use AI to write your PR description or your replies to maintainers.
-
-Pull requests that appear to be unreviewed AI output will be closed without review.
-
-## Pull request guidelines
-
-### Before submitting
-
- **Search for existing PRs** to avoid duplicating effort.
- **Test your changes locally.** Your PR cannot be merged unless tests pass.
- **Format your code.** Run `ruff format frigate` for Python and `npm run prettier:write` from the `web/` directory for frontend changes.
- **Run the linter.** Run `ruff check frigate` for Python and `npm run lint` from `web/` for frontend.
- **One concern per PR.** Don't combine unrelated changes. A bugfix and a new feature should be separate PRs.
-
-### What we look for in review
-
- **Does it work?** Tested locally, tests pass, no regressions.
- **Is it maintainable?** Clear code, appropriate complexity, good separation of concerns.
- **Does it fit?** Consistent with Frigate's architecture and design philosophy.
- **Is it scoped well?** Solves the stated problem without unnecessary additions.
-
-### After submitting
-
- Be responsive to review feedback. We may ask for changes.
- Expect honest, direct feedback. We try to be respectful but we also try to be efficient.
- If your PR goes stale, rebase it on the latest `dev` branch.
-
-## Coding standards
-
-### Python (backend)
-
- **Python** — use modern language features (type hints, pattern matching, f-strings, dataclasses)
- **Formatting**: Ruff (configured in `pyproject.toml`)
- **Linting**: Ruff
- **Testing**: `python3 -u -m unittest`
- **Logging**: Use module-level `logger = logging.getLogger(__name__)` with lazy formatting
- **Async**: All external I/O must be async. No blocking calls in async functions.
- **Error handling**: Use specific exception types. Keep try blocks minimal.
- **Language**: American English for all code, comments, and documentation
-
-### TypeScript/React (frontend)
-
- **Linting**: ESLint (`npm run lint` from `web/`)
- **Formatting**: Prettier (`npm run prettier:write` from `web/`)
- **Type safety**: TypeScript strict mode. Avoid `any`.
- **i18n**: All user-facing strings must use `react-i18next`. Never hardcode display text in components. Add English strings to the appropriate files in `web/public/locales/en/`.
- **Components**: Use Radix UI/shadcn primitives and TailwindCSS with the `cn()` utility.
-
-### Development commands
-
-```bash
-# Python
-python3 -u -m unittest                              # Run all tests
-python3 -u -m unittest frigate.test.test_ffmpeg_presets  # Run specific test
-ruff format frigate                                  # Format
-ruff check frigate                                   # Lint
-
-# Frontend (from web/ directory)
-npm run build                                        # Build
-npm run lint                                         # Lint
-npm run lint:fix                                     # Lint + fix
-npm run prettier:write                               # Format
-```
-
-## Project structure
-
-```
-frigate/           # Python backend
-  api/             # FastAPI route handlers
-  config/          # Configuration parsing and validation
-  detectors/       # Object detection backends
-  events/          # Event management and storage
-  test/            # Backend tests
-  util/            # Shared utilities
-web/               # React/TypeScript frontend
-  src/
-    api/           # API client functions
-    components/    # Reusable components
-    hooks/         # Custom React hooks
-    pages/         # Route components
-    types/         # TypeScript type definitions
-    views/         # Complex view components
-docker/            # Docker build files
-docs/              # Documentation site
-migrations/        # Database migrations
-```
-
-## Translations
-
-Frigate uses [Weblate](https://hosted.weblate.org/projects/frigate-nvr/) for managing language translations. If you'd like to help translate Frigate into your language:
-
-1. Visit the [Frigate project on Weblate](https://hosted.weblate.org/projects/frigate-nvr/).
-2. Create an account or log in.
-3. Browse the available languages and select the one you'd like to contribute to, or request a new language.
-4. Translate strings directly in the Weblate interface — no code changes or pull requests needed.
-
-Translation contributions through Weblate are automatically synced to the repository. Please do not submit pull requests for translation changes — use Weblate instead so that translations are properly tracked and coordinated.
-
-## Resources
-
- [Documentation](https://docs.frigate.video)
- [Discussions, Support, and Bug Reports](https://github.com/blakeblackshear/frigate/discussions)
- [Feature Requests](https://github.com/blakeblackshear/frigate/issues)
@@ -1,7 +1,7 @@
 default_target: local

 COMMIT_HASH := $(shell git log -1 --pretty=format:"%h"|tail -1)
-VERSION = 0.19.0
+VERSION = 0.17.2
 IMAGE_REPO ?= ghcr.io/blakeblackshear/frigate
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
 BOARDS= #Initialized empty
@@ -49,8 +49,7 @@ push: push-boards
 		--push

 run: local
-	docker run --rm --publish=5000:5000 --publish=8971:8971 \
-		--volume=${PWD}/config:/config frigate:latest
+	docker run --rm --publish=5000:5000 --volume=${PWD}/config:/config frigate:latest

 run_tests: local
 	docker run --rm --workdir=/opt/frigate --entrypoint= frigate:latest \
@@ -24,7 +24,7 @@ yell
 sigh
 singing
 choir
-yodeling
+sodeling
 chant
 mantra
 child_singing
@@ -14,8 +14,6 @@ services:
      dockerfile: docker/main/Dockerfile
      # Use target devcontainer-trt for TensorRT dev
      target: devcontainer
-      cache_from:
-        - ghcr.io/blakeblackshear/frigate:cache-amd64
    ## Uncomment this block for nvidia gpu support
    # deploy:
    #       resources:
@@ -52,18 +52,10 @@ RUN --mount=type=tmpfs,target=/tmp --mount=type=tmpfs,target=/var/cache/apt \
    --mount=type=cache,target=/root/.ccache \
    /deps/build_sqlite_vec.sh

-# Build intel-media-driver from source against bookworm's system libva so it
-# works with Debian 12's glibc/libstdc++ (pre-built noble/trixie packages
-# require glibc 2.38 which is not available on bookworm).
-FROM base AS intel-media-driver
-ARG DEBIAN_FRONTEND
-RUN --mount=type=bind,source=docker/main/build_intel_media_driver.sh,target=/deps/build_intel_media_driver.sh \
-    /deps/build_intel_media_driver.sh
-
-FROM wget AS go2rtc
+FROM scratch AS go2rtc
 ARG TARGETARCH
-RUN --mount=type=bind,source=docker/main/install_go2rtc.sh,target=/deps/install_go2rtc.sh \
-    /deps/install_go2rtc.sh
+WORKDIR /rootfs/usr/local/go2rtc/bin
+ADD --link --chmod=755 "https://github.com/AlexxIT/go2rtc/releases/download/v1.9.10/go2rtc_linux_${TARGETARCH}" go2rtc

 FROM wget AS tempio
 ARG TARGETARCH
@@ -81,10 +73,10 @@ RUN --mount=type=bind,source=docker/main/install_tempio.sh,target=/deps/install_
 FROM base_host AS ov-converter
 ARG DEBIAN_FRONTEND

-# Install OpenVINO for model conversion
+# Install OpenVino Runtime and Dev library
 COPY docker/main/requirements-ov.txt /requirements-ov.txt
 RUN apt-get -qq update \
-    && apt-get -qq install -y wget python3 python3-distutils \
+    && apt-get -qq install -y wget python3 python3-dev python3-distutils gcc pkg-config libhdf5-dev \
    && wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
    && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
    && python3 get-pip.py "pip" \
@@ -146,8 +138,6 @@ RUN wget -q https://github.com/openvinotoolkit/open_model_zoo/raw/master/data/da
 RUN wget -qO - https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download | tar xvz && mv 1.tflite cpu_audio_model.tflite
 COPY audio-labelmap.txt .

-RUN chmod -R a+rX /rootfs
-

 FROM wget AS s6-overlay
 ARG TARGETARCH
@@ -202,16 +192,20 @@ RUN pip3 wheel --wheel-dir=/wheels -r /requirements-wheels.txt && \
        pip3 wheel --wheel-dir=/wheels -r /requirements-dev.txt; \
    fi

+# Install HailoRT & Wheels
+RUN --mount=type=bind,source=docker/main/install_hailort.sh,target=/deps/install_hailort.sh \
+    /deps/install_hailort.sh
+
 # Collect deps in a single layer
 FROM scratch AS deps-rootfs
 COPY --from=nginx /usr/local/nginx/ /usr/local/nginx/
 COPY --from=sqlite-vec /usr/local/lib/ /usr/local/lib/
-COPY --from=intel-media-driver /rootfs/ /
 COPY --from=go2rtc /rootfs/ /
 COPY --from=libusb-build /usr/local/lib /usr/local/lib
 COPY --from=tempio /rootfs/ /
 COPY --from=s6-overlay /rootfs/ /
 COPY --from=models /rootfs/ /
+COPY --from=wheels /rootfs/ /
 COPY docker/main/rootfs/ /


@@ -262,25 +256,8 @@ ENV PATH="/usr/local/go2rtc/bin:/usr/local/tempio/bin:/usr/local/nginx/sbin:${PA
 RUN --mount=type=bind,source=docker/main/install_deps.sh,target=/deps/install_deps.sh \
    /deps/install_deps.sh

-# Runtime users. frigate may be remapped at start via PUID/PGID (init-usermod)
-# or replaced entirely with docker's --user. go2rtc is intentionally separate
-# and more restricted. frigate-data is the shared group for /config access.
-# -o tolerates variant base images that already contain uid/gid 1000.
-RUN groupadd -o --gid 1000 frigate \
-    && useradd -o --uid 1000 --gid frigate --no-create-home --shell /usr/sbin/nologin frigate \
-    && groupadd --system go2rtc \
-    && useradd --system --gid go2rtc --no-create-home --shell /usr/sbin/nologin go2rtc \
-    && groupadd --system frigate-data \
-    && usermod -aG frigate-data frigate \
-    && usermod -aG frigate-data go2rtc \
-    && for grp in video render plugdev audio; do \
-         if getent group "$grp" >/dev/null; then \
-           usermod -aG "$grp" frigate && usermod -aG "$grp" go2rtc; \
-         fi; \
-       done
-
-ENV DEFAULT_FFMPEG_VERSION="8.0"
-ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:7.0:5.0"
+ENV DEFAULT_FFMPEG_VERSION="7.0"
+ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:5.0"

 RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
    && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
@@ -289,11 +266,9 @@ RUN wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
 RUN --mount=type=bind,from=wheels,source=/wheels,target=/deps/wheels \
    pip3 install -U /deps/wheels/*.whl

-# The Hailo, MemryX, and Axera runtimes are installed at first start by
-# frigate/util/runtime_deps.py, only when that detector is configured.
-# Axera's native libraries are bind mounted from the host.
-ENV PATH="${PATH}:/usr/bin/axcl"
-ENV LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:/usr/lib/axcl"
+# Install MemryX runtime (requires libgomp (OpenMP) in the final docker image)
+RUN --mount=type=bind,source=docker/main/install_memryx.sh,target=/deps/install_memryx.sh \
+    bash -c "bash /deps/install_memryx.sh"

 COPY --from=deps-rootfs / /

@@ -307,9 +282,6 @@ EXPOSE 8555/tcp 8555/udp
 ENV S6_LOGGING_SCRIPT="T 1 n0 s10000000 T"
 # Do not fail on long-running download scripts
 ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
-# Allow running with a read-only root filesystem: s6 copies its scan dir into
-# /run and executes service scripts from there, so /run must allow exec
-ENV S6_READ_ONLY_ROOT=1

 ENTRYPOINT ["/init"]
 CMD []
@@ -320,11 +292,6 @@ HEALTHCHECK --start-period=300s --start-interval=5s --interval=15s --timeout=5s
 # Frigate deps with Node.js and NPM for devcontainer
 FROM deps AS devcontainer

-# /config here is the developer's bind-mounted checkout, not a data volume, so
-# the prepare ownership sweep must not run: it would chown the source tree to
-# the runtime uid and lock out any container user that isn't 1000.
-ENV FRIGATE_RUN_AS_ROOT=true
-
 # Do not start the actual Frigate service on devcontainer as it will be started by VS Code
 # But start a fake service for simulating the logs
 COPY docker/main/fake_frigate_run /etc/s6-overlay/s6-rc.d/frigate/run
@@ -381,7 +348,3 @@ FROM deps AS frigate

 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
-
-# Pre-compile bytecode so a read-only rootfs doesn't force re-parsing the
-# source tree on every boot (pip-installed packages are already compiled)
-RUN python3 -m compileall -q -j0 /opt/frigate/frigate
@@ -1,48 +0,0 @@
-#!/bin/bash
-
-set -euxo pipefail
-
-# Intel media driver is x86_64-only. Create empty rootfs on other arches so
-# the downstream COPY --from has a valid source.
-if [ "$(uname -m)" != "x86_64" ]; then
-    mkdir -p /rootfs
-    exit 0
-fi
-
-MEDIA_DRIVER_VERSION="intel-media-25.2.6"
-GMMLIB_VERSION="intel-gmmlib-22.7.2"
-
-apt-get -qq update
-apt-get -qq install -y wget gnupg ca-certificates cmake g++ make pkg-config
-
-# Use Intel's jammy repo for newer libva-dev (2.22) which provides the
-# VVC/VVC-decode headers required by media-driver 25.x
-wget -qO - https://repositories.intel.com/gpu/intel-graphics.key | gpg --yes --dearmor --output /usr/share/keyrings/intel-graphics.gpg
-echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu jammy client" > /etc/apt/sources.list.d/intel-gpu-jammy.list
-apt-get -qq update
-apt-get -qq install -y libva-dev
-
-# Build gmmlib (required by media-driver)
-wget -qO gmmlib.tar.gz "https://github.com/intel/gmmlib/archive/refs/tags/${GMMLIB_VERSION}.tar.gz"
-mkdir /tmp/gmmlib
-tar -xf gmmlib.tar.gz -C /tmp/gmmlib --strip-components 1
-cmake -S /tmp/gmmlib -B /tmp/gmmlib/build -DCMAKE_BUILD_TYPE=Release
-make -C /tmp/gmmlib/build -j"$(nproc)"
-make -C /tmp/gmmlib/build install
-
-# Build intel-media-driver
-wget -qO media-driver.tar.gz "https://github.com/intel/media-driver/archive/refs/tags/${MEDIA_DRIVER_VERSION}.tar.gz"
-mkdir /tmp/media-driver
-tar -xf media-driver.tar.gz -C /tmp/media-driver --strip-components 1
-cmake -S /tmp/media-driver -B /tmp/media-driver/build \
-    -DCMAKE_BUILD_TYPE=Release \
-    -DENABLE_KERNELS=ON \
-    -DENABLE_NONFREE_KERNELS=ON \
-    -DCMAKE_INSTALL_PREFIX=/usr \
-    -DCMAKE_INSTALL_LIBDIR=/usr/lib/x86_64-linux-gnu \
-    -DCMAKE_C_FLAGS="-Wno-error" \
-    -DCMAKE_CXX_FLAGS="-Wno-error"
-make -C /tmp/media-driver/build -j"$(nproc)"
-
-# Install driver to rootfs for COPY --from
-make -C /tmp/media-driver/build install DESTDIR=/rootfs
@@ -3,7 +3,7 @@
 set -euxo pipefail

 NGINX_VERSION="1.27.4"
-VOD_MODULE_VERSION="v1.9.1"
+VOD_MODULE_VERSION="1.31"
 SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
@@ -31,24 +31,24 @@ wget -nv https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
 tar -zxf nginx-${NGINX_VERSION}.tar.gz -C /tmp/nginx --strip-components=1
 rm nginx-${NGINX_VERSION}.tar.gz
 mkdir /tmp/nginx-vod-module
-wget -nv https://github.com/dio-az/nginx-vod-module/archive/refs/tags/${VOD_MODULE_VERSION}.tar.gz
+wget -nv https://github.com/kaltura/nginx-vod-module/archive/refs/tags/${VOD_MODULE_VERSION}.tar.gz
 tar -zxf ${VOD_MODULE_VERSION}.tar.gz -C /tmp/nginx-vod-module --strip-components=1
 rm ${VOD_MODULE_VERSION}.tar.gz
    # Patch MAX_CLIPS to allow more clips to be added than the default 128
 sed -i 's/MAX_CLIPS (128)/MAX_CLIPS (1080)/g' /tmp/nginx-vod-module/vod/media_set.h
 patch -d /tmp/nginx-vod-module/ -p1 << 'EOF'
--- a/vod/avc_hevc_parser.c
-+++ b/vod/avc_hevc_parser.c
-@@ -2,6 +2,9 @@
-
+--- a/vod/avc_hevc_parser.c       2022-06-27 11:38:10.000000000 +0000
+++ b/vod/avc_hevc_parser.c       2023-01-16 11:25:10.900521298 +0000
+@@ -3,6 +3,9 @@
 bool_t
- avc_hevc_parser_rbsp_trailing_bits(bit_reader_state_t* reader) {
+ avc_hevc_parser_rbsp_trailing_bits(bit_reader_state_t* reader)
+ {
 +	// https://github.com/blakeblackshear/frigate/issues/4572
 +	return TRUE;
 +
 	uint32_t one_bit;

- 	if (reader->stream.eof_reached) {
+ 	if (reader->stream.eof_reached)
 EOF


@@ -73,7 +73,6 @@ cd /tmp/nginx
    --with-file-aio \
    --with-http_sub_module \
    --with-http_ssl_module \
-    --with-http_v2_module \
    --with-http_auth_request_module \
    --with-http_realip_module \
    --with-threads \
@@ -1,106 +1,11 @@
-"""Convert the default SSDLite MobileNet v2 model to OpenVINO IR.
-
-Replaces the legacy openvino-dev Model Optimizer conversion. The TensorFlow
-frontend translates the Object Detection API pre and post processors literally,
-producing per-class NonMaxSuppression, NonZero ops and map loops with data
-dependent shapes that the GPU plugin handles very badly. Both are cut out the
-way ssd_v2_support.json used to do it: the preprocessor is an identity at the
-native 300x300 input, and the postprocessor becomes a single fused
-DetectionOutput. The result is the [1, 1, 100, 7] tensor that Frigate's
-OpenVINO detector expects, with the input flipped to BGR to match the legacy
-reverse_input_channels behavior.
-"""
-
-import numpy as np
 import openvino as ov
-from openvino import opset8 as ops
-from openvino.preprocess import PrePostProcessor
+from openvino.tools import mo

-MODEL_DIR = "/models/ssdlite_mobilenet_v2_coco_2018_05_09"
-OUTPUT_PATH = "/models/ssdlite_mobilenet_v2.xml"
-INPUT_SHAPE = [1, 300, 300, 3]
-
-# faster_rcnn_box_coder divides the deltas by pipeline.config's y/x/height/width
-# scales of 10/10/5/5, which DetectionOutput expresses as per-prior variances.
-BOX_VARIANCES = np.float32([0.1, 0.1, 0.2, 0.2])
-
-model = ov.convert_model(
-    f"{MODEL_DIR}/frozen_inference_graph.pb",
-    input=[("image_tensor:0", INPUT_SHAPE)],
+ov_model = mo.convert_model(
+    "/models/ssdlite_mobilenet_v2_coco_2018_05_09/frozen_inference_graph.pb",
+    compress_to_fp16=True,
+    transformations_config="/usr/local/lib/python3.11/dist-packages/openvino/tools/mo/front/tf/ssd_v2_support.json",
+    tensorflow_object_detection_api_pipeline_config="/models/ssdlite_mobilenet_v2_coco_2018_05_09/pipeline.config",
+    reverse_input_channels=True,
 )
-
-nodes = {op.get_friendly_name(): op for op in model.get_ordered_ops()}
-parameter = model.get_parameters()[0]
-
-preprocessor = nodes["Preprocessor/map/TensorArrayStack/TensorArrayGatherV3"]
-box_deltas = nodes["Postprocessor/Reshape_1"].output(0)
-class_scores = nodes["Postprocessor/convert_scores"].output(0)
-anchors_output = nodes["Postprocessor/Reshape"].output(0)
-
-# The anchors only depend on the static input shape, so fold them into a
-# constant and drop the generator subgraph with the rest of the postprocessor.
-probe = ov.Core().compile_model(
-    ov.Model([anchors_output, preprocessor.output(0)], [parameter], "probe"), "CPU"
-)
-probe_input = np.random.default_rng(0).integers(0, 255, INPUT_SHAPE, dtype=np.uint8)
-anchors, resized = (out.copy() for out in probe([probe_input]).values())
-
-assert np.allclose(resized, probe_input, atol=1e-3), (
-    "preprocessor is not an identity at 300x300, it cannot be bypassed"
-)
-
-image = ops.convert(parameter, "f32")
-
-for consumer in list(preprocessor.output(0).get_target_inputs()):
-    consumer.replace_source_output(image.output(0))
-
-# (ymin, xmin, ymax, xmax) -> (xmin, ymin, xmax, ymax)
-priors = anchors[:, [1, 0, 3, 2]].astype(np.float32).reshape(-1)
-variances = np.tile(BOX_VARIANCES, len(anchors))
-proposals = ops.constant(np.stack([priors, variances])[np.newaxis])
-
-# (ty, tx, th, tw) -> (dx, dy, dw, dh) for the CENTER_SIZE decode
-box_logits = ops.reshape(ops.gather(box_deltas, [1, 0, 3, 2], 1), [1, -1], False)
-class_preds = ops.reshape(class_scores, [1, -1], False)
-
-detections = ops.detection_output(
-    box_logits,
-    class_preds,
-    proposals,
-    {
-        "background_label_id": 0,
-        "top_k": 100,
-        "keep_top_k": [100],
-        "nms_threshold": 0.6,
-        "confidence_threshold": 0.3,
-        "code_type": "caffe.PriorBoxParameter.CENTER_SIZE",
-        "share_location": True,
-        "variance_encoded_in_target": False,
-        "normalized": True,
-        "clip_before_nms": False,
-        "clip_after_nms": True,
-        "decrease_label_id": False,
-    },
-)
-detections.output(0).get_tensor().set_names({"detection_out"})
-
-model = ov.Model([detections], [parameter], "ssdlite_mobilenet_v2")
-
-ppp = PrePostProcessor(model)
-ppp.input().tensor().set_layout(ov.Layout("NHWC"))
-ppp.input().preprocess().reverse_channels()
-model = ppp.build()
-
-# Fail the build rather than silently ship the dynamically shaped graph again.
-op_types = [op.get_type_name() for op in model.get_ordered_ops()]
-assert op_types.count("DetectionOutput") == 1, "postprocessor was not fused"
-
-for dynamic_op in ("NonMaxSuppression", "NonZero", "Loop", "TensorIterator"):
-    assert dynamic_op not in op_types, f"{dynamic_op} left in the graph"
-
-output_shape = model.outputs[0].get_partial_shape()
-assert output_shape.is_static and list(output_shape) == [1, 1, 100, 7], (
-    f"unexpected detector output shape {output_shape}"
-)
-
-ov.save_model(model, OUTPUT_PATH, compress_to_fp16=True)
+ov.save_model(ov_model, "/models/ssdlite_mobilenet_v2.xml")
@@ -2,7 +2,7 @@

 set -euxo pipefail

-SQLITE_VEC_VERSION="0.1.9"
+SQLITE_VEC_VERSION="0.1.3"

 source /etc/os-release

@@ -10,7 +10,7 @@ apt-get -qq install --no-install-recommends -y \
    gnupg \
    wget \
    lbzip2 \
-    procps vainfo acl \
+    procps vainfo \
    unzip locales tzdata libxml2 xz-utils \
    python3.11 \
    curl \
@@ -28,13 +28,7 @@ update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
 mkdir -p -m 600 /root/.gnupg

 # install coral runtime
-# sha256 digests of the release debs; update when bumping the libedgetpu release.
-declare -A edgetpu_checksums=(
-    ["amd64"]="63fd00989d29160fa9894e115156a9abe456e88751fc9be89d26e4696200441b"
-    ["arm64"]="eab8aa4576b4dbf738135d8094f32270b24117f77147d25cbe0f49d0144d85f2"
-)
 wget -q -O /tmp/libedgetpu1-max.deb "https://github.com/feranick/libedgetpu/releases/download/16.0TF2.17.1-1/libedgetpu1-max_16.0tf2.17.1-1.bookworm_${TARGETARCH}.deb"
-echo "${edgetpu_checksums[${TARGETARCH}]}  /tmp/libedgetpu1-max.deb" | sha256sum -c -
 unset DEBIAN_FRONTEND
 yes | dpkg -i /tmp/libedgetpu1-max.deb && export DEBIAN_FRONTEND=noninteractive
 rm /tmp/libedgetpu1-max.deb
@@ -51,41 +45,28 @@ if [[ "${TARGETARCH}" == "arm64" ]]; then
    fi
 fi

-# sha256 digests of the ffmpeg builds, keyed "<install dir>-<arch>".
-# Upstream publishes no checksums; these come from a one-time fetch and guard
-# against later substitution. Update when bumping a build URL.
-declare -A ffmpeg_checksums=(
-    ["5.0-amd64"]="377abec133f9d9e8014dee1b91c9684ac8bb0b5b7d80100a57116ff837c4c0d4"
-    ["7.0-amd64"]="e13860eb90409c8218319c928067834ce450128e86f24cfed5cfe91ce6e31037"
-    ["8.0-amd64"]="9bac85054d351cdc89c0a4f45c8ea5c44df94009aabd964b719bbadd56aedae9"
-    ["5.0-arm64"]="57ee475407bad49910ba9b946428396e30cf075ea28a7912fbe1aa2578085af0"
-    ["7.0-arm64"]="16c8b04e9d0ea9c769ad964c4c453fcf05121a1947237329d2e9d8a5e43e2a3c"
-    ["8.0-arm64"]="cd91948468d0f11ce795a2cdaa0c69911bd1db313b49bb19c22512beb88cde69"
-)
-
-# the tarballs nest their binaries under a directory named for the arch, which
-# matches TARGETARCH for both builds we consume
-install_ffmpeg() {
-    local dir="$1" url="$2"
-    mkdir -p "/usr/lib/ffmpeg/${dir}"
-    wget -qO ffmpeg.tar.xz "${url}"
-    echo "${ffmpeg_checksums[${dir}-${TARGETARCH}]}  ffmpeg.tar.xz" | sha256sum -c -
-    tar -xf ffmpeg.tar.xz -C "/usr/lib/ffmpeg/${dir}" --strip-components 1 "${TARGETARCH}/bin/ffmpeg" "${TARGETARCH}/bin/ffprobe"
-    rm -f ffmpeg.tar.xz
-}
-
 # ffmpeg -> amd64
 if [[ "${TARGETARCH}" == "amd64" ]]; then
-    install_ffmpeg 5.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
-    install_ffmpeg 7.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linux64-gpl-7.0.tar.xz"
-    install_ffmpeg 8.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linux64-gpl-8.1.tar.xz"
+    mkdir -p /usr/lib/ffmpeg/5.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
+    rm -rf ffmpeg.tar.xz
+    mkdir -p /usr/lib/ffmpeg/7.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linux64-gpl-7.0.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
+    rm -rf ffmpeg.tar.xz
 fi

 # ffmpeg -> arm64
 if [[ "${TARGETARCH}" == "arm64" ]]; then
-    install_ffmpeg 5.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
-    install_ffmpeg 7.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linuxarm64-gpl-7.0.tar.xz"
-    install_ffmpeg 8.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linuxarm64-gpl-8.1.tar.xz"
+    mkdir -p /usr/lib/ffmpeg/5.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
+    rm -f ffmpeg.tar.xz
+    mkdir -p /usr/lib/ffmpeg/7.0
+    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linuxarm64-gpl-7.0.tar.xz"
+    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
+    rm -f ffmpeg.tar.xz
 fi

 # arch specific packages
@@ -106,89 +87,46 @@ if [[ "${TARGETARCH}" == "amd64" ]]; then
    # intel packages use zst compression so we need to update dpkg
    apt-get install -y dpkg

-    # use intel apt repo for libmfx1 (legacy QSV, pre-Gen12)
+    # use intel apt intel packages
    wget -qO - https://repositories.intel.com/gpu/intel-graphics.key | gpg --yes --dearmor --output /usr/share/keyrings/intel-graphics.gpg
    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu jammy client" | tee /etc/apt/sources.list.d/intel-gpu-jammy.list
    apt-get -qq update
-
-    # intel-media-va-driver-non-free is built from source in the
-    # intel-media-driver Dockerfile stage for Battlemage (Xe2) support
    apt-get -qq install --no-install-recommends --no-install-suggests -y \
-        libmfx1
-    rm -f /usr/share/keyrings/intel-graphics.gpg
-    rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list
+        intel-media-va-driver-non-free libmfx1 libmfxgen1 libvpl2

-    # upgrade libva2, oneVPL runtime, and libvpl2 from trixie for Battlemage support
-    echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/trixie.list
-    apt-get -qq update
-    apt-get -qq install -y -t trixie libva2 libva-drm2 libzstd1
-    apt-get -qq install -y -t trixie libmfx-gen1.2 libvpl2
-    rm -f /etc/apt/sources.list.d/trixie.list
-    apt-get -qq update
    apt-get -qq install -y ocl-icd-libopencl1

    # install libtbb12 for NPU support
    apt-get -qq install -y libtbb12

-    # install legacy and standard intel compute packages
-    # sha256 digests of the driver debs, taken from the ww<week>.sum asset
-    # compute-runtime ships per release and the checksum.sha256 on npu-driver
-    # v1.19.0; intel-graphics-compiler and level-zero publish none, so those
-    # five are hash-what-you-get. Refresh after a version bump with
-    # `curl -sL <url> | sha256sum`, cross-checking upstream's sum where the
-    # release still has one. npu-driver stopped publishing them after v1.19.0.
-    declare -A intel_checksums=(
-        ["libigdgmm12_22.9.0_amd64.deb"]="9d712f71c18baee076de9961dda71e8089291e1bd0deb5d649ab5ba5de114f97"
-        ["intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb"]="bbe71e4f414259e06a10cde72c29a2bd78d41b2bb2f6f8463b1806797fe66e85"
-        ["intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb"]="40dfbd15ab62de036a00824b304a2aa1fa2d81ad60ef83da09cfe3c5a80c429f"
-        ["intel-igc-opencl_1.0.17537.24_amd64.deb"]="dd016400f87fa2b6a9fa9fbcca7eb4a2629174a29de679709f9bec5cede88b0e"
-        ["intel-igc-core_1.0.17537.24_amd64.deb"]="c1e1ecdfe2064c047c552651cfdcdafc504f2033afafba65654338b880048b67"
-        ["intel-opencl-icd_26.14.37833.4-0_amd64.deb"]="2e15eeb4fe9c1bba467a655967373eec6a20dd04cc7159de53c359f17ab53e41"
-        ["libze-intel-gpu1_26.14.37833.4-0_amd64.deb"]="34ce5791160d87ce6d54edb558a4030858ee1dad2afb067b9c5c58d4cde774c6"
-        ["intel-igc-opencl-2_2.32.7+21184_amd64.deb"]="3c9bddbfe558279402bbeaabcf9c63b8de46b956b0ad9625415fd35dda53ad52"
-        ["intel-igc-core-2_2.32.7+21184_amd64.deb"]="64e5230788e3a31e611e8d815a141b1facb91e5f0ef239233ef3f0614bfe3fd6"
-        ["level-zero_1.28.2+u22.04_amd64.deb"]="9015a579abef960166f8e943858d5c81fd4199a960f07260c1da66038257effb"
-        ["intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="8087bfcc0872d7976d0163203c7c783a4176f813c473766587e86c7b34135dff"
-        ["intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="740219c03495f8812c03ab74baf8199acf17d13929001105418d4ba226ba2290"
-        ["intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="f4f5eb97aa7da52c7fec97e4ddfb43aae01703bbadc767bae1f2d4faf342ba42"
-    )
-
-    fetch_intel_deb() {
-        local url="$1" name
-        name=$(basename "$url")
-        wget -q "$url"
-        echo "${intel_checksums[${name}]}  ${name}" | sha256sum -c -
-    }
+    rm -f /usr/share/keyrings/intel-graphics.gpg
+    rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list

+    # install legacy and standard intel icd and level-zero-gpu
    # see https://github.com/intel/compute-runtime/blob/master/LEGACY_PLATFORMS.md for more info
    # needed core package
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libigdgmm12_22.9.0_amd64.deb
-    dpkg -i libigdgmm12_22.9.0_amd64.deb
-    rm libigdgmm12_22.9.0_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.52.32224.5/libigdgmm12_22.5.5_amd64.deb
+    dpkg -i libigdgmm12_22.5.5_amd64.deb
+    rm libigdgmm12_22.5.5_amd64.deb

-    # legacy compute-runtime packages
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
-    # standard compute-runtime packages
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/intel-opencl-icd_26.14.37833.4-0_amd64.deb
-    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libze-intel-gpu1_26.14.37833.4-0_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-opencl-2_2.32.7+21184_amd64.deb
-    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-core-2_2.32.7+21184_amd64.deb
+    # legacy packages
+    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
+    # standard packages
+    wget https://github.com/intel/compute-runtime/releases/download/24.52.32224.5/intel-opencl-icd_24.52.32224.5_amd64.deb
+    wget https://github.com/intel/compute-runtime/releases/download/24.52.32224.5/intel-level-zero-gpu_1.6.32224.5_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.5.6/intel-igc-opencl-2_2.5.6+18417_amd64.deb
+    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.5.6/intel-igc-core-2_2.5.6+18417_amd64.deb
    # npu packages
-    fetch_intel_deb https://github.com/oneapi-src/level-zero/releases/download/v1.28.2/level-zero_1.28.2+u22.04_amd64.deb
-    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
-    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
-    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    wget https://github.com/oneapi-src/level-zero/releases/download/v1.21.9/level-zero_1.21.9+u22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.17.0/intel-driver-compiler-npu_1.17.0.20250508-14912879441_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.17.0/intel-fw-npu_1.17.0.20250508-14912879441_ubuntu22.04_amd64.deb
+    wget https://github.com/intel/linux-npu-driver/releases/download/v1.17.0/intel-level-zero-npu_1.17.0.20250508-14912879441_ubuntu22.04_amd64.deb

    dpkg -i *.deb
    rm *.deb
-    apt-get -qq install -f -y
-
-    # Battlemage uses the xe kernel driver, but the VA-API driver is still iHD.
-    # The oneVPL runtime may look for a driver named after the kernel module.
-    ln -sf /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so /usr/lib/x86_64-linux-gnu/dri/xe_drv_video.so
 fi

 if [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -1,19 +0,0 @@
-#!/bin/bash
-
-set -euxo pipefail
-
-go2rtc_version="1.9.14"
-
-# sha256 digests of the release binaries; update when bumping go2rtc_version.
-declare -A go2rtc_checksums=(
-    ["amd64"]="32d616af226bd731678ffde328b94cfb94e30339bfefc469cfb76323144615a6"
-    ["arm64"]="359fabade8a7a51e81a55fe6df6b0ef81764a5e1d63179577534eaaa71904b50"
-)
-
-dest_dir="/rootfs/usr/local/go2rtc/bin"
-mkdir -p "${dest_dir}"
-
-wget -qO "${dest_dir}/go2rtc" \
-    "https://github.com/AlexxIT/go2rtc/releases/download/v${go2rtc_version}/go2rtc_linux_${TARGETARCH}"
-echo "${go2rtc_checksums[${TARGETARCH}]}  ${dest_dir}/go2rtc" | sha256sum -c -
-chmod 755 "${dest_dir}/go2rtc"
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+hailo_version="4.21.0"
+
+if [[ "${TARGETARCH}" == "amd64" ]]; then
+    arch="x86_64"
+elif [[ "${TARGETARCH}" == "arm64" ]]; then
+    arch="aarch64"
+fi
+
+wget -qO- "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-debian12-${TARGETARCH}.tar.gz" | tar -C / -xzf -
+wget -P /wheels/ "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"
@@ -0,0 +1,31 @@
+#!/bin/bash
+set -e
+
+# Download the MxAccl for Frigate github release
+wget https://github.com/memryx/mx_accl_frigate/archive/refs/tags/v2.1.0.zip -O /tmp/mxaccl.zip
+unzip /tmp/mxaccl.zip -d /tmp
+mv /tmp/mx_accl_frigate-2.1.0 /opt/mx_accl_frigate
+rm /tmp/mxaccl.zip
+
+# Install Python dependencies
+pip3 install -r /opt/mx_accl_frigate/freeze
+
+# Link the Python package dynamically
+SITE_PACKAGES=$(python3 -c "import site; print(site.getsitepackages()[0])")
+ln -s /opt/mx_accl_frigate/memryx "$SITE_PACKAGES/memryx"
+
+# Copy architecture-specific shared libraries
+ARCH=$(uname -m)
+if [[ "$ARCH" == "x86_64" ]]; then
+    cp /opt/mx_accl_frigate/memryx/x86/libmemx.so* /usr/lib/x86_64-linux-gnu/
+    cp /opt/mx_accl_frigate/memryx/x86/libmx_accl.so* /usr/lib/x86_64-linux-gnu/
+elif [[ "$ARCH" == "aarch64" ]]; then
+    cp /opt/mx_accl_frigate/memryx/arm/libmemx.so* /usr/lib/aarch64-linux-gnu/
+    cp /opt/mx_accl_frigate/memryx/arm/libmx_accl.so* /usr/lib/aarch64-linux-gnu/
+else
+    echo "Unsupported architecture: $ARCH"
+    exit 1
+fi
+
+# Refresh linker cache
+ldconfig
@@ -4,15 +4,6 @@ set -euxo pipefail

 s6_version="3.2.1.0"

-# sha256 digests of the release artifacts, from the .sha256 files published at
-# https://github.com/just-containers/s6-overlay/releases/tag/v3.2.1.0
-# Update these when bumping s6_version.
-declare -A s6_checksums=(
-    ["noarch"]="42e038a9a00fc0fef70bf0bc42f625a9c14f8ecdfe77d4ad93281edf717e10c5"
-    ["x86_64"]="8bcbc2cada58426f976b159dcc4e06cbb1454d5f39252b3bb0c778ccf71c9435"
-    ["aarch64"]="c8fd6b1f0380d399422fc986a1e6799f6a287e2cfa24813ad0b6a4fb4fa755cc"
-)
-
 if [[ "${TARGETARCH}" == "amd64" ]]; then
    s6_arch="x86_64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -21,15 +12,8 @@ fi

 mkdir -p /rootfs/

-download_and_extract() {
-    local arch="$1"
-    local tarball="/tmp/s6-overlay-${arch}.tar.xz"
-    wget -qO "${tarball}" \
-        "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-${arch}.tar.xz"
-    echo "${s6_checksums[${arch}]}  ${tarball}" | sha256sum -c -
-    tar -C /rootfs/ -Jxpf "${tarball}"
-    rm -f "${tarball}"
-}
+wget -qO- "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-noarch.tar.xz" |
+    tar -C /rootfs/ -Jxpf -

-download_and_extract "noarch"
-download_and_extract "${s6_arch}"
+wget -qO- "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-${s6_arch}.tar.xz" |
+    tar -C /rootfs/ -Jxpf -
@@ -4,14 +4,6 @@ set -euxo pipefail

 tempio_version="2021.09.0"

-# sha256 digests of the release binaries; update when bumping tempio_version.
-# Upstream publishes no checksums, so these come from a one-time fetch and
-# guard against later substitution rather than the original download.
-declare -A tempio_checksums=(
-    ["amd64"]="b7b93ebfd24c1161cec7aecfad62ab51f2241149358cef354b86cdbc6a60546f"
-    ["aarch64"]="3a5c32981ba68b75ed9b28497429e5a5cecbeb74c3b821b035a48b37609bb895"
-)
-
 if [[ "${TARGETARCH}" == "amd64" ]]; then
    arch="amd64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -21,5 +13,4 @@ fi
 mkdir -p /rootfs/usr/local/tempio/bin

 wget -q -O /rootfs/usr/local/tempio/bin/tempio "https://github.com/home-assistant/tempio/releases/download/${tempio_version}/tempio_${arch}"
-echo "${tempio_checksums[${arch}]}  /rootfs/usr/local/tempio/bin/tempio" | sha256sum -c -
 chmod 755 /rootfs/usr/local/tempio/bin/tempio
@@ -1,4 +1,4 @@
-ruff == 0.15.20
+ruff

 # types
 types-peewee == 3.17.*
@@ -1,2 +1,3 @@
 numpy
-openvino >= 2026.2.0
+tensorflow
+openvino-dev>=2024.0.0
@@ -11,7 +11,7 @@ joserfc == 1.2.*
 cryptography == 44.0.*
 pathvalidate == 3.3.*
 markupsafe == 3.0.*
-python-multipart == 0.0.26
+python-multipart == 0.0.20
 # Classification Model Training
 tensorflow == 2.19.* ; platform_machine == 'aarch64'
 tensorflow-cpu == 2.19.* ; platform_machine == 'x86_64'
@@ -42,7 +42,7 @@ opencv-python-headless == 4.11.0.*
 opencv-contrib-python == 4.11.0.*
 scipy == 1.16.*
 # OpenVino & ONNX
-openvino == 2025.4.*
+openvino == 2025.3.*
 onnxruntime == 1.22.*
 # Embeddings
 transformers == 4.45.*
@@ -57,12 +57,19 @@ pywebpush == 2.0.*
 pyclipper == 1.3.*
 shapely == 2.0.*
 rapidfuzz==3.12.*
-# HailoRT
+# HailoRT Wheels
+appdirs==1.4.*
 argcomplete==2.0.*
 contextlib2==0.6.*
+distlib==0.3.*
+filelock==3.8.*
 future==0.18.*
+importlib-metadata==5.1.*
+importlib-resources==5.1.*
 netaddr==0.8.*
 netifaces==0.10.*
+verboselogs==1.7.*
+virtualenv==20.17.*
 prometheus-client == 0.21.*
 # TFLite
 tflite_runtime @ https://github.com/frigate-nvr/TFlite-builds/releases/download/v2.17.1/tflite_runtime-2.17.1-cp311-cp311-linux_x86_64.whl; platform_machine == 'x86_64'
@@ -72,5 +79,7 @@ sherpa-onnx==1.12.*
 faster-whisper==1.1.*
 librosa==0.11.*
 soundfile==0.13.*
+# DeGirum detector
+degirum == 0.16.*
 # Memory profiling
 memray == 1.15.*
@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash

-if [[ "$(id -u)" -eq 0 ]]; then
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/certsync
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/certsync
+exec logutil-service /dev/shm/logs/certsync
@@ -6,38 +6,11 @@ set -o errexit -o nounset -o pipefail

 # Logs should be sent to stdout so that s6 can collect them

-# Not `nginx -s reload`: that has root parse /tmp/nginx/conf, which the
-# unprivileged nginx user can rewrite, and nginx chowns path directives on load.
-function reload_nginx() {
-    local pid
-
-    if ! pid=$(cat /tmp/nginx/nginx.pid 2>/dev/null); then
-        echo "[ERROR] No nginx pid file found, not reloading"
-        return 0
-    fi
-
-    if [[ ! "$pid" =~ ^[0-9]+$ ]] || [[ "$(cat "/proc/${pid}/comm" 2>/dev/null)" != "nginx" ]]; then
-        echo "[ERROR] nginx pid file does not name a running nginx process, not reloading"
-        return 0
-    fi
-
-    kill -HUP "$pid"
-}
-
 echo "[INFO] Starting certsync..."

-# Resolved once, and the condition must stay identical to the nginx run
-# script's. Testing only fullchain.pem here would pick the mounted cert on a
-# half-populated mount that nginx rejected, and the two fingerprints would then
-# never agree, reloading nginx every cycle forever.
-if [ -f /etc/letsencrypt/live/frigate/privkey.pem ] && [ -f /etc/letsencrypt/live/frigate/fullchain.pem ]; then
-    lefile="/etc/letsencrypt/live/frigate/fullchain.pem"
-else
-    lefile="/config/tls/fullchain.pem"
-fi
+lefile="/etc/letsencrypt/live/frigate/fullchain.pem"

-tls_enabled=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .tls.enabled`
-listen_external_port=`python3 /usr/local/nginx/get_nginx_settings.py | jq -r .listen.external_port`
+tls_enabled=`python3 /usr/local/nginx/get_listen_settings.py | jq -r .tls.enabled`

 while true
 do
@@ -61,7 +34,7 @@ do
            ;;
    esac

-    liveprint=`echo | openssl s_client -showcerts -connect 127.0.0.1:$listen_external_port 2>&1 | openssl x509 -fingerprint 2>&1 | grep -i fingerprint  || echo 'failed'`
+    liveprint=`echo | openssl s_client -showcerts -connect 127.0.0.1:8971 2>&1 | openssl x509 -fingerprint 2>&1 | grep -i fingerprint  || echo 'failed'`

    case "$liveprint" in
        *Fingerprint*)
@@ -75,11 +48,11 @@ do
    then
        echo "[INFO] Reloading nginx to refresh TLS certificate"
        echo "$lefile: $leprint"
-        reload_nginx
+        /usr/local/nginx/sbin/nginx -s reload
    fi

    sleep 60

 done

-exit 0
+exit 0
@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash

-if [[ "$(id -u)" -eq 0 ]]; then
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/frigate
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/frigate
+exec logutil-service /dev/shm/logs/frigate
@@ -4,24 +4,6 @@

 set -o errexit -o nounset -o pipefail

-runs_as_root=0
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root frigate; then
-        runs_as_root=1
-    fi
-fi
-
-# /root survives s6-setuidgid and breaks cache writes after the drop; set
-# before opt_in_out so the opt-out marker lands where the service will look
-if [[ "$runs_as_root" -eq 0 ]]; then
-    export HOME=/config
-fi
-
-# detector runtimes installed at first start (pip install --user) live under
-# $HOME/.local; the dynamic loader only reads LD_LIBRARY_PATH at exec time
-export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+${LD_LIBRARY_PATH}:}${HOME}/.local/lib"
-export PATH="${PATH}:${HOME}/.local/bin"
-
 # opt out of openvino telemetry
 if [ -e /usr/local/bin/opt_in_out ]; then
  /usr/local/bin/opt_in_out --opt_out > /dev/null 2>&1
@@ -48,8 +30,4 @@ cd /opt/frigate || echo "[ERROR] Failed to change working directory to /opt/frig

 # Replace the bash process with the Frigate process, redirecting stderr to stdout
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
-    exec python3 -u -m frigate
-else
-    exec s6-setuidgid frigate python3 -u -m frigate
-fi
+exec python3 -u -m frigate
@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash

-if [[ "$(id -u)" -eq 0 ]]; then
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/go2rtc
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/go2rtc
+exec logutil-service /dev/shm/logs/go2rtc
@@ -4,20 +4,6 @@

 set -o errexit -o nounset -o pipefail

-runs_as_root=0
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root go2rtc; then
-        runs_as_root=1
-    fi
-fi
-
-# Root via FRIGATE_ROOT_SERVICES only; the escape hatch sweeps nothing and
-# leaves no unprivileged service, so /config/go2rtc stays as safe as pre-drop.
-granular_root=0
-if [[ "$runs_as_root" -eq 1 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-    granular_root=1
-fi
-
 # Logs should be sent to stdout so that s6 can collect them

 function get_ip_and_port_from_supervisor() {
@@ -64,6 +50,42 @@ function set_libva_version() {
    export LIBAVFORMAT_VERSION_MAJOR
 }

+function setup_homekit_config() {
+    local config_path="$1"
+
+    if [[ ! -f "${config_path}" ]]; then
+        echo "[INFO] Creating empty config file for HomeKit..."
+        : > "${config_path}"
+    fi
+
+    # Convert YAML to JSON for jq processing
+    local temp_json="/tmp/cache/homekit_config.json"
+    yq eval -o=json "${config_path}" > "${temp_json}" 2>/dev/null || {
+        echo "[WARNING] Failed to convert HomeKit config to JSON, skipping cleanup"
+        return 0
+    }
+
+    # Use jq to extract the homekit section, if it exists
+    local homekit_json
+    homekit_json=$(jq '
+        if has("homekit") then {homekit: .homekit} else null end
+    ' "${temp_json}" 2>/dev/null) || homekit_json="null"
+
+    # If no homekit section, write an empty config file
+    if [[ "${homekit_json}" == "null" ]]; then
+        : > "${config_path}"
+    else
+        # Convert homekit JSON back to YAML and write to the config file
+        echo "${homekit_json}" | yq eval -P - > "${config_path}" 2>/dev/null || {
+            echo "[WARNING] Failed to convert cleaned config to YAML, creating minimal config"
+            : > "${config_path}"
+        }
+    fi
+
+    # Clean up temp files
+    rm -f "${temp_json}"
+}
+
 set_libva_version

 if [[ -f "/dev/shm/go2rtc.yaml" ]]; then
@@ -84,23 +106,13 @@ else
    echo "[WARNING] Unable to remove existing go2rtc config. Changes made to your frigate config file may not be recognized. Please remove the /dev/shm/go2rtc.yaml from your docker host manually."
 fi

-# HomeKit persistence. The helper is symlink-safe; hand off to go2rtc only when dropping.
+# HomeKit configuration persistence setup
 readonly homekit_config_path="/config/go2rtc_homekit.yml"
-if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
-    python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}" --chown
-    chown go2rtc:go2rtc /dev/shm/go2rtc.yaml 2>/dev/null || true
-else
-    python3 /usr/local/go2rtc/prepare_homekit.py "${homekit_config_path}"
-fi
+setup_homekit_config "${homekit_config_path}"

 readonly config_path="/config"

-# the sweep hands /config to uid 1000, so a root service must not exec from it
-if [[ "$granular_root" -eq 1 && -x "${config_path}/go2rtc" ]]; then
-  echo "[WARN] Ignoring '${config_path}/go2rtc' because FRIGATE_ROOT_SERVICES runs this service as root and /config is owned by the runtime user; using the embedded binary"
-  echo "[WARN] Use FRIGATE_RUN_AS_ROOT=true instead if you need both a custom go2rtc build and root"
-  readonly binary_path="/usr/local/go2rtc/bin/go2rtc"
-elif [[ -x "${config_path}/go2rtc" ]]; then
+if [[ -x "${config_path}/go2rtc" ]]; then
  readonly binary_path="${config_path}/go2rtc"
  echo "[WARN] Using go2rtc binary from '${binary_path}' instead of the embedded one"
 else
@@ -113,8 +125,4 @@ echo "[INFO] Starting go2rtc..."
 # Use HomeKit config as the primary config so writebacks go there
 # The main config from Frigate will be loaded as a secondary config
 exec 2>&1
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
-    exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
-else
-    exec s6-setuidgid go2rtc "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
-fi
+exec "${binary_path}" -config="${homekit_config_path}" -config=/dev/shm/go2rtc.yaml
@@ -1,104 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-# Grant the runtime users access to mapped-in device nodes with POSIX ACLs,
-# so --device works without host-side group or udev setup.
-# No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
-# or FRIGATE_DEVICE_ACLS=false.
-
-set -o errexit -o nounset -o pipefail
-
-if [[ "$(id -u)" -ne 0 ]]; then
-    exit 0
-fi
-
-if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
-    exit 0
-fi
-
-if [[ "${FRIGATE_DEVICE_ACLS:-true}" == "false" ]]; then
-    echo "[INFO] FRIGATE_DEVICE_ACLS=false: skipping device access grants"
-    exit 0
-fi
-
-shopt -s nullglob
-
-device_globs=(
-    "/dev/dri/*"
-    "/dev/accel/*"
-    "/dev/apex_*"
-    "/dev/hailo*"
-    "/dev/video*"
-    "/dev/kfd"
-    "/dev/rknpu*"
-    "/dev/mpp_service"
-    "/dev/rga"
-    "/dev/dma_heap/*"
-    "/dev/nvhost*"
-    "/dev/nvmap"
-    "/dev/nvidia*"
-    "/dev/memx*"
-)
-
-IFS=',' read -ra extra_globs <<< "${DEVICE_ACL_PATHS:-}"
-for extra in "${extra_globs[@]}"; do
-    extra="${extra//[[:space:]]/}"
-    if [[ -z "$extra" ]]; then
-        continue
-    fi
-    if [[ "$extra" != /dev/* || "$extra" == *..* ]]; then
-        echo "[ERROR] DEVICE_ACL_PATHS entries must be under /dev, got '${extra}'" >&2
-        exit 1
-    fi
-    device_globs+=("$extra")
-done
-
-granted=0
-failed=0
-
-grant() {
-    local node="$1"
-    # nullglob only drops patterns that hold a metacharacter, so a literal
-    # table entry for absent hardware arrives here verbatim. Warn only about
-    # nodes that exist and could not be granted.
-    if [[ ! -e "$node" ]]; then
-        return 0
-    fi
-    local spec="u:frigate:rw,u:go2rtc:rw"
-    # directories need traverse or nothing under them is reachable
-    if [[ -d "$node" ]]; then
-        spec="u:frigate:rwx,u:go2rtc:rwx"
-    fi
-    if setfacl -m "$spec" "$node" 2>/dev/null; then
-        granted=$((granted + 1))
-    else
-        failed=$((failed + 1))
-        echo "[WARN] could not grant device access on ${node}; see EXTRA_GROUPS in the non-root docs for the fallback"
-    fi
-}
-
-for glob in "${device_globs[@]}"; do
-    # shellcheck disable=SC2231
-    for node in $glob; do
-        grant "$node"
-    done
-done
-
-# USB devices re-enumerate (the Coral uploads firmware and reattaches as a new
-# node), so the directories also get a default ACL new nodes inherit. The
-# inherited grant is clamped by the creating mode's group bits, which is rw on
-# udev hosts (0664) and nothing on raw devtmpfs (0600); hardware-verified.
-if [[ -d /dev/bus/usb ]]; then
-    while IFS= read -r -d '' node; do
-        grant "$node"
-    done < <(find /dev/bus/usb -mindepth 1 -print0)
-    while IFS= read -r -d '' dir; do
-        setfacl -d -m "u:frigate:rw,u:go2rtc:rw" "$dir" 2>/dev/null || \
-            echo "[WARN] could not set a default ACL on ${dir}; a re-enumerating USB device may lose access"
-    done < <(find /dev/bus/usb -type d -print0)
-fi
-
-if [[ "$failed" -gt 0 ]]; then
-    echo "[INFO] device access: granted ${granted} node(s), ${failed} failed"
-elif [[ "$granted" -gt 0 ]]; then
-    echo "[INFO] device access: granted ${granted} node(s) to the runtime users"
-fi
@@ -1 +0,0 @@
-oneshot
@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-devices/run
@@ -1,104 +0,0 @@
-#!/command/with-contenv bash
-# shellcheck shell=bash
-# Remap the frigate user to PUID/PGID and register EXTRA_GROUPS.
-# No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
-# or PUID/PGID already match. FRIGATE_ROOT_SERVICES is validated here too.
-
-set -o errexit -o nounset -o pipefail
-
-if [[ "$(id -u)" -ne 0 ]]; then
-    # Started with docker --user; the host owns UID mapping entirely.
-    exit 0
-fi
-
-if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
-    if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
-        echo "[INFO] FRIGATE_RUN_AS_ROOT=true: ignoring FRIGATE_ROOT_SERVICES"
-    fi
-    echo "[INFO] FRIGATE_RUN_AS_ROOT=true: skipping user remapping"
-    exit 0
-fi
-
-# a typo must fail the boot, not silently drop a service to non-root
-if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
-    IFS=',' read -ra root_services <<< "${FRIGATE_ROOT_SERVICES}"
-    for entry in "${root_services[@]}"; do
-        entry="${entry//[[:space:]]/}"
-        if [[ -z "$entry" ]]; then
-            continue
-        fi
-        case "$entry" in
-            frigate|go2rtc|nginx) ;;
-            *)
-                echo "[ERROR] FRIGATE_ROOT_SERVICES contains unknown service '${entry}'; valid names are frigate, go2rtc, nginx" >&2
-                exit 1
-                ;;
-        esac
-    done
-fi
-
-puid="${PUID:-1000}"
-pgid="${PGID:-1000}"
-
-if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
-    echo "[ERROR] PUID and PGID must be numeric, got '${puid}' and '${pgid}'" >&2
-    exit 1
-fi
-
-# Remapping to 0 would make the frigate user root, so every service would keep
-# full privilege while reporting a successful migration.
-if [[ "$puid" -eq 0 || "$pgid" -eq 0 ]]; then
-    echo "[ERROR] PUID/PGID 0 would run the services as root and defeat the privilege separation." >&2
-    echo "[ERROR] Set FRIGATE_RUN_AS_ROOT=true if you want to keep running as root." >&2
-    exit 1
-fi
-
-# Colliding with the go2rtc ids would merge the two users and collapse the
-# separation between the main process and the network-facing restreamer.
-go2rtc_uid="$(id -u go2rtc)"
-go2rtc_gid="$(id -g go2rtc)"
-if [[ "$puid" -eq "$go2rtc_uid" || "$pgid" -eq "$go2rtc_gid" ]]; then
-    echo "[ERROR] PUID/PGID must not equal the go2rtc service ids (${go2rtc_uid}:${go2rtc_gid})." >&2
-    exit 1
-fi
-
-current_uid="$(id -u frigate)"
-current_gid="$(id -g frigate)"
-
-if [[ "$puid" != "$current_uid" || "$pgid" != "$current_gid" ]]; then
-    if [[ ! -w /etc/passwd ]]; then
-        echo "[ERROR] PUID/PGID remapping needs a writable /etc and is not compatible with read_only: true." >&2
-        echo "[ERROR] Either remove read_only and keep PUID, or drop PUID/PGID and use docker's user: ${puid}:${pgid} instead." >&2
-        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
-        exit 1
-    fi
-    echo "[INFO] Remapping frigate user to ${puid}:${pgid}"
-    groupmod -o -g "$pgid" frigate
-    usermod -o -u "$puid" frigate
-fi
-
-# EXTRA_GROUPS: numeric host GIDs granting device access (e.g. host render/video)
-if [[ -n "${EXTRA_GROUPS:-}" ]]; then
-    # groupadd and usermod -aG both write /etc/group. Checked up front so a
-    # read-only rootfs reports the real problem instead of dying mid-loop.
-    if [[ ! -w /etc/group ]]; then
-        echo "[ERROR] EXTRA_GROUPS needs a writable /etc and is not compatible with read_only: true." >&2
-        echo "[ERROR] Use docker's group_add: with the same GIDs instead; it needs no writes inside the container." >&2
-        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
-        exit 1
-    fi
-
-    for gid in ${EXTRA_GROUPS//,/ }; do
-        if ! [[ "$gid" =~ ^[0-9]+$ ]] || [[ "$gid" -eq 0 ]]; then
-            echo "[ERROR] EXTRA_GROUPS must be nonzero numeric GIDs, got '${gid}'" >&2
-            exit 1
-        fi
-        if ! getent group "$gid" >/dev/null; then
-            groupadd -o -g "$gid" "frigate-extra-${gid}"
-        fi
-        group_name="$(getent group "$gid" | cut -d: -f1)"
-        usermod -aG "$group_name" frigate
-        usermod -aG "$group_name" go2rtc
-        echo "[INFO] Added frigate and go2rtc to supplementary group ${group_name} (gid ${gid})"
-    done
-fi
@@ -1 +0,0 @@
-oneshot
@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-usermod/run
@@ -7,12 +7,5 @@ set -o errexit -o nounset -o pipefail
 dirs=(/dev/shm/logs/frigate /dev/shm/logs/go2rtc /dev/shm/logs/nginx /dev/shm/logs/certsync)

 mkdir -p "${dirs[@]}"
-
-# logutil-service drops s6-log to nobody, so the dirs must stay nobody-owned
-# in root mode. Under docker --user we are already the (only) target user,
-# chown would fail, and the plain s6-log fallback in the *-log services
-# writes as us (the mkdir above is sufficient, /dev/shm is 1777).
-if [[ "$(id -u)" -eq 0 ]]; then
-    chown nobody:nogroup "${dirs[@]}"
-fi
+chown nobody:nogroup "${dirs[@]}"
 chmod 02755 "${dirs[@]}"
@@ -1,12 +1,4 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash

-if [[ "$(id -u)" -eq 0 ]]; then
-    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
-    exec logutil-service /dev/shm/logs/nginx
-fi
-
-# Non-root (--user) fallback: logutil-service cannot change UID, so run
-# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
-# shellcheck disable=SC2086
-exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/nginx
+exec logutil-service /dev/shm/logs/nginx
@@ -2,4 +2,4 @@
 set -e

 # Wait for PID file to exist.
-while ! test -f /tmp/nginx/nginx.pid; do sleep 1; done
+while ! test -f /run/nginx.pid; do sleep 1; done
@@ -4,13 +4,6 @@

 set -o errexit -o nounset -o pipefail

-runs_as_root=0
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]] || /usr/local/bin/service-runs-as-root nginx; then
-        runs_as_root=1
-    fi
-fi
-
 # Logs should be sent to stdout so that s6 can collect them

 echo "[INFO] Starting NGINX..."
@@ -66,105 +59,38 @@ function set_worker_processes() {
        cpus=4
    fi

-    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /tmp/nginx/conf/nginx.conf
+    # we need to catch any errors because sed will fail if user has bind mounted a custom nginx file
+    sed -i "s/worker_processes auto;/worker_processes ${cpus};/" /usr/local/nginx/conf/nginx.conf || true
 }

-# Rebuilt root-owned every start: a symlink planted by the previously
-# unprivileged nginx would redirect the root cp/tempio writes below onto any
-# root file. rm does not traverse symlinks; the bare mkdir fails closed if raced.
-rm -rf /tmp/nginx
-mkdir /tmp/nginx
-mkdir -p /tmp/nginx/conf /tmp/nginx/client_body /tmp/nginx/proxy \
-         /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
-cp -r /usr/local/nginx/conf/. /tmp/nginx/conf/
-
 set_worker_processes

-# TLS certs: user-mounted certs at /etc/letsencrypt/live/frigate (documented
-# contract) always win; otherwise fall back to a self-signed cert persisted in
-# /config/tls, which stays writable under a read-only root filesystem.
+# ensure the directory for ACME challenges exists
+mkdir -p /etc/letsencrypt/www
+
+# Create self signed certs if needed
 letsencrypt_path=/etc/letsencrypt/live/frigate
-selfsigned_path=/config/tls
+mkdir -p $letsencrypt_path

-if [ -f "$letsencrypt_path/privkey.pem" ] && [ -f "$letsencrypt_path/fullchain.pem" ]; then
-    cert_path="$letsencrypt_path"
-else
-    cert_path="$selfsigned_path"
-
-    # Root writing into /config follows any symlink planted there, and /config
-    # is owned by whoever the host mount says, not by root. Generate as the
-    # runtime user wherever we are going to drop to it; the escape hatch keeps
-    # root all the way through, so that path is refused rather than dropped.
-    gen=()
-    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-        gen=(s6-setuidgid frigate)
-    elif [[ "$(id -u)" -eq 0 ]]; then
-        for link in "$cert_path" "$cert_path/privkey.pem" "$cert_path/fullchain.pem"; do
-            if [[ -L "$link" ]]; then
-                echo "[ERROR] ${link} is a symlink; refusing to write TLS material through it as root" >&2
-                exit 1
-            fi
-        done
-    fi
-
-    "${gen[@]}" mkdir -p "$cert_path"
-
-    if [ ! \( -f "$cert_path/privkey.pem" -a -f "$cert_path/fullchain.pem" \) ]; then
-        echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
-        "${gen[@]}" openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
-            -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
-            -keyout "$cert_path/privkey.pem" -out "$cert_path/fullchain.pem" 2>/dev/null
-        "${gen[@]}" chmod 600 "$cert_path/privkey.pem"
-        "${gen[@]}" chmod 644 "$cert_path/fullchain.pem"
-    fi
+if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.pem" \) ]; then
+    echo "[INFO] No TLS certificate found. Generating a self signed certificate..."
+    openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
+        -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
+        -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
 fi

-# ACME challenges are only served from a writable rootfs; skipping the mkdir
-# under read_only leaves the location 404ing, which is the same as unused
-mkdir -p /etc/letsencrypt/www 2>/dev/null || true
-
-# nginx settings are read once; both templates consume them
-nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)
-
 # build templates for optional FRIGATE_BASE_PATH environment variable
-echo "$nginx_settings" | \
+python3 /usr/local/nginx/get_base_path.py | \
    tempio -template /usr/local/nginx/templates/base_path.gotmpl \
-           -out /tmp/nginx/conf/base_path.conf
+       -out /usr/local/nginx/conf/base_path.conf

-# build templates for additional network settings; listen.conf is the only
-# template that needs the resolved cert directory
-echo "$nginx_settings" | \
-    jq --arg p "$cert_path" '.tls.cert_path = $p' | \
-    tempio -template /usr/local/nginx/templates/listen.gotmpl \
-           -out /tmp/nginx/conf/listen.conf
-
-if [[ "$(id -u)" -eq 0 && "$runs_as_root" -eq 0 ]]; then
-    chown -R frigate:frigate /tmp/nginx
-    # heal the cache: a root `nginx -t` chowns every cycle path to the `user` directive user
-    if [ -d /dev/shm/nginx_cache ]; then
-        chown -R frigate:frigate /dev/shm/nginx_cache
-    fi
-    # nginx reopens /dev/stdout by path for its logs, and s6 made the pipe
-    # root-owned 0600; without this the non-root master exits EACCES
-    chown frigate /dev/stdout
-    # Only mounted certs need handing over; the self-signed pair is already
-    # owned by the runtime user that generated it. Never chown the /config copy:
-    # chown follows symlinks, so it would retarget onto any root file the
-    # runtime user pointed it at. Tolerant because mounted certs may be :ro.
-    if [ "$cert_path" = "$letsencrypt_path" ] && [ -f "$cert_path/privkey.pem" ]; then
-        chown frigate:frigate "$cert_path/privkey.pem" "$cert_path/fullchain.pem" 2>/dev/null || true
-    fi
-fi
+# build templates for optional TLS support
+python3 /usr/local/nginx/get_listen_settings.py | \
+    tempio  -template /usr/local/nginx/templates/listen.gotmpl \
+            -out /usr/local/nginx/conf/listen.conf

 # Replace the bash process with the NGINX process, redirecting stderr to stdout
 exec 2>&1
-# -e stderr: the compiled-in error log path is not writable by the runtime user
-if [[ "$(id -u)" -ne 0 || "$runs_as_root" -eq 1 ]]; then
-    exec \
-        s6-notifyoncheck -t 30000 -n 1 \
-        nginx -e stderr -c /tmp/nginx/conf/nginx.conf
-else
-    exec \
-        s6-notifyoncheck -t 30000 -n 1 \
-        s6-setuidgid frigate nginx -e stderr -c /tmp/nginx/conf/nginx.conf
-fi
+exec \
+    s6-notifyoncheck -t 30000 -n 1 \
+    nginx
@@ -144,66 +144,3 @@ rm -f /dev/shm/.frigate-is-stopping

 migrate_addon_config_dir
 migrate_db_from_media_to_config
-
-# Align volume ownership with the runtime user (one sweep per PUID/schema
-# change, guarded by the sentinel; see fix-ownership). The escape hatch
-# deletes the sentinel instead: ownership is never mutated while it is on,
-# so the next non-root boot must re-sweep whatever root created meanwhile.
-if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
-        rm -f /config/.permissions_version
-    else
-        # Only when a mount backs /media/frigate itself: under a parent /media
-        # mount, a dedicated volume added later would be shadowed and skipped
-        sentinel_args=(--sentinel /config/.permissions_version)
-        root_services_mode=""
-        if [[ -n "${FRIGATE_ROOT_SERVICES:-}" ]]; then
-            # || true: an all-empty list (",") fails grep -v and errexit would kill the boot
-            root_services_mode=$(tr ',' '\n' <<< "${FRIGATE_ROOT_SERVICES//[[:space:]]/}" | grep -v '^$' | sort -u | paste -sd, - || true)
-            if [[ -n "$root_services_mode" ]]; then
-                sentinel_args+=(--mode "$root_services_mode")
-            fi
-        fi
-        if ! awk '$2 == "/media/frigate" || $2 ~ /^\/media\/frigate\//' /proc/mounts | grep -q .; then
-            sentinel_args=()
-        fi
-        /usr/local/bin/fix-ownership "${sentinel_args[@]}" \
-            "${PUID:-1000}" "${PGID:-1000}" /config /media/frigate
-
-        # Root services write clips stragglers and caches mid-run; realign the
-        # small trees every boot. Recordings are chowned at create instead.
-        if [[ -n "$root_services_mode" ]]; then
-            # only sweep what exists; clips and exports appear after the first run
-            boot_sweep_paths=(/config)
-            for extra in /media/frigate/clips /media/frigate/exports; do
-                if [[ -d "$extra" ]]; then
-                    boot_sweep_paths+=("$extra")
-                fi
-            done
-            /usr/local/bin/fix-ownership \
-                "${PUID:-1000}" "${PGID:-1000}" "${boot_sweep_paths[@]}"
-        fi
-    fi
-fi
-
-# Must stay after the sweep, which reads an absent /media/frigate as an
-# unmounted volume rather than a swept one
-if [[ "$(id -u)" -eq 0 && ! -d /media/frigate ]]; then
-    # The image does not ship this directory, so on a read-only rootfs it can
-    # only come from a mount. Report that rather than failing under errexit.
-    if ! mkdir -p /media/frigate 2>/dev/null; then
-        echo "[ERROR] /media/frigate does not exist and could not be created, which is what happens with read_only: true and no recordings volume." >&2
-        echo "[ERROR] Mount a volume at /media/frigate." >&2
-        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
-        exit 1
-    fi
-    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-        chown "${PUID:-1000}:${PGID:-1000}" /media/frigate
-    fi
-fi
-
-# usually a tmpfs mount: root-owned on arrival and outside the swept volumes
-if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-    mkdir -p /tmp/cache
-    chown "${PUID:-1000}:${PGID:-1000}" /tmp/cache
-fi
@@ -1,194 +0,0 @@
-#!/bin/bash
-# Single source of truth for aligning volume ownership with the runtime user.
-#
-# Usage: fix-ownership [--dry-run] [--sentinel FILE] [--mode STRING] UID GID PATH [PATH...]
-#
-#   --dry-run    report what would change, touch nothing
-#   --sentinel   skip entirely when FILE already records "SCHEMA:UID:GID";
-#                write it after a successful run (used by the boot path so
-#                multi-TB volumes are swept once per UID/schema change, not
-#                on every boot)
-#   --mode       append STRING to the sentinel, so changing it re-sweeps once
-#
-# Only files whose uid OR gid differs are touched, so re-runs are cheap.
-# lost+found is skipped: fsck fills it with root-only recovered fragments.
-# Top-level /config additionally grants group frigate-data TRAVERSE ONLY
-# (g+rx) so the separate go2rtc user can reach its pre-created HomeKit file
-# on hosts where /config is mounted 0700. Never g+w: directory write means
-# unlink rights over frigate.db/config.yml, and would let a compromised
-# go2rtc plant /config/go2rtc, which the go2rtc run script executes
-# preferentially, as root under the escape hatch.
-
-set -o errexit -o nounset -o pipefail
-
-# Permissions-layout epoch. Bump to force a one-time re-sweep on upgrade
-# (e.g. when the privilege-drop release must capture files created as root
-# since the previous sweep).
-schema=2
-
-dry_run=0
-sentinel=""
-mode=""
-
-while [[ "${1:-}" == --* ]]; do
-    case "$1" in
-        --dry-run) dry_run=1; shift ;;
-        --sentinel)
-            if [[ -z "${2:-}" ]]; then
-                echo "[ERROR] fix-ownership: --sentinel requires a file argument" >&2
-                exit 2
-            fi
-            sentinel="$2"; shift 2 ;;
-        --mode)
-            if [[ -z "${2:-}" ]]; then
-                echo "[ERROR] fix-ownership: --mode requires a value" >&2
-                exit 2
-            fi
-            mode="$2"; shift 2 ;;
-        *) echo "[ERROR] fix-ownership: unknown option $1" >&2; exit 2 ;;
-    esac
-done
-
-if [[ $# -lt 3 ]]; then
-    echo "Usage: fix-ownership [--dry-run] [--sentinel FILE] [--mode STRING] UID GID PATH..." >&2
-    exit 2
-fi
-
-target_uid="$1"
-target_gid="$2"
-shift 2
-
-if [[ "$(id -u)" -ne 0 ]]; then
-    echo "[INFO] fix-ownership: not running as root, skipping (ownership is managed by the host in --user mode)"
-    exit 0
-fi
-
-# The list folds into the sentinel so entering or leaving a granular root mode
-# re-sweeps once, catching whatever the other ownership mechanisms missed.
-sentinel_content="${schema}:${target_uid}:${target_gid}"
-if [[ -n "$mode" ]]; then
-    sentinel_content="${sentinel_content}:${mode}"
-fi
-
-# safe-sentinel reports only a root-owned regular file, so a forged or
-# symlinked sentinel in the runtime-user-owned /config can't suppress the sweep
-if [[ "$dry_run" -eq 0 && -n "$sentinel" ]]; then
-    if existing=$(/usr/local/bin/safe-sentinel read "$sentinel" 2>/dev/null) && \
-        [[ "$existing" == "$sentinel_content" ]]; then
-        echo "[INFO] fix-ownership: ${target_uid}:${target_gid} (schema ${schema}) already applied, skipping"
-        exit 0
-    fi
-fi
-
-# A sweep that could not chown everything must not be recorded as complete:
-# the sentinel would make every later boot skip it and the entries would stay
-# unreachable once services run unprivileged.
-swept_clean=1
-
-# Entries another mechanism deliberately owns. Chowning them undoes that work
-# and leaves the same "mismatch" waiting for the next boot, so /config could
-# never report itself clean: /config is chgrp'd to frigate-data below so go2rtc
-# can traverse it, and the HomeKit file is handed to the go2rtc user by the
-# go2rtc service. Only the GROUP on /config is exempt; a root-owned /config
-# must still be chowned or the runtime user cannot write there at all.
-# Shared by the counting and the chowning walk so the two cannot disagree.
-mismatch_expr=(
-    "(" -not -uid "$target_uid"
-        -o "(" -not -gid "$target_gid" -a ! -path /config ")"
-    ")"
-    -a ! -path /config/go2rtc_homekit.yml
-)
-if [[ -n "$sentinel" ]]; then
-    # safe-sentinel keeps the sentinel root-owned on purpose and rejects one
-    # owned by anybody else, so chowning it here would suppress the skip and
-    # make every boot re-sweep. Only the trailing write puts it back today.
-    mismatch_expr+=(-a ! -path "$sentinel")
-fi
-
-for path in "$@"; do
-    # An absent root is an incomplete sweep, not a finished one: /media/frigate
-    # is not in the image, so a boot before the volume is mounted would
-    # otherwise record success and the volume would never be swept once added.
-    if [[ ! -d "$path" ]]; then
-        swept_clean=0
-        echo "[WARN] fix-ownership: $path does not exist, skipping; will retry on next boot"
-        continue
-    fi
-
-    echo "[INFO] fix-ownership: scanning ${path} for ownership mismatches; this may take a while on large filesystems"
-
-    # find may fail mid-walk on a live volume (file deleted under it) or on a
-    # stale mount. Tolerate it rather than aborting under errexit, but never
-    # read a failed scan as "nothing to do": that would record the sweep as
-    # complete without having looked.
-    if ! count=$(find "$path" -name lost+found -prune -o "${mismatch_expr[@]}" -printf '.' 2>/dev/null | wc -c); then
-        swept_clean=0
-        echo "[WARN] fix-ownership: could not scan ${path}; will retry on next boot"
-        continue
-    fi
-
-    if [[ "$count" -eq 0 ]]; then
-        echo "[INFO] fix-ownership: $path already owned by ${target_uid}:${target_gid}, nothing to do"
-        continue
-    fi
-
-    # find does not descend symlinks and chown -h retargets the link itself, so
-    # anything behind a symlinked directory is outside this sweep. Following
-    # them is not an option: a link could walk the chown out of the volume.
-    if [[ -n "$(find "$path" -type l -xtype d -print -quit 2>/dev/null)" ]]; then
-        echo "[WARN] fix-ownership: ${path} contains symlinked directories; ownership behind them is not managed and must be aligned by hand"
-    fi
-
-    echo "[WARN] fix-ownership: adjusting ownership of ${count} entries under ${path}"
-    if [[ "$dry_run" -eq 1 ]]; then
-        echo "[INFO] fix-ownership: dry run, not changing ${path}"
-        continue
-    fi
-
-    # -execdir chowns from the entry's own directory, so a parent swapped for a
-    # symlink mid-walk can't redirect the chown out of the volume
-    started=$SECONDS
-    if find "$path" -name lost+found -prune -o "${mismatch_expr[@]}" \
-        -print -execdir chown -h "${target_uid}:${target_gid}" {} + \
-        | awk -v total="$count" -v path="$path" '
-            BEGIN { next_pct = 5 }
-            {
-                pct = int(NR * 100 / total)
-                if (pct > 100) pct = 100
-                if (pct >= next_pct) {
-                    printf "[INFO] fix-ownership: %s %d%% (%d/%d entries)\n", path, pct, NR, total
-                    # mawk block-buffers to a pipe; without fflush the whole
-                    # progress log arrives at once
-                    fflush()
-                    while (next_pct <= pct) next_pct += 5
-                }
-            }'; then
-        elapsed=$((SECONDS - started))
-        if [[ "$elapsed" -ge 60 ]]; then
-            elapsed="$((elapsed / 60))m $((elapsed % 60))s"
-        else
-            elapsed="${elapsed}s"
-        fi
-        echo "[INFO] fix-ownership: finished ${path} in ${elapsed}"
-    else
-        swept_clean=0
-        echo "[WARN] fix-ownership: some entries under ${path} could not be updated (deleted mid-sweep or chown denied); will retry on next mismatch"
-    fi
-done
-
-# go2rtc (separate user) must be able to REACH its HomeKit state in /config.
-# Write access is per-file, not per-directory: go2rtc's PatchConfig rewrites
-# the first -config file via os.WriteFile (in-place truncate, no rename,
-# verified against go2rtc v1.9.14 internal/app/config.go), and the file is
-# always pre-created by setup_homekit_config before go2rtc starts, so
-# O_CREATE never needs directory write. See header comment for why g+w is
-# forbidden here.
-if [[ "$dry_run" -eq 0 && -d /config ]]; then
-    chgrp frigate-data /config 2>/dev/null || true
-    chmod g+rx /config 2>/dev/null || true
-fi
-
-if [[ "$dry_run" -eq 0 && -n "$sentinel" && "$swept_clean" -eq 1 ]]; then
-    /usr/local/bin/safe-sentinel write "$sentinel" "$sentinel_content" || \
-        echo "[WARN] fix-ownership: could not write ${sentinel}; the sweep will run again on next boot"
-fi
@@ -1,74 +0,0 @@
-#!/usr/bin/env python3
-"""Read or write the ownership sweep sentinel without following symlinks.
-
-The sentinel lives in /config, which the unprivileged runtime user owns, so it
-can be swapped for a symlink. read trusts only a root-owned regular file; write
-never follows a symlink or fifo onto another file.
-
-Usage:
-  safe-sentinel read PATH            print content, exit 0 only if root-owned regular file
-  safe-sentinel write PATH CONTENT   write CONTENT to a regular file at PATH
-"""
-
-import errno
-import os
-import stat
-import sys
-
-MODE = 0o644
-
-
-def do_read(path: str) -> int:
-    try:
-        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
-    except OSError:
-        return 1
-    try:
-        st = os.fstat(fd)
-        if not stat.S_ISREG(st.st_mode) or st.st_uid != 0:
-            return 1
-        sys.stdout.buffer.write(os.read(fd, 4096))
-    finally:
-        os.close(fd)
-    return 0
-
-
-def do_write(path: str, content: str) -> int:
-    # O_NONBLOCK so a fifo fails fast (ENXIO) instead of blocking the open.
-    flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK
-    replace = (errno.ELOOP, errno.ENXIO)
-    try:
-        fd = os.open(path, flags, MODE)
-        if not stat.S_ISREG(os.fstat(fd).st_mode):
-            os.close(fd)
-            raise OSError(errno.ELOOP, "not a regular file")
-    except OSError as err:
-        if err.errno not in replace:
-            raise
-        os.unlink(path)
-        fd = os.open(path, flags | os.O_EXCL, MODE)
-    try:
-        os.ftruncate(fd, 0)
-        os.write(fd, content.encode())
-        # keep it root-owned so a later sweep that chowned the old sentinel to
-        # the runtime user can't make the next read reject and re-sweep
-        os.fchown(fd, 0, 0)
-    finally:
-        os.close(fd)
-    return 0
-
-
-def main(argv: list[str]) -> int:
-    if len(argv) == 3 and argv[1] == "read":
-        return do_read(argv[2])
-    if len(argv) == 4 and argv[1] == "write":
-        try:
-            return do_write(argv[2], argv[3])
-        except OSError:
-            return 1
-    print("usage: safe-sentinel read PATH | write PATH CONTENT", file=sys.stderr)
-    return 2
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv))
@@ -1,18 +0,0 @@
-#!/bin/bash
-# Exit 0 when FRIGATE_ROOT_SERVICES names the given service. Membership only:
-# the euid and FRIGATE_RUN_AS_ROOT checks stay in the callers.
-#
-# Usage: service-runs-as-root SERVICE
-
-set -o nounset
-
-service="${1:?usage: service-runs-as-root SERVICE}"
-
-IFS=',' read -ra entries <<< "${FRIGATE_ROOT_SERVICES:-}"
-for entry in "${entries[@]}"; do
-    entry="${entry//[[:space:]]/}"
-    if [[ "$entry" == "$service" ]]; then
-        exit 0
-    fi
-done
-exit 1
@@ -5,7 +5,11 @@ from typing import Any
 from ruamel.yaml import YAML

 sys.path.insert(0, "/opt/frigate")
-from frigate.util.config import find_config_file, resolve_ffmpeg_path
+from frigate.const import (
+    DEFAULT_FFMPEG_VERSION,
+    INCLUDED_FFMPEG_VERSIONS,
+)
+from frigate.util.config import find_config_file

 sys.path.remove("/opt/frigate")

@@ -25,4 +29,9 @@ except FileNotFoundError:
    config: dict[str, Any] = {}

 path = config.get("ffmpeg", {}).get("path", "default")
-print(resolve_ffmpeg_path(path, "ffmpeg"))
+if path == "default":
+    print(f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg")
+elif path in INCLUDED_FFMPEG_VERSIONS:
+    print(f"/usr/lib/ffmpeg/{path}/bin/ffmpeg")
+else:
+    print(f"{path}/bin/ffmpeg")
@@ -3,18 +3,20 @@
 import json
 import os
 import sys
+from pathlib import Path
 from typing import Any

 from ruamel.yaml import YAML

 sys.path.insert(0, "/opt/frigate")
-from frigate.config.env import apply_config_env_vars, substitute_frigate_vars
 from frigate.const import (
    BIRDSEYE_PIPE,
+    DEFAULT_FFMPEG_VERSION,
+    INCLUDED_FFMPEG_VERSIONS,
    LIBAVFORMAT_VERSION_MAJOR,
 )
 from frigate.ffmpeg_presets import parse_preset_hardware_acceleration_encode
-from frigate.util.config import find_config_file, resolve_ffmpeg_path
+from frigate.util.config import find_config_file
 from frigate.util.services import (
    is_go2rtc_arbitrary_exec_allowed,
    is_restricted_go2rtc_source,
@@ -24,6 +26,15 @@ sys.path.remove("/opt/frigate")

 yaml = YAML()

+FRIGATE_ENV_VARS = {k: v for k, v in os.environ.items() if k.startswith("FRIGATE_")}
+# read docker secret files as env vars too
+if os.path.isdir("/run/secrets"):
+    for secret_file in os.listdir("/run/secrets"):
+        if secret_file.startswith("FRIGATE_"):
+            FRIGATE_ENV_VARS[secret_file] = (
+                Path(os.path.join("/run/secrets", secret_file)).read_text().strip()
+            )
+
 config_file = find_config_file()

 try:
@@ -37,20 +48,6 @@ try:
 except FileNotFoundError:
    config: dict[str, Any] = {}

-# No validator runs here, so install environment_vars ourselves. FRIGATE_
-# names only: anything else lands in os.environ, where the exec gate reads
-# GO2RTC_ALLOW_ARBITRARY_EXEC.
-config_env_vars = config.get("environment_vars")
-apply_config_env_vars(
-    {
-        key: value
-        for key, value in config_env_vars.items()
-        if str(key).startswith("FRIGATE_")
-    }
-    if isinstance(config_env_vars, dict)
-    else {}
-)
-
 go2rtc_config: dict[str, Any] = config.get("go2rtc", {})

 # Need to enable CORS for go2rtc so the frigate integration / card work automatically
@@ -85,18 +82,23 @@ if go2rtc_config["webrtc"].get("candidates") is None:
    go2rtc_config["webrtc"]["candidates"] = default_candidates

 if go2rtc_config.get("rtsp", {}).get("username") is not None:
-    go2rtc_config["rtsp"]["username"] = substitute_frigate_vars(
-        go2rtc_config["rtsp"]["username"]
+    go2rtc_config["rtsp"]["username"] = go2rtc_config["rtsp"]["username"].format(
+        **FRIGATE_ENV_VARS
    )

 if go2rtc_config.get("rtsp", {}).get("password") is not None:
-    go2rtc_config["rtsp"]["password"] = substitute_frigate_vars(
-        go2rtc_config["rtsp"]["password"]
+    go2rtc_config["rtsp"]["password"] = go2rtc_config["rtsp"]["password"].format(
+        **FRIGATE_ENV_VARS
    )

 # ensure ffmpeg path is set correctly
 path = config.get("ffmpeg", {}).get("path", "default")
-ffmpeg_path = resolve_ffmpeg_path(path, "ffmpeg")
+if path == "default":
+    ffmpeg_path = f"/usr/lib/ffmpeg/{DEFAULT_FFMPEG_VERSION}/bin/ffmpeg"
+elif path in INCLUDED_FFMPEG_VERSIONS:
+    ffmpeg_path = f"/usr/lib/ffmpeg/{path}/bin/ffmpeg"
+else:
+    ffmpeg_path = f"{path}/bin/ffmpeg"

 if go2rtc_config.get("ffmpeg") is None:
    go2rtc_config["ffmpeg"] = {"bin": ffmpeg_path}
@@ -117,7 +119,7 @@ for name in list(go2rtc_config.get("streams", {})):

    if isinstance(stream, str):
        try:
-            formatted_stream = substitute_frigate_vars(stream)
+            formatted_stream = stream.format(**FRIGATE_ENV_VARS)
            if is_restricted_go2rtc_source(formatted_stream):
                print(
                    f"[ERROR] Stream '{name}' uses a restricted source (echo/expr/exec) which is disabled by default for security. "
@@ -126,7 +128,7 @@ for name in list(go2rtc_config.get("streams", {})):
                del go2rtc_config["streams"][name]
                continue
            go2rtc_config["streams"][name] = formatted_stream
-        except ValueError as e:
+        except KeyError as e:
            print(
                "[ERROR] Invalid substitution found, see https://docs.frigate.video/configuration/restream#advanced-restream-configurations for more info."
            )
@@ -136,7 +138,7 @@ for name in list(go2rtc_config.get("streams", {})):
        filtered_streams = []
        for i, stream_item in enumerate(stream):
            try:
-                formatted_stream = substitute_frigate_vars(stream_item)
+                formatted_stream = stream_item.format(**FRIGATE_ENV_VARS)
                if is_restricted_go2rtc_source(formatted_stream):
                    print(
                        f"[ERROR] Stream '{name}' item {i + 1} uses a restricted source (echo/expr/exec) which is disabled by default for security. "
@@ -145,7 +147,7 @@ for name in list(go2rtc_config.get("streams", {})):
                    continue

                filtered_streams.append(formatted_stream)
-            except ValueError as e:
+            except KeyError as e:
                print(
                    "[ERROR] Invalid substitution found, see https://docs.frigate.video/configuration/restream#advanced-restream-configurations for more info."
                )
@@ -189,6 +191,3 @@ if config.get("birdseye", {}).get("restream", False):
 # Write go2rtc_config to /dev/shm/go2rtc.yaml
 with open("/dev/shm/go2rtc.yaml", "w") as f:
    yaml.dump(go2rtc_config, f)
-
-# config contains camera credentials; do not leave it world-readable
-os.chmod("/dev/shm/go2rtc.yaml", 0o640)
@@ -1,107 +0,0 @@
-"""Normalize the go2rtc HomeKit file and hand it to go2rtc, as root.
-
-Runs before the drop. The file is in the runtime-user-owned /config, so a
-planted symlink could redirect the root write or chown onto another file;
-every operation goes through an O_NOFOLLOW fd to prevent that.
-
-Usage: prepare_homekit.py PATH [--chown]
-"""
-
-import errno
-import grp
-import io
-import os
-import pwd
-import stat
-import sys
-
-from ruamel.yaml import YAML
-
-RUNTIME_OWNER = "go2rtc"
-SHARED_GROUP = "frigate-data"
-MODE = 0o664
-MAX_BYTES = 10 * 1024 * 1024
-
-
-def open_nofollow(path: str) -> int:
-    """Return an fd to a regular file at path, never following a symlink."""
-    flags = os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW
-    try:
-        fd = os.open(path, flags, MODE)
-    except OSError as err:
-        if err.errno != errno.ELOOP:
-            raise
-        os.unlink(path)
-        return os.open(path, flags | os.O_EXCL, MODE)
-
-    # A fifo or other non-regular file would hang or misbehave on read; replace it.
-    if not stat.S_ISREG(os.fstat(fd).st_mode):
-        os.close(fd)
-        os.unlink(path)
-        return os.open(path, flags | os.O_EXCL, MODE)
-    return fd
-
-
-def normalize(content: str) -> str:
-    """Keep only the homekit section, matching the previous yq/jq behavior."""
-    yaml = YAML(typ="safe")
-    try:
-        data = yaml.load(content)
-    except Exception:
-        return ""
-
-    if not isinstance(data, dict) or "homekit" not in data:
-        return ""
-
-    buf = io.StringIO()
-    yaml.dump({"homekit": data["homekit"]}, buf)
-    return buf.getvalue()
-
-
-def main() -> int:
-    if len(sys.argv) < 2:
-        print("[ERROR] prepare_homekit: PATH is required", file=sys.stderr)
-        return 2
-
-    path = sys.argv[1]
-    do_chown = "--chown" in sys.argv[2:]
-
-    try:
-        fd = open_nofollow(path)
-    except PermissionError:
-        print(
-            f"[WARN] {path} is not writable by uid {os.geteuid()}, so HomeKit "
-            "pairing changes will not persist. It is owned by the go2rtc user "
-            "from an earlier run in the default mode. To fix, on the host run: "
-            f"chown {os.geteuid()}:{os.getegid()} <your config dir>/{os.path.basename(path)}"
-        )
-        return 0
-
-    try:
-        content = os.read(fd, MAX_BYTES).decode("utf-8", "replace")
-        normalized = normalize(content)
-        os.ftruncate(fd, 0)
-        os.lseek(fd, 0, os.SEEK_SET)
-        os.write(fd, normalized.encode("utf-8"))
-
-        if do_chown:
-            # tolerate a chown-refusing mount (NFS root_squash): pairing
-            # persistence degrades, the service does not
-            try:
-                uid = pwd.getpwnam(RUNTIME_OWNER).pw_uid
-                gid = grp.getgrnam(SHARED_GROUP).gr_gid
-                os.fchown(fd, uid, gid)
-                os.fchmod(fd, MODE)
-            except (KeyError, OSError):
-                print(
-                    f"[WARN] Could not hand {path} to the go2rtc user; "
-                    "HomeKit pairing changes may not persist"
-                )
-    finally:
-        os.close(fd)
-
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
@@ -1,13 +1,9 @@
-# Loaded with -c from the /tmp/nginx/conf copy: relative includes follow the -c
-# file, all other path directives follow --prefix and must stay absolute.
-
 daemon off;
-# ignored by a non-root master; keeps workers root under FRIGATE_RUN_AS_ROOT
 user root;
 worker_processes auto;

 error_log /dev/stdout warn;
-pid /tmp/nginx/nginx.pid;
+pid /var/run/nginx.pid;

 events {
    worker_connections 1024;
@@ -15,13 +11,6 @@ events {

 http {
    map_hash_bucket_size 256;
-    server_tokens off;
-
-    client_body_temp_path /tmp/nginx/client_body;
-    proxy_temp_path /tmp/nginx/proxy;
-    fastcgi_temp_path /tmp/nginx/fastcgi;
-    uwsgi_temp_path /tmp/nginx/uwsgi;
-    scgi_temp_path /tmp/nginx/scgi;

    include mime.types;
    default_type application/octet-stream;
@@ -73,10 +62,6 @@ http {

    server {
        include listen.conf;
-        include security_headers.conf;
-
-        # enable HTTP/2 for TLS connections to eliminate browser 6-connection limit
-        http2 on;

        # vod settings
        vod_base_url '';
@@ -87,12 +72,6 @@ http {
        vod_align_segments_to_key_frames on;
        vod_manifest_segment_durations_mode accurate;
        vod_ignore_edit_list on;
-        # short leading segments at each playlist start; sources start at
-        # the seek target, so the ladder applies to every seek. Only
-        # effective when clips declare real keyFrameDurations
-        vod_bootstrap_segment_durations 1000;
-        vod_bootstrap_segment_durations 2000;
-        vod_bootstrap_segment_durations 4000;
        vod_segment_duration 10000;

        # MPEG-TS settings (not used when fMP4 is enabled, kept for reference)
@@ -132,23 +111,25 @@ http {
            # Smaller segments, faster generation, better browser compatibility
            vod_hls_container_format fmp4;

-            # fMP4 playlists use EXT-X-MAP, which requires HLS protocol
-            # version 6 (RFC 8216 section 7); the module default is 4
-            vod_hls_version 6;
-
            secure_token $args;
            secure_token_types application/vnd.apple.mpegurl;

-            include security_headers.conf;
            add_header Cache-Control "no-store";
            expires off;

            keepalive_disable safari;
+
+            # vod module returns 502 for non-existent media
+            # https://github.com/kaltura/nginx-vod-module/issues/468
+            error_page 502 =404 /vod-not-found;
+        }
+
+        location = /vod-not-found {
+            return 404;
        }

        location /stream/ {
            include auth_request.conf;
-            include security_headers.conf;
            add_header Cache-Control "no-store";
            expires off;

@@ -170,7 +151,6 @@ http {
            }

            expires 7d;
-            include security_headers.conf;
            add_header Cache-Control "public";
            autoindex on;
            root /media/frigate;
@@ -244,6 +224,16 @@ http {
            include proxy.conf;
        }

+        # frontend uses this to fetch the version
+        location /api/go2rtc/api {
+            include auth_request.conf;
+            limit_except GET {
+                deny  all;
+            }
+            proxy_pass http://go2rtc/api;
+            include proxy.conf;
+        }
+
        # integration uses this to add webrtc candidate
        location /api/go2rtc/webrtc {
            include auth_request.conf;
@@ -263,7 +253,6 @@ http {

        location /api/ {
            include auth_request.conf;
-            include security_headers.conf;
            add_header Cache-Control "no-store";
            expires off;
            proxy_pass http://frigate_api/;
@@ -292,13 +281,6 @@ http {
                include proxy.conf;
            }

-            location /api/logout {
-                auth_request off;
-                rewrite ^/api(/.*)$ $1 break;
-                proxy_pass http://frigate_api;
-                include proxy.conf;
-            }
-
            # Allow unauthenticated access to the first_time_login endpoint
            # so the login page can load help text before authentication.
            location /api/auth/first_time_login {
@@ -330,34 +312,29 @@ http {

        location / {
            # do not require auth for static assets
-            include security_headers.conf;
            add_header Cache-Control "no-store";
            expires off;

            location /assets/ {
                access_log off;
                expires 1y;
-                include security_headers.conf;
                add_header Cache-Control "public";
            }

            location /fonts/ {
                access_log off;
                expires 1y;
-                include security_headers.conf;
                add_header Cache-Control "public";
            }

            location /locales/ {
                access_log off;
-                include security_headers.conf;
                add_header Cache-Control "public";
            }

            location ~ ^/.*-([A-Za-z0-9]+)\.webmanifest$ {
                access_log off;
                expires 1y;
-                include security_headers.conf;
                add_header Cache-Control "public";
                default_type application/json;
                proxy_set_header Accept-Encoding "";
@@ -1,5 +0,0 @@
-# Deliberately no X-Frame-Options or CSP frame-ancestors: HA's Webpage card and
-# iframe panels frame Frigate cross-origin, and either would break them
-# silently. Bind-mount this file to add your own.
-add_header X-Content-Type-Options "nosniff" always;
-add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -0,0 +1,11 @@
+"""Prints the base path as json to stdout."""
+
+import json
+import os
+from typing import Any
+
+base_path = os.environ.get("FRIGATE_BASE_PATH", "")
+
+result: dict[str, Any] = {"base_path": base_path}
+
+print(json.dumps(result))
@@ -0,0 +1,35 @@
+"""Prints the tls config as json to stdout."""
+
+import json
+import sys
+from typing import Any
+
+from ruamel.yaml import YAML
+
+sys.path.insert(0, "/opt/frigate")
+from frigate.util.config import find_config_file
+
+sys.path.remove("/opt/frigate")
+
+yaml = YAML()
+
+config_file = find_config_file()
+
+try:
+    with open(config_file) as f:
+        raw_config = f.read()
+
+    if config_file.endswith((".yaml", ".yml")):
+        config: dict[str, Any] = yaml.load(raw_config)
+    elif config_file.endswith(".json"):
+        config: dict[str, Any] = json.loads(raw_config)
+except FileNotFoundError:
+    config: dict[str, Any] = {}
+
+tls_config: dict[str, any] = config.get("tls", {"enabled": True})
+networking_config = config.get("networking", {})
+ipv6_config = networking_config.get("ipv6", {"enabled": False})
+
+output = {"tls": tls_config, "ipv6": ipv6_config}
+
+print(json.dumps(output))
@@ -1,62 +0,0 @@
-"""Prints the nginx settings as json to stdout."""
-
-import json
-import os
-import sys
-from typing import Any
-
-from ruamel.yaml import YAML
-
-sys.path.insert(0, "/opt/frigate")
-from frigate.util.config import find_config_file
-
-sys.path.remove("/opt/frigate")
-
-yaml = YAML()
-
-config_file = find_config_file()
-
-try:
-    with open(config_file) as f:
-        raw_config = f.read()
-
-    if config_file.endswith((".yaml", ".yml")):
-        config: dict[str, Any] = yaml.load(raw_config)
-    elif config_file.endswith(".json"):
-        config: dict[str, Any] = json.loads(raw_config)
-except FileNotFoundError:
-    config: dict[str, Any] = {}
-
-tls_config: dict[str, Any] = config.get("tls", {})
-tls_config.setdefault("enabled", True)
-
-networking_config: dict[str, Any] = config.get("networking", {})
-ipv6_config: dict[str, Any] = networking_config.get("ipv6", {})
-ipv6_config.setdefault("enabled", False)
-
-listen_config: dict[str, Any] = networking_config.get("listen", {})
-listen_config.setdefault("internal", 5000)
-listen_config.setdefault("external", 8971)
-
-# handle case where internal port is a string with ip:port
-internal_port = listen_config["internal"]
-if type(internal_port) is str:
-    internal_port = int(internal_port.split(":")[-1])
-listen_config["internal_port"] = internal_port
-
-# handle case where external port is a string with ip:port
-external_port = listen_config["external"]
-if type(external_port) is str:
-    external_port = int(external_port.split(":")[-1])
-listen_config["external_port"] = external_port
-
-base_path = os.environ.get("FRIGATE_BASE_PATH", "")
-
-result: dict[str, Any] = {
-    "tls": tls_config,
-    "ipv6": ipv6_config,
-    "listen": listen_config,
-    "base_path": base_path,
-}
-
-print(json.dumps(result))
@@ -7,7 +7,7 @@ location ^~ {{ .base_path }}/ {
    # remove base_url from the path before passing upstream
    rewrite ^{{ .base_path }}/(.*) /$1 break;

-    proxy_pass $scheme://127.0.0.1:{{ .listen.external_port }};
+    proxy_pass $scheme://127.0.0.1:8971;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
@@ -1,36 +1,45 @@
+
 # Internal (IPv4 always; IPv6 optional)
-listen {{ .listen.internal }};
-{{ if .ipv6.enabled }}listen [::]:{{ .listen.internal_port }};{{ end }}
+listen 5000;
+{{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:5000;{{ end }}{{ end }}
+

 # intended for external traffic, protected by auth
-{{ if .tls.enabled }}
-    # external HTTPS (IPv4 always; IPv6 optional)
-    listen {{ .listen.external }} ssl;
-    {{ if .ipv6.enabled }}listen [::]:{{ .listen.external_port }} ssl;{{ end }}
+{{ if .tls }}
+    {{ if .tls.enabled }}
+        # external HTTPS (IPv4 always; IPv6 optional)
+        listen 8971 ssl;
+        {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971 ssl;{{ end }}{{ end }}

-    ssl_certificate {{ .tls.cert_path }}/fullchain.pem;
-    ssl_certificate_key {{ .tls.cert_path }}/privkey.pem;
+        ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;

-    # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
-    # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
-    ssl_session_tickets off;
+        # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
+        # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+        ssl_session_tickets off;

-    # modern configuration
-    ssl_protocols TLSv1.3;
-    ssl_prefer_server_ciphers off;
+        # modern configuration
+        ssl_protocols TLSv1.3;
+        ssl_prefer_server_ciphers off;

-    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
-    add_header Strict-Transport-Security "max-age=63072000" always;
+        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+        add_header Strict-Transport-Security "max-age=63072000" always;

-    # ACME challenge location
-    location /.well-known/acme-challenge/ {
-            default_type "text/plain";
-            root /etc/letsencrypt/www;
-    }
+        # ACME challenge location
+        location /.well-known/acme-challenge/ {
+                default_type "text/plain";
+                root /etc/letsencrypt/www;
+        }
+    {{ else }}
+        # external HTTP (IPv4 always; IPv6 optional)
+        listen 8971;
+        {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
+    {{ end }}
 {{ else }}
-    # (No tls) default to HTTP (IPv4 always; IPv6 optional)
-    listen {{ .listen.external }};
-    {{ if .ipv6.enabled }}listen [::]:{{ .listen.external_port }};{{ end }}
+    # (No tls section) default to HTTP (IPv4 always; IPv6 optional)
+    listen 8971;
+    {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
 {{ end }}
+
@@ -1,55 +0,0 @@
-#!/bin/bash
-# Ahead-of-time volume ownership migration for switching Frigate to non-root.
-# Run from the host BEFORE enabling PUID/PGID or --user:
-#
-#   ./fix-permissions.sh [--dry-run] <config_dir> <media_dir> [PUID] [PGID]
-#
-# Wraps the image's fix-ownership helper so there is exactly one
-# implementation of the chown logic. Requires an image that contains the
-# helper (any release that includes non-root support).
-
-set -o errexit -o nounset -o pipefail
-
-IMAGE="${FRIGATE_IMAGE:-ghcr.io/blakeblackshear/frigate:stable}"
-
-dry_run_flag=""
-if [[ "${1:-}" == "--dry-run" ]]; then
-    dry_run_flag="--dry-run"
-    shift
-fi
-
-if [[ $# -lt 2 ]]; then
-    echo "Usage: $0 [--dry-run] <config_dir> <media_dir> [PUID] [PGID]" >&2
-    exit 2
-fi
-
-config_dir="$1"
-media_dir="$2"
-puid="${3:-1000}"
-pgid="${4:-1000}"
-
-# The ids are interpolated into the container's bash -c source below, so
-# anything but digits would be reparsed as shell rather than passed through
-if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
-    echo "[ERROR] PUID and PGID must be numeric, got '${puid}' and '${pgid}'" >&2
-    exit 2
-fi
-
-echo "[INFO] Using image ${IMAGE} (override with FRIGATE_IMAGE=...)"
-if ! docker image inspect "${IMAGE}" >/dev/null 2>&1; then
-    echo "[INFO] ${IMAGE} is not present locally and has to be pulled first; this may take a while"
-fi
-
-if [[ -n "$dry_run_flag" ]]; then
-    echo "[INFO] Dry run: reporting what would change under ${config_dir} and ${media_dir}, changing nothing"
-else
-    echo "[INFO] Aligning ${config_dir} and ${media_dir} to ${puid}:${pgid}; this may take a while on large filesystems"
-fi
-
-# shellcheck disable=SC2086
-docker run --rm \
-    -v "${config_dir}:/config" \
-    -v "${media_dir}:/media/frigate" \
-    --entrypoint bash \
-    "${IMAGE}" \
-    -c "command -v fix-ownership >/dev/null || { echo '[ERROR] this Frigate image predates non-root support; set FRIGATE_IMAGE to a release that includes it' >&2; exit 1; }; exec fix-ownership ${dry_run_flag} ${puid} ${pgid} /config /media/frigate"
@@ -11,10 +11,10 @@ except FileNotFoundError:
    pass

 try:
-    with open("/config/conv2rknn.yaml") as config_file:
+    with open("/config/conv2rknn.yaml", "r") as config_file:
        configuration = yaml.safe_load(config_file)
 except FileNotFoundError:
-    raise Exception("Please place a config file at /config/conv2rknn.yaml") from None
+    raise Exception("Please place a config file at /config/conv2rknn.yaml")

 if configuration["config"] != None:
    rknn_config = configuration["config"]
@@ -31,7 +31,7 @@ if "soc" not in configuration:
        with open("/proc/device-tree/compatible") as file:
            soc = file.read().split(",")[-1].strip("\x00")
    except FileNotFoundError:
-        raise Exception("Make sure to run docker in privileged mode.") from None
+        raise Exception("Make sure to run docker in privileged mode.")

    configuration["soc"] = [
        soc,
@@ -13,7 +13,7 @@ ARG ROCM

 RUN apt update -qq && \
    apt install -y wget gpg && \
-    wget -O rocm.deb https://repo.radeon.com/amdgpu-install/7.2.3/ubuntu/jammy/amdgpu-install_7.2.3.70203-1_all.deb && \
+    wget -O rocm.deb https://repo.radeon.com/amdgpu-install/7.1.1/ubuntu/jammy/amdgpu-install_7.1.1.70101-1_all.deb && \
    apt install -y ./rocm.deb && \
    apt update && \
    apt install -qq -y rocm
@@ -32,14 +32,11 @@ RUN echo /opt/rocm/lib|tee /opt/rocm-dist/etc/ld.so.conf.d/rocm.conf
 FROM deps AS deps-prelim

 COPY docker/rocm/debian-backports.sources /etc/apt/sources.list.d/debian-backports.sources
-# install_deps.sh upgraded libstdc++6 from trixie for Battlemage; the matching
-# -dev package must also come from trixie or apt refuses to satisfy it.
-RUN echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/trixie.list && \
-    apt-get update && \
+RUN apt-get update && \
    apt-get install -y libnuma1 && \
    apt-get install -qq -y -t bookworm-backports mesa-va-drivers mesa-vulkan-drivers && \
-    apt-get install -qq -y -t trixie libstdc++-14-dev && \
-    rm -f /etc/apt/sources.list.d/trixie.list && \
+    # Install C++ standard library headers for HIPRTC kernel compilation fallback
+    apt-get install -qq -y libstdc++-12-dev && \
    rm -rf /var/lib/apt/lists/*

 WORKDIR /opt/frigate
@@ -59,17 +56,13 @@ FROM scratch AS rocm-dist

 ARG ROCM

-# Copy HIP headers required for MIOpen JIT (BuildHip) / HIPRTC at runtime
-COPY --from=rocm /opt/rocm-${ROCM}/include/ /opt/rocm-${ROCM}/include/
 COPY --from=rocm /opt/rocm-$ROCM/bin/rocminfo /opt/rocm-$ROCM/bin/migraphx-driver /opt/rocm-$ROCM/bin/
-# Copy MIOpen database files for gfx10xx, gfx11xx, and gfx12xx only (RDNA2/RDNA3/RDNA4)
+# Copy MIOpen database files for gfx10xx and gfx11xx only (RDNA2/RDNA3)
 COPY --from=rocm /opt/rocm-$ROCM/share/miopen/db/*gfx10* /opt/rocm-$ROCM/share/miopen/db/
 COPY --from=rocm /opt/rocm-$ROCM/share/miopen/db/*gfx11* /opt/rocm-$ROCM/share/miopen/db/
-COPY --from=rocm /opt/rocm-$ROCM/share/miopen/db/*gfx12* /opt/rocm-$ROCM/share/miopen/db/
-# Copy rocBLAS library files for gfx10xx, gfx11xx, and gfx12xx only
+# Copy rocBLAS library files for gfx10xx and gfx11xx only
 COPY --from=rocm /opt/rocm-$ROCM/lib/rocblas/library/*gfx10* /opt/rocm-$ROCM/lib/rocblas/library/
 COPY --from=rocm /opt/rocm-$ROCM/lib/rocblas/library/*gfx11* /opt/rocm-$ROCM/lib/rocblas/library/
-COPY --from=rocm /opt/rocm-$ROCM/lib/rocblas/library/*gfx12* /opt/rocm-$ROCM/lib/rocblas/library/
 COPY --from=rocm /opt/rocm-dist/ /

 #######################################################################
@@ -78,10 +71,6 @@ ENV MIGRAPHX_DISABLE_MIOPEN_FUSION=1
 ENV MIGRAPHX_DISABLE_SCHEDULE_PASS=1
 ENV MIGRAPHX_DISABLE_REDUCE_FUSION=1
 ENV MIGRAPHX_ENABLE_HIPRTC_WORKAROUNDS=1
-ENV MIOPEN_CUSTOM_CACHE_DIR=/config/model_cache/migraphx
-ENV MIOPEN_USER_DB_PATH=/config/model_cache/migraphx
-ENV AMD_COMGR_CACHE=1
-ENV AMD_COMGR_CACHE_DIR=/config/model_cache/migraphx

 COPY --from=rocm-dist / /

@@ -1 +1 @@
-onnxruntime-migraphx @ https://github.com/NickM-27/frigate-onnxruntime-rocm/releases/download/v7.2.3-1/onnxruntime_migraphx-1.24.4-cp311-cp311-linux_x86_64.whl
+onnxruntime-migraphx @ https://github.com/NickM-27/frigate-onnxruntime-rocm/releases/download/v7.1.0/onnxruntime_migraphx-1.23.1-cp311-cp311-linux_x86_64.whl
@@ -1,5 +1,5 @@
 variable "ROCM" {
-  default = "7.2.3"
+  default = "7.1.1"
 }
 variable "HSA_OVERRIDE_GFX_VERSION" {
  default = ""
@@ -13,16 +13,6 @@ TRT_VER=${TRT_VER:-$(cat /etc/TENSORRT_VER)}
 OUTPUT_FOLDER="${MODEL_CACHE_DIR}/${TRT_VER}"
 YOLO_MODELS=${YOLO_MODELS:-""}

-# This runs as root after prepare's sentinel-guarded sweep, so the dirs and
-# engines it creates below are the runtime user's to fix up, on every exit path
-function hand_off_ownership() {
-    if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
-        /usr/local/bin/fix-ownership "${PUID:-1000}" "${PGID:-1000}" \
-            /config/model_cache "${MODEL_CACHE_DIR}"
-    fi
-}
-trap hand_off_ownership EXIT
-
 # Create output folder
 mkdir -p ${OUTPUT_FOLDER}

@@ -1,18 +1,18 @@
-# Nvidia ONNX Runtime GPU Support
+# NVidia TensorRT Support (amd64 only)
 --extra-index-url 'https://pypi.nvidia.com'
 cython==3.0.*; platform_machine == 'x86_64'
-nvidia-cuda-cupti-cu12==12.8.90; platform_machine == 'x86_64'
-nvidia-cublas-cu12==12.8.4.1; platform_machine == 'x86_64'
-nvidia-cudnn-cu12==9.8.0.87; platform_machine == 'x86_64'
-nvidia-cufft-cu12==11.3.3.83; platform_machine == 'x86_64'
-nvidia-curand-cu12==10.3.9.90; platform_machine == 'x86_64'
-nvidia-cuda-nvcc-cu12==12.8.93; platform_machine == 'x86_64'
-nvidia-cuda-nvrtc-cu12==12.8.93; platform_machine == 'x86_64'
-nvidia-cuda-runtime-cu12==12.8.90; platform_machine == 'x86_64'
-nvidia-cusolver-cu12==11.7.3.90; platform_machine == 'x86_64'
-nvidia-cusparse-cu12==12.5.8.93; platform_machine == 'x86_64'
-nvidia-nccl-cu12==2.26.2.post1; platform_machine == 'x86_64'
-nvidia-nvjitlink-cu12==12.8.93; platform_machine == 'x86_64'
+nvidia_cuda_cupti_cu12==12.5.82; platform_machine == 'x86_64'
+nvidia-cublas-cu12==12.5.3.*; platform_machine == 'x86_64'
+nvidia-cudnn-cu12==9.3.0.*; platform_machine == 'x86_64'
+nvidia-cufft-cu12==11.2.3.*; platform_machine == 'x86_64'
+nvidia-curand-cu12==10.3.6.*; platform_machine == 'x86_64'
+nvidia_cuda_nvcc_cu12==12.5.82; platform_machine == 'x86_64'
+nvidia-cuda-nvrtc-cu12==12.5.82; platform_machine == 'x86_64'
+nvidia_cuda_runtime_cu12==12.5.82; platform_machine == 'x86_64'
+nvidia_cusolver_cu12==11.6.3.*; platform_machine == 'x86_64'
+nvidia_cusparse_cu12==12.5.1.*; platform_machine == 'x86_64'
+nvidia_nccl_cu12==2.23.4; platform_machine == 'x86_64'
+nvidia_nvjitlink_cu12==12.5.82; platform_machine == 'x86_64'
 onnx==1.16.*; platform_machine == 'x86_64'
-onnxruntime-gpu==1.24.*; platform_machine == 'x86_64'
+onnxruntime-gpu==1.22.*; platform_machine == 'x86_64'
 protobuf==3.20.3; platform_machine == 'x86_64'
@@ -7,7 +7,6 @@
 # Generated files
 .docusaurus
 .cache-loader
-docs/integrations/api/

 # Misc
 .DS_Store
@@ -0,0 +1,283 @@
+---
+id: advanced
+title: Advanced Options
+sidebar_label: Advanced Options
+---
+
+### Logging
+
+#### Frigate `logger`
+
+Change the default log level for troubleshooting purposes.
+
+```yaml
+logger:
+  # Optional: default log level (default: shown below)
+  default: info
+  # Optional: module by module log level configuration
+  logs:
+    frigate.mqtt: error
+```
+
+Available log levels are: `debug`, `info`, `warning`, `error`, `critical`
+
+Examples of available modules are:
+
+- `frigate.app`
+- `frigate.mqtt`
+- `frigate.object_detection.base`
+- `detector.<detector_name>`
+- `watchdog.<camera_name>`
+- `ffmpeg.<camera_name>.<sorted_roles>` NOTE: All FFmpeg logs are sent as `error` level.
+
+#### Go2RTC Logging
+
+See [the go2rtc docs](https://github.com/AlexxIT/go2rtc?tab=readme-ov-file#module-log) for logging configuration
+
+```yaml
+go2rtc:
+  streams:
+    # ...
+  log:
+    exec: trace
+```
+
+### `environment_vars`
+
+This section can be used to set environment variables for those unable to modify the environment of the container, like within Home Assistant OS. Docker users should set environment variables in their `docker run` command (`-e FRIGATE_MQTT_PASSWORD=secret`) or `docker-compose.yml` file (`environment:` section) instead. Note that values set here are stored in plain text in your config file, so if the goal is to keep credentials out of your configuration, use Docker environment variables or Docker secrets instead.
+
+Variables prefixed with `FRIGATE_` can be referenced in config fields that support environment variable substitution (such as MQTT host and credentials, camera stream URLs, and ONVIF host and credentials) using the `{FRIGATE_VARIABLE_NAME}` syntax.
+
+Example:
+
+```yaml
+environment_vars:
+  FRIGATE_MQTT_USER: my_mqtt_user
+  FRIGATE_MQTT_PASSWORD: my_mqtt_password
+
+mqtt:
+  host: "{FRIGATE_MQTT_HOST}"
+  user: "{FRIGATE_MQTT_USER}"
+  password: "{FRIGATE_MQTT_PASSWORD}"
+```
+
+#### TensorFlow Thread Configuration
+
+If you encounter thread creation errors during classification model training, you can limit TensorFlow's thread usage:
+
+```yaml
+environment_vars:
+  TF_INTRA_OP_PARALLELISM_THREADS: "2" # Threads within operations (0 = use default)
+  TF_INTER_OP_PARALLELISM_THREADS: "2" # Threads between operations (0 = use default)
+  TF_DATASET_THREAD_POOL_SIZE: "2" # Data pipeline threads (0 = use default)
+```
+
+### `database`
+
+Tracked object and recording information is managed in a sqlite database at `/config/frigate.db`. If that database is deleted, recordings will be orphaned and will need to be cleaned up manually. They also won't show up in the Media Browser within Home Assistant.
+
+If you are storing your database on a network share (SMB, NFS, etc), you may get a `database is locked` error message on startup. You can customize the location of the database in the config if necessary.
+
+This may need to be in a custom location if network storage is used for the media folder.
+
+```yaml
+database:
+  path: /path/to/frigate.db
+```
+
+### `model`
+
+If using a custom model, the width and height will need to be specified.
+
+Custom models may also require different input tensor formats. The colorspace conversion supports RGB, BGR, or YUV frames to be sent to the object detector. The input tensor shape parameter is an enumeration to match what specified by the model.
+
+| Tensor Dimension | Description    |
+| :--------------: | -------------- |
+|        N         | Batch Size     |
+|        H         | Model Height   |
+|        W         | Model Width    |
+|        C         | Color Channels |
+
+| Available Input Tensor Shapes |
+| :---------------------------: |
+|            "nhwc"             |
+|            "nchw"             |
+
+```yaml
+# Optional: model config
+model:
+  path: /path/to/model
+  width: 320
+  height: 320
+  input_tensor: "nhwc"
+  input_pixel_format: "bgr"
+```
+
+#### `labelmap`
+
+:::warning
+
+If the labelmap is customized then the labels used for alerts will need to be adjusted as well. See [alert labels](../configuration/review.md#restricting-alerts-to-specific-labels) for more info.
+
+:::
+
+The labelmap can be customized to your needs. A common reason to do this is to combine multiple object types that are easily confused when you don't need to be as granular such as car/truck. By default, truck is renamed to car because they are often confused. You cannot add new object types, but you can change the names of existing objects in the model.
+
+```yaml
+model:
+  labelmap:
+    2: vehicle
+    3: vehicle
+    5: vehicle
+    7: vehicle
+    15: animal
+    16: animal
+    17: animal
+```
+
+Note that if you rename objects in the labelmap, you will also need to update your `objects -> track` list as well.
+
+:::warning
+
+Some labels have special handling and modifications can disable functionality.
+
+`person` objects are associated with `face` and `amazon`
+
+`car` objects are associated with `license_plate`, `ups`, `fedex`, `amazon`
+
+:::
+
+## Network Configuration
+
+Changes to Frigate's internal network configuration can be made by bind mounting nginx.conf into the container. For example:
+
+```yaml
+services:
+  frigate:
+    container_name: frigate
+    ...
+    volumes:
+      ...
+      - /path/to/your/nginx.conf:/usr/local/nginx/conf/nginx.conf
+```
+
+### Enabling IPv6
+
+IPv6 is disabled by default, to enable IPv6 listen.gotmpl needs to be bind mounted with IPv6 enabled. For example:
+
+```
+{{ if not .enabled }}
+# intended for external traffic, protected by auth
+listen 8971;
+{{ else }}
+# intended for external traffic, protected by auth
+listen 8971 ssl;
+
+# intended for internal traffic, not protected by auth
+listen 5000;
+```
+
+becomes
+
+```
+{{ if not .enabled }}
+# intended for external traffic, protected by auth
+listen [::]:8971 ipv6only=off;
+{{ else }}
+# intended for external traffic, protected by auth
+listen [::]:8971 ipv6only=off ssl;
+
+# intended for internal traffic, not protected by auth
+listen [::]:5000 ipv6only=off;
+```
+
+## Base path
+
+By default, Frigate runs at the root path (`/`). However some setups require to run Frigate under a custom path prefix (e.g. `/frigate`), especially when Frigate is located behind a reverse proxy that requires path-based routing.
+
+### Set Base Path via HTTP Header
+
+The preferred way to configure the base path is through the `X-Ingress-Path` HTTP header, which needs to be set to the desired base path in an upstream reverse proxy.
+
+For example, in Nginx:
+
+```
+location /frigate {
+    proxy_set_header X-Ingress-Path /frigate;
+    proxy_pass http://frigate_backend;
+}
+```
+
+### Set Base Path via Environment Variable
+
+When it is not feasible to set the base path via a HTTP header, it can also be set via the `FRIGATE_BASE_PATH` environment variable in the Docker Compose file.
+
+For example:
+
+```
+services:
+  frigate:
+    image: blakeblackshear/frigate:latest
+    environment:
+      - FRIGATE_BASE_PATH=/frigate
+```
+
+This can be used for example to access Frigate via a Tailscale agent (https), by simply forwarding all requests to the base path (http):
+
+```
+tailscale serve --https=443 --bg --set-path /frigate http://localhost:5000/frigate
+```
+
+## Custom Dependencies
+
+### Custom ffmpeg build
+
+Included with Frigate is a build of ffmpeg that works for the vast majority of users. However, there exists some hardware setups which have incompatibilities with the included build. In this case, statically built `ffmpeg` and `ffprobe` binaries can be placed in `/config/custom-ffmpeg/bin` for Frigate to use.
+
+To do this:
+
+1. Download your ffmpeg build and uncompress it to the `/config/custom-ffmpeg` folder. Verify that both the `ffmpeg` and `ffprobe` binaries are located in `/config/custom-ffmpeg/bin`.
+2. Update the `ffmpeg.path` in your Frigate config to `/config/custom-ffmpeg`.
+3. Restart Frigate and the custom version will be used if the steps above were done correctly.
+
+### Custom go2rtc version
+
+Frigate currently includes go2rtc v1.9.10, there may be certain cases where you want to run a different version of go2rtc.
+
+To do this:
+
+1. Download the go2rtc build to the `/config` folder.
+2. Rename the build to `go2rtc`.
+3. Give `go2rtc` execute permission.
+4. Restart Frigate and the custom version will be used, you can verify by checking go2rtc logs.
+
+## Validating your config.yml file updates
+
+When frigate starts up, it checks whether your config file is valid, and if it is not, the process exits. To minimize interruptions when updating your config, you have three options -- you can edit the config via the WebUI which has built in validation, use the config API, or you can validate on the command line using the frigate docker container.
+
+### Via API
+
+Frigate can accept a new configuration file as JSON at the `/api/config/save` endpoint. When updating the config this way, Frigate will validate the config before saving it, and return a `400` if the config is not valid.
+
+```bash
+curl -X POST http://frigate_host:5000/api/config/save -d @config.json
+```
+
+if you'd like you can use your yaml config directly by using [`yq`](https://github.com/mikefarah/yq) to convert it to json:
+
+```bash
+yq -o=json '.' config.yaml | curl -X POST 'http://frigate_host:5000/api/config/save?save_option=saveonly' --data-binary @-
+```
+
+### Via Command Line
+
+You can also validate your config at the command line by using the docker container itself. In CI/CD, you leverage the return code to determine if your config is valid, Frigate will return `1` if the config is invalid, or `0` if it's valid.
+
+```bash
+docker run                                \
+  -v $(pwd)/config.yml:/config/config.yml \
+  --entrypoint python3                    \
+  ghcr.io/blakeblackshear/frigate:stable  \
+  -u -m frigate                           \
+  --validate-config
+```
@@ -1,446 +0,0 @@
---
-id: system
-title: System
---
-
-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
-### Logging
-
-#### Frigate `logger`
-
-Change the default log level for troubleshooting purposes.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Logging" />.
-
-| Field                     | Description                                             |
-| ------------------------- | ------------------------------------------------------- |
-| **Logging level**         | The default log level for all modules (default: `info`) |
-| **Per-process log level** | Override the log level for specific modules             |
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-logger:
-  # Optional: default log level (default: shown below)
-  default: info
-  # Optional: module by module log level configuration
-  logs:
-    frigate.mqtt: error
-```
-
-</TabItem>
-</ConfigTabs>
-
-Available log levels are: `debug`, `info`, `warning`, `error`, `critical`
-
-Examples of available modules are:
-
- `frigate.app`
- `frigate.mqtt`
- `frigate.object_detection.base`
- `detector.<detector_name>`
- `watchdog.<camera_name>`
- `ffmpeg.<camera_name>.<sorted_roles>` NOTE: All FFmpeg logs are sent as `error` level.
-
-#### Go2RTC Logging
-
-See [the go2rtc docs](https://github.com/AlexxIT/go2rtc?tab=readme-ov-file#module-log) for logging configuration
-
-```yaml
-go2rtc:
-  streams:
-    # ...
-  log:
-    exec: trace
-```
-
-### `environment_vars`
-
-This section sets environment variables in the Frigate process for those unable to modify the environment of the container, like within Home Assistant OS. It's meant for process settings such as `LIBVA_DRIVER_NAME` or the TensorFlow thread counts below. Docker users should set environment variables in their `docker run` command (`-e LIBVA_DRIVER_NAME=i965`) or `docker-compose.yml` file (`environment:` section) instead. Values set here are stored in plain text in your config file, so credentials belong in `secrets.yaml`, Docker environment variables, or Docker secrets instead.
-
-Names prefixed with `FRIGATE_` set here also take part in `{FRIGATE_VARIABLE_NAME}` substitution (see [below](#substitution-sources-and-precedence)), but `secrets.yaml` is the better home for them.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Environment variables" /> to add or edit environment variables.
-
-| Field             | Description                                               |
-| ----------------- | --------------------------------------------------------- |
-| **Variable name** | The environment variable name (e.g., `LIBVA_DRIVER_NAME`) |
-| **Value**         | The value for the variable                                |
-
-Names prefixed with `FRIGATE_` can also be referenced elsewhere in your configuration using the `{FRIGATE_VARIABLE_NAME}` syntax.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-environment_vars:
-  LIBVA_DRIVER_NAME: i965
-```
-
-</TabItem>
-</ConfigTabs>
-
-#### TensorFlow Thread Configuration
-
-If you encounter thread creation errors during classification model training, you can limit TensorFlow's thread usage:
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Environment variables" /> and add the following variables:
-
-| Variable                          | Description                                    |
-| --------------------------------- | ---------------------------------------------- |
-| `TF_INTRA_OP_PARALLELISM_THREADS` | Threads within operations (`0` = use default)  |
-| `TF_INTER_OP_PARALLELISM_THREADS` | Threads between operations (`0` = use default) |
-| `TF_DATASET_THREAD_POOL_SIZE`     | Data pipeline threads (`0` = use default)      |
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-environment_vars:
-  TF_INTRA_OP_PARALLELISM_THREADS: "2" # Threads within operations (0 = use default)
-  TF_INTER_OP_PARALLELISM_THREADS: "2" # Threads between operations (0 = use default)
-  TF_DATASET_THREAD_POOL_SIZE: "2" # Data pipeline threads (0 = use default)
-```
-
-</TabItem>
-</ConfigTabs>
-
-### `secrets.yaml`
-
-A `secrets.yaml` file next to your `config.yml` is an additional source of `FRIGATE_` variables, for installs that can't set container environment variables or mount Docker secrets. It's a flat map of names to values, and it is never read or written by the Frigate UI:
-
-```yaml
-FRIGATE_CAM_USER: viewer
-FRIGATE_CAM_PASS: "p@ss w0rd"
-FRIGATE_MQTT_HOST: mqtt.internal.example
-```
-
-For Docker this is `/config/secrets.yaml` inside the container, so it lives in whatever host directory you mounted at `/config`. For the Home Assistant App it's `/addon_configs/<addon_directory>/secrets.yaml`, in the same folder as your `config.yml`; see [the App config directory](../config.md#accessing-app-config-dir) for the directory name for your variant.
-
-Names must start with `FRIGATE_`, and nesting is not supported. `secrets.yaml` feeds `{FRIGATE_VARIABLE_NAME}` substitution, so the handful of variables Frigate reads straight from the process environment, such as `FRIGATE_JWT_SECRET`, still need a container environment variable or a Docker secret.
-
-### Substitution sources and precedence
-
-The same `{FRIGATE_VARIABLE_NAME}` placeholder resolves from four sources. When a name is defined in more than one, the higher one wins and a warning at startup names which source was used.
-
-| Priority    | Source                | Where it's set                                                             | Who can use it                 |
-| ----------- | --------------------- | -------------------------------------------------------------------------- | ------------------------------ |
-| 1 (highest) | Docker secrets        | Files in `/run/secrets`, or the directory named by `CREDENTIALS_DIRECTORY` | Docker, systemd                |
-| 2           | Container environment | `docker run -e`, the `environment:` section of `docker-compose.yml`        | Docker                         |
-| 3           | `secrets.yaml`        | Next to `config.yml`, see above                                            | Everyone, including the HA App |
-| 4 (lowest)  | `environment_vars`    | The block in `config.yml` described above                                  | Everyone, including the HA App |
-
-For example, with this `secrets.yaml`:
-
-```yaml
-FRIGATE_MQTT_PASSWORD: from_secrets
-```
-
-and this `config.yml`:
-
-```yaml
-environment_vars:
-  FRIGATE_MQTT_PASSWORD: from_config
-
-mqtt:
-  password: "{FRIGATE_MQTT_PASSWORD}"
-```
-
-the password resolves to `from_secrets`, and the log shows `FRIGATE_MQTT_PASSWORD is defined in more than one place, using the value from secrets.yaml`. Add `-e FRIGATE_MQTT_PASSWORD=from_env` to the container and it resolves to `from_env` instead.
-
-Referencing a name that no source defines is a config validation error naming the field.
-
-### `database`
-
-Tracked object and recording information is managed in a sqlite database at `/config/frigate.db`. If that database is deleted, recordings will be orphaned and will need to be cleaned up manually. They also won't show up in the Media Browser within Home Assistant.
-
-If you are storing your database on a network share (SMB, NFS, etc), you may get a `database is locked` error message on startup. You can customize the location of the database if necessary.
-
-This may need to be in a custom location if network storage is used for the media folder.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Database" />.
-
- Set **Database path** to the custom path for the Frigate database file (default: `/config/frigate.db`)
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-database:
-  path: /path/to/frigate.db
-```
-
-</TabItem>
-</ConfigTabs>
-
-### `model`
-
-If using a custom model, the width and height will need to be specified.
-
-Custom models may also require different input tensor formats. The colorspace conversion supports RGB, BGR, or YUV frames to be sent to the object detector. The input tensor shape parameter is an enumeration to match what specified by the model.
-
-| Tensor Dimension | Description    |
-| :--------------: | -------------- |
-|        N         | Batch Size     |
-|        H         | Model Height   |
-|        W         | Model Width    |
-|        C         | Color Channels |
-
-| Available Input Tensor Shapes |
-| :---------------------------: |
-|            "nhwc"             |
-|            "nchw"             |
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Detection models" /> and, on the model you want to change, open the **Custom Model** tab to configure the model path, dimensions, and input format.
-
-| Field                                         | Description                          |
-| --------------------------------------------- | ------------------------------------ |
-| **Custom object detector model path**         | Path to the custom model file        |
-| **Object detection model input width**        | Model input width (default: 320)     |
-| **Object detection model input height**       | Model input height (default: 320)    |
-| **Advanced > Model Input Tensor Shape**       | Input tensor shape: `nhwc` or `nchw` |
-| **Advanced > Model Input Pixel Color Format** | Pixel format: `rgb`, `bgr`, or `yuv` |
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-# Optional: model config
-models:
-  - devices:
-      - openvino:GPU
-    path: /path/to/model
-    width: 320
-    height: 320
-    input_tensor: "nhwc"
-    input_pixel_format: "bgr"
-```
-
-</TabItem>
-</ConfigTabs>
-
-#### `labelmap`
-
-:::warning
-
-If the labelmap is customized then the labels used for alerts will need to be adjusted as well. See [alert labels](../review.md#restricting-alerts-to-specific-labels) for more info.
-
-:::
-
-The labelmap can be customized to your needs. A common reason to do this is to combine multiple object types that are easily confused when you don't need to be as granular such as car/truck. By default, truck is renamed to car because they are often confused. You cannot add new object types, but you can change the names of existing objects in the model.
-
-```yaml
-models:
-  - labelmap:
-      2: vehicle
-      3: vehicle
-      5: vehicle
-      7: vehicle
-      15: animal
-      16: animal
-      17: animal
-```
-
-Note that if you rename objects in the labelmap, you will also need to update your `objects -> track` list as well.
-
-:::warning
-
-Some labels have special handling and modifications can disable functionality.
-
-`person` objects are associated with `face` and `amazon`
-
-`car` objects are associated with `license_plate`, `ups`, `fedex`, `amazon`
-
-:::
-
-## Network Configuration
-
-Frigate exposes a few networking options. IPv6 and the listen ports are set in the `networking` configuration (or from the Settings UI); more advanced changes require [customizing the bundled Nginx configuration](#customizing-the-nginx-configuration).
-
-### Enabling IPv6
-
-By default Frigate listens on IPv4 only. To also listen on IPv6 (on port `5000`, and on `8971` when TLS is configured), enable it in the `networking` configuration.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Networking" /> and enable **IPv6**.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-networking:
-  ipv6:
-    enabled: true
-```
-
-</TabItem>
-</ConfigTabs>
-
-### Listen on different ports
-
-You can change the ports Nginx uses for listening. The internal port (unauthenticated) and external port (authenticated) can be changed independently. You can also specify an IP address using the format `ip:port` if you wish to bind the port to a specific interface. This may be useful for example to prevent exposing the internal port outside the container.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Networking" /> to configure the listen ports.
-
-| Field             | Description                                               |
-| ----------------- | --------------------------------------------------------- |
-| **Internal port** | The unauthenticated listen address/port (default: `5000`) |
-| **External port** | The authenticated listen address/port (default: `8971`)   |
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-networking:
-  listen:
-    internal: 127.0.0.1:5000
-    external: 8971
-```
-
-</TabItem>
-</ConfigTabs>
-
-:::warning
-
-This setting is for advanced users. For the majority of use cases it's recommended to change the `ports` section of your Docker compose file or use the Docker `run` `--publish` option instead, e.g. `-p 443:8971`. Changing Frigate's ports may break some integrations.
-
-The internal and external ports must be different port numbers, and Frigate will refuse to start otherwise. Requests arriving on the internal port are treated as authenticated admins, so pointing both at the same port would remove authentication from the external one.
-
-Nginx binds these ports when it starts, so port changes only take effect after Frigate restarts.
-
-:::
-
-### Customizing the Nginx configuration
-
-More advanced changes to Frigate's internal network configuration can be made by bind mounting your own `nginx.conf` into the container. For example:
-
-```yaml
-services:
-  frigate:
-    container_name: frigate
-    ...
-    volumes:
-      ...
-      - /path/to/your/nginx.conf:/usr/local/nginx/conf/nginx.conf
-```
-
-## Base path
-
-By default, Frigate runs at the root path (`/`). However some setups require to run Frigate under a custom path prefix (e.g. `/frigate`), especially when Frigate is located behind a reverse proxy that requires path-based routing.
-
-### Set Base Path via HTTP Header
-
-The preferred way to configure the base path is through the `X-Ingress-Path` HTTP header, which needs to be set to the desired base path in an upstream reverse proxy.
-
-For example, in Nginx:
-
-```
-location /frigate {
-    proxy_set_header X-Ingress-Path /frigate;
-    proxy_pass http://frigate_backend;
-}
-```
-
-### Set Base Path via Environment Variable
-
-When it is not feasible to set the base path via a HTTP header, it can also be set via the `FRIGATE_BASE_PATH` environment variable in the Docker Compose file.
-
-For example:
-
-```
-services:
-  frigate:
-    image: ghcr.io/blakeblackshear/frigate:stable
-    environment:
-      - FRIGATE_BASE_PATH=/frigate
-```
-
-This can be used for example to access Frigate via a Tailscale agent (https), by simply forwarding all requests to the base path (http):
-
-```
-tailscale serve --https=443 --bg --set-path /frigate http://localhost:5000/frigate
-```
-
-## Custom Dependencies
-
-### Custom ffmpeg build
-
-Included with Frigate is a build of ffmpeg that works for the vast majority of users. However, there exists some hardware setups which have incompatibilities with the included build. In this case, statically built `ffmpeg` and `ffprobe` binaries can be placed in `/config/custom-ffmpeg/bin` for Frigate to use.
-
-To do this:
-
-1. Download your ffmpeg build and uncompress it to the `/config/custom-ffmpeg` folder. Verify that both the `ffmpeg` and `ffprobe` binaries are located in `/config/custom-ffmpeg/bin`.
-2. Update the `ffmpeg.path` in your Frigate config to `/config/custom-ffmpeg`.
-3. Restart Frigate and the custom version will be used if the steps above were done correctly.
-
-Both binaries have to be executable by Frigate's unprivileged runtime user, so `chmod 755` them after extracting. The startup ownership sweep runs only once, so anything you add to `/config` later keeps whatever ownership and mode you gave it.
-
-There is one exception, and it only affects [`FRIGATE_ROOT_SERVICES`](/configuration/non_root#keeping-individual-services-root) listing `frigate`. That mode runs Frigate as root while still handing `/config` to the unprivileged runtime user, so anything running as that user could swap the binary and gain root. A build inside any of Frigate's writable volumes (`/config`, `/media/frigate`, the cache and shm dirs) is ignored there and the bundled one is used, with a warning in the log. Keep the build somewhere root-owned (any absolute `ffmpeg.path` works, so a read-only bind mount such as `/opt/custom-ffmpeg` is enough) if you need both. The default mode and `FRIGATE_RUN_AS_ROOT=true` are unaffected and behave exactly as they always have.
-
-### Custom go2rtc version
-
-Frigate currently includes go2rtc v1.9.14, there may be certain cases where you want to run a different version of go2rtc.
-
-To do this:
-
-1. Download the go2rtc build to the `/config` folder.
-2. Rename the build to `go2rtc`.
-3. Give `go2rtc` execute permission for all users (`chmod 755`). It runs as its own `go2rtc` user, which doesn't own the file, so owner-only execute permission isn't enough.
-4. Restart Frigate and the custom version will be used, you can verify by checking go2rtc logs.
-
-The same exception applies, and again only to [`FRIGATE_ROOT_SERVICES`](/configuration/non_root#keeping-individual-services-root) listing `go2rtc`: the binary is ignored there and the embedded one is used, with a warning in the log. Unlike `ffmpeg.path`, the go2rtc binary location is not configurable, so there is no outside-`/config` alternative. Use `FRIGATE_RUN_AS_ROOT=true` instead if you need both a custom go2rtc build and root. The default mode and the escape hatch both honor `/config/go2rtc` exactly as they always have.
-
-## Validating your config.yml file updates
-
-When frigate starts up, it checks whether your config file is valid, and if it is not, the process exits. To minimize interruptions when updating your config, you have three options -- you can edit the config via the WebUI which has built in validation, use the config API, or you can validate on the command line using the frigate docker container.
-
-### Via API
-
-Frigate can accept a new configuration file as JSON at the `/api/config/save` endpoint. When updating the config this way, Frigate will validate the config before saving it, and return a `400` if the config is not valid.
-
-```bash
-curl -X POST http://frigate_host:5000/api/config/save -d @config.json
-```
-
-if you'd like you can use your yaml config directly by using [`yq`](https://github.com/mikefarah/yq) to convert it to json:
-
-```bash
-yq -o=json '.' config.yaml | curl -X POST 'http://frigate_host:5000/api/config/save?save_option=saveonly' --data-binary @-
-```
-
-### Via Command Line
-
-You can also validate your config at the command line by using the docker container itself. In CI/CD, you leverage the return code to determine if your config is valid, Frigate will return `1` if the config is invalid, or `0` if it's valid.
-
-```bash
-docker run                                \
-  -v $(pwd)/config.yml:/config/config.yml \
-  --entrypoint python3                    \
-  ghcr.io/blakeblackshear/frigate:stable  \
-  -u -m frigate                           \
-  --validate-config
-```
@@ -3,10 +3,6 @@ id: audio_detectors
 title: Audio Detectors
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
 Frigate provides a builtin audio detector which runs on the CPU. Compared to object detection in images, audio detection is a relatively lightweight operation so the only option is to run the detection on a CPU.

 ## Configuration
@@ -15,17 +11,7 @@ Audio events work by detecting a type of audio and creating an event, the event

 ### Enabling Audio Events

-Audio events can be enabled globally or for specific cameras.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-**Global:** Navigate to <NavPath path="Settings > Global configuration > Audio events" /> and set **Enable audio detection** to on.
-
-**Per-camera:** Navigate to <NavPath path="Settings > Camera configuration > Audio events" /> and set **Enable audio detection** to on for the desired camera.
-
-</TabItem>
-<TabItem value="yaml">
+Audio events can be enabled for all cameras or only for specific cameras.

 ```yaml

@@ -40,9 +26,6 @@ cameras:
      enabled: True # <- enable audio events for the front_camera
 ```

-</TabItem>
-</ConfigTabs>
-
 If you are using multiple streams then you must set the `audio` role on the stream that is going to be used for audio detection, this can be any stream but the stream must have audio included.

 :::note
@@ -51,14 +34,6 @@ The ffmpeg process for capturing audio will be a separate connection to the came

 :::

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Camera configuration > Streams (FFmpeg)" /> and add an input with the `audio` role pointing to a stream that includes audio.
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 cameras:
  front_camera:
@@ -73,12 +48,9 @@ cameras:
            - detect
 ```

-</TabItem>
-</ConfigTabs>
-
 ### Configuring Minimum Volume

-The audio detector uses volume levels in the same way that motion in a camera feed is used for object detection. This means that Frigate will not run audio detection unless the audio volume is above the configured level in order to reduce resource usage. Audio levels can vary widely between camera models so it is important to run tests to see what volume levels are. The [Debug view](/usage/live#the-single-camera-view) in the Frigate UI has an Audio tab for cameras that have the `audio` role assigned where a graph and the current levels are displayed. The `min_volume` parameter should be set to the minimum the `RMS` level required to run audio detection.
+The audio detector uses volume levels in the same way that motion in a camera feed is used for object detection. This means that Frigate will not run audio detection unless the audio volume is above the configured level in order to reduce resource usage. Audio levels can vary widely between camera models so it is important to run tests to see what volume levels are. The Debug view in the Frigate UI has an Audio tab for cameras that have the `audio` role assigned where a graph and the current levels are is displayed. The `min_volume` parameter should be set to the minimum the `RMS` level required to run audio detection.

 :::tip

@@ -88,18 +60,7 @@ Volume is considered motion for recordings, this means when the `record -> retai

 ### Configuring Audio Events

-The included audio model has over [500 different types](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt) of audio that can be detected, many of which are not practical. By default `bark`, `fire_alarm`, `speech`, and `yell` are enabled but these can be customized.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Global configuration > Audio events" />.
-
- Set **Enable audio detection** to on
- Set **Listen types** to include the audio types you want to detect
-
-</TabItem>
-<TabItem value="yaml">
+The included audio model has over [500 different types](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt) of audio that can be detected, many of which are not practical. By default `bark`, `fire_alarm`, `scream`, `speech`, and `yell` are enabled but these can be customized.

 ```yaml
 audio:
@@ -107,130 +68,20 @@ audio:
  listen:
    - bark
    - fire_alarm
+    - scream
    - speech
    - yell
 ```

-</TabItem>
-</ConfigTabs>
-
-#### Grouping Audio Labels
-
-Related audio classes can be grouped under one label by mapping their numeric
-class IDs to the same name. Add the grouped name to `listen` and use it for any
-corresponding filter:
-
-```yaml
-audio:
-  listen:
-    - dogs
-  labelmap:
-    69: dogs # dog
-    70: dogs # bark
-    75: dogs # whimper_dog
-  filters:
-    dogs:
-      threshold: 0.8
-```
-
-Class IDs are zero-based indices in
-[`audio-labelmap.txt`](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt),
-so each ID is one less than the displayed file line number.
-Audio label mappings are separate from the object detector's `model.labelmap`.
-
-### Common Audio Labels
-
-The labelmap includes hundreds of sound types. The labels below are the ones most users may find practical, grouped by what they're typically used for. Use the exact label string from the left column in your `listen` config, or search for the label in the Frigate UI directly.
-
-Some labels cover several related sounds: `yell` is triggered by shouting, yelling, children shouting, and screaming; `crying` covers baby cries, sobbing, and whimpering; and `speech` covers ordinary talking and conversation.
-
-**Safety and security**
-
-| Label            | Detects                            |
-| ---------------- | ---------------------------------- |
-| `yell`           | Shouting, yelling, screaming       |
-| `fire_alarm`     | Fire and smoke alarm sirens        |
-| `smoke_detector` | Smoke detector beeps               |
-| `alarm`          | General alarm sounds               |
-| `car_alarm`      | Car alarms                         |
-| `siren`          | Emergency vehicle and civil sirens |
-| `glass`          | Glass clinking                     |
-| `shatter`        | Breaking glass                     |
-| `breaking`       | Something breaking                 |
-| `gunshot`        | Gunshots                           |
-| `explosion`      | Explosions                         |
-
-**People and activity**
-
-| Label       | Detects                  |
-| ----------- | ------------------------ |
-| `speech`    | Talking and conversation |
-| `laughter`  | Laughing                 |
-| `crying`    | Baby crying and sobbing  |
-| `cough`     | Coughing                 |
-| `footsteps` | Footsteps and walking    |
-| `knock`     | Knocking on a door       |
-| `doorbell`  | Doorbell                 |
-| `ding-dong` | Doorbell chime           |
-
-**Pets and animals**
-
-| Label      | Detects          |
-| ---------- | ---------------- |
-| `bark`     | Dog barking      |
-| `dog`      | Other dog sounds |
-| `howl`     | Howling          |
-| `growling` | Growling         |
-| `meow`     | Cat meowing      |
-| `cat`      | Other cat sounds |
-| `hiss`     | Hissing          |
-
-**Vehicles and driveway**
-
-| Label             | Detects              |
-| ----------------- | -------------------- |
-| `car`             | Passing cars         |
-| `honk`            | Car horns            |
-| `truck`           | Trucks               |
-| `reversing_beeps` | Vehicle backup beeps |
-| `motorcycle`      | Motorcycles          |
-| `engine_starting` | Engines starting     |
-
-:::tip
-
-Frequently-heard labels like `speech` can generate a lot of events, and each event could save a snapshot and recording based on your configuration, so start with a focused set and expand from there. The defaults (`bark`, `fire_alarm`, `speech`, `yell`) plus a few of the safety labels above cover most needs. See the [full audio labelmap](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt) or the Frigate UI for every available type.
-
-:::
-
 ### Audio Transcription

-Frigate supports fully local audio transcription using either `sherpa-onnx` or OpenAI's open-source Whisper models via `faster-whisper`. The goal of this feature is to support Semantic Search for `speech` audio events. Frigate is not intended to act as a continuous, fully-automatic speech transcription service. Automatically transcribing all speech (or queuing many audio events for transcription) requires substantial CPU (or GPU) resources and is impractical on most systems. For this reason, transcriptions for events are initiated manually from the UI or the API rather than being run continuously in the background.
-
-:::info
-
-Audio transcription requires a one-time internet connection to download the Whisper or Sherpa-ONNX model on first use. Once cached, transcription runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
-
-:::
+Frigate supports fully local audio transcription using either `sherpa-onnx` or OpenAI’s open-source Whisper models via `faster-whisper`. The goal of this feature is to support Semantic Search for `speech` audio events. Frigate is not intended to act as a continuous, fully-automatic speech transcription service — automatically transcribing all speech (or queuing many audio events for transcription) requires substantial CPU (or GPU) resources and is impractical on most systems. For this reason, transcriptions for events are initiated manually from the UI or the API rather than being run continuously in the background.

 Transcription accuracy also depends heavily on the quality of your camera's microphone and recording conditions. Many cameras use inexpensive microphones, and distance to the speaker, low audio bitrate, or background noise can significantly reduce transcription quality. If you need higher accuracy, more robust long-running queues, or large-scale automatic transcription, consider using the HTTP API in combination with an automation platform and a cloud transcription service.

 #### Configuration

-To enable transcription, configure it globally and optionally disable for specific cameras. Audio detection must also be enabled as described above.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-**Global:** Navigate to <NavPath path="Settings > Enrichments > Audio transcription" />.
-
- Set **Enable audio transcription** to on
- Set **Transcription device** to the desired device
- Set **Model size** to the desired size
-
-**Per-camera:** Navigate to <NavPath path="Settings > Camera configuration > Audio transcription" /> to enable or disable transcription for a specific camera.
-
-</TabItem>
-<TabItem value="yaml">
+To enable transcription, enable it in your config. Note that audio detection must also be enabled as described above in order to use audio transcription features.

 ```yaml
 audio_transcription:
@@ -249,9 +100,6 @@ cameras:
      enabled: False
 ```

-</TabItem>
-</ConfigTabs>
-
 :::note

 Audio detection must be enabled and configured as described above in order to use audio transcription features.
@@ -280,7 +128,7 @@ The only field that is valid at the camera level is `enabled`.

 #### Live transcription

-The single camera Live view in the Frigate UI supports live transcription of audio for streams defined with the `audio` role. Use the Enable/Disable Live Audio Transcription button/switch to toggle transcription processing, or toggle it outside of the UI with the [`frigate/<camera_name>/audio_transcription/set`](/integrations/mqtt#frigatecamera_nameaudio_transcriptionset) MQTT topic or the HTTP API. When speech is heard, the UI will display a black box over the top of the camera stream with text. The MQTT topic `frigate/<camera_name>/audio/transcription` will also be updated in real-time with transcribed text.
+The single camera Live view in the Frigate UI supports live transcription of audio for streams defined with the `audio` role. Use the Enable/Disable Live Audio Transcription button/switch to toggle transcription processing. When speech is heard, the UI will display a black box over the top of the camera stream with text. The MQTT topic `frigate/<camera_name>/audio/transcription` will also be updated in real-time with transcribed text.

 Results can be error-prone due to a number of factors, including:

@@ -296,9 +144,9 @@ If you have CUDA hardware, you can experiment with the `large` `whisper` model o

 #### Transcription and translation of `speech` audio events

-Any `speech` events in Explore can be transcribed and/or translated through the Transcribe button (the microphone icon) in the Tracked Object Details pane.
+Any `speech` events in Explore can be transcribed and/or translated through the Transcribe button in the Tracked Object Details pane.

-In order to use transcription and translation for past events, you must enable audio detection and define `speech` as an audio type to listen for. To have `speech` events translated into the language of your choice, set the `language` config parameter with the correct [language code](https://github.com/openai/whisper/blob/main/whisper/tokenizer.py#L10).
+In order to use transcription and translation for past events, you must enable audio detection and define `speech` as an audio type to listen for in your config. To have `speech` events translated into the language of your choice, set the `language` config parameter with the correct [language code](https://github.com/openai/whisper/blob/main/whisper/tokenizer.py#L10).

 The transcribed/translated speech will appear in the description box in the Tracked Object Details pane. If Semantic Search is enabled, embeddings are generated for the transcription text and are fully searchable using the description search type.

@@ -314,16 +162,16 @@ Recorded `speech` events will always use a `whisper` model, regardless of the `m

 1. Why doesn't Frigate automatically transcribe all `speech` events?

-   Frigate does not implement a queue mechanism for speech transcription, and adding one is not trivial. A proper queue would need backpressure, prioritization, memory/disk buffering, retry logic, crash recovery, and safeguards to prevent unbounded growth when events outpace processing. That's a significant amount of complexity for a feature that, in most real-world environments, would mostly just churn through low-value noise.
+   Frigate does not implement a queue mechanism for speech transcription, and adding one is not trivial. A proper queue would need backpressure, prioritization, memory/disk buffering, retry logic, crash recovery, and safeguards to prevent unbounded growth when events outpace processing. That’s a significant amount of complexity for a feature that, in most real-world environments, would mostly just churn through low-value noise.

   Because transcription is **serialized (one event at a time)** and speech events can be generated far faster than they can be processed, an auto-transcribe toggle would very quickly create an ever-growing backlog and degrade core functionality. For the amount of engineering and risk involved, it adds **very little practical value** for the majority of deployments, which are often on low-powered, edge hardware.

-   If you hear speech that's actually important and worth saving/indexing for the future, **just press the transcribe button (the microphone icon) in Explore** on that specific `speech` event - that keeps things explicit, reliable, and under your control.
+   If you hear speech that’s actually important and worth saving/indexing for the future, **just press the transcribe button in Explore** on that specific `speech` event - that keeps things explicit, reliable, and under your control.

   Other options are being considered for future versions of Frigate to add transcription options that support external `whisper` Docker containers. A single transcription service could then be shared by Frigate and other applications (for example, Home Assistant Voice), and run on more powerful machines when available.

 2. Why don't you save live transcription text and use that for `speech` events?

-   There's no guarantee that a `speech` event is even created from the exact audio that went through the transcription model. Live transcription and `speech` event creation are **separate, asynchronous processes**. Even when both are correctly configured, trying to align the **precise start and end time of a speech event** with whatever audio the model happened to be processing at that moment is unreliable.
+   There’s no guarantee that a `speech` event is even created from the exact audio that went through the transcription model. Live transcription and `speech` event creation are **separate, asynchronous processes**. Even when both are correctly configured, trying to align the **precise start and end time of a speech event** with whatever audio the model happened to be processing at that moment is unreliable.

-   Automatically persisting that data would often result in **misaligned, partial, or irrelevant transcripts**, while still incurring all of the CPU, storage, and privacy costs of transcription. That's why Frigate treats transcription as an **explicit, user-initiated action** rather than an automatic side-effect of every `speech` event.
+   Automatically persisting that data would often result in **misaligned, partial, or irrelevant transcripts**, while still incurring all of the CPU, storage, and privacy costs of transcription. That’s why Frigate treats transcription as an **explicit, user-initiated action** rather than an automatic side-effect of every `speech` event.
@@ -3,10 +3,6 @@ id: authentication
 title: Authentication
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
 # Authentication

 Frigate stores user information in its database. Password hashes are generated using industry standard PBKDF2-SHA256 with 600,000 iterations. Upon successful login, a JWT token is issued with an expiration date and set as a cookie. The cookie is refreshed as needed automatically. This JWT token can also be passed in the Authorization header as a bearer token.
@@ -22,32 +18,17 @@ The following ports are available to access the Frigate web UI.

 ## Onboarding

-On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time.
-
-On a new install the [setup wizard](../guides/getting_started.md#configuring-frigate) offers this as its first step, along with creating accounts for anyone else who needs access. You can also do both at any time under <NavPath path="Settings > Users" />.
+On startup, an admin user and password are generated and printed in the logs. It is recommended to set a new password for the admin account after logging in for the first time under Settings > Users.

 ## Resetting admin password

-In the event that you are locked out of your instance, you can tell Frigate to reset the admin password and print it in the logs on next startup.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Authentication" />.
-
- Set **Reset admin password** to on to reset the admin password and print it in the logs on next startup
-
-</TabItem>
-<TabItem value="yaml">
+In the event that you are locked out of your instance, you can tell Frigate to reset the admin password and print it in the logs on next startup using the `reset_admin_password` setting in your config file.

 ```yaml
 auth:
  reset_admin_password: true
 ```

-</TabItem>
-</ConfigTabs>
-
 ## Password guidance

 Constructing secure passwords and managing them properly is important. Frigate requires a minimum length of 12 characters. For guidance on password standards see [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html). To learn what makes a password truly secure, read this [article](https://medium.com/peerio/how-to-build-a-billion-dollar-password-3d92568d9277).
@@ -66,20 +47,7 @@ Restarting Frigate will reset the rate limits.

 If you are running Frigate behind a proxy, you will want to set `trusted_proxies` or these rate limits will apply to the upstream proxy IP address. This means that a brute force attack will rate limit login attempts from other devices and could temporarily lock you out of your instance. In order to ensure rate limits only apply to the actual IP address where the requests are coming from, you will need to list the upstream networks that you want to trust. These trusted proxies are checked against the `X-Forwarded-For` header when looking for the IP address where the request originated.

-If you are running a reverse proxy in the same Docker Compose file as Frigate, configure rate limiting and trusted proxies as follows:
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Authentication" />.
-
-| Field                   | Description                                                                                                               |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| **Failed login limits** | Rate limit string for login failures (e.g., `1/second;5/minute;20/hour`)                                                  |
-| **Trusted proxies**     | List of upstream network CIDRs to trust for `X-Forwarded-For` (e.g., `172.18.0.0/16` for internal Docker Compose network) |
-
-</TabItem>
-<TabItem value="yaml">
+If you are running a reverse proxy in the same Docker Compose file as Frigate, here is an example of how your auth config might look:

 ```yaml
 auth:
@@ -88,12 +56,9 @@ auth:
    - 172.18.0.0/16 # <---- this is the subnet for the internal Docker Compose network
 ```

-</TabItem>
-</ConfigTabs>
-
 ## Session Length

-The default session length for user authentication in Frigate is 24 hours. This setting determines how long a user's authenticated session remains active before a token refresh is required. Otherwise, the user will need to log in again.
+The default session length for user authentication in Frigate is 24 hours. This setting determines how long a user's authenticated session remains active before a token refresh is required — otherwise, the user will need to log in again.

 While the default provides a balance of security and convenience, you can customize this duration to suit your specific security requirements and user experience preferences. The session length is configured in seconds.

@@ -102,24 +67,11 @@ The default value of `86400` will expire the authentication session after 24 hou
 - `0`: Setting the session length to 0 will require a user to log in every time they access the application or after a very short, immediate timeout.
 - `604800`: Setting the session length to 604800 will require a user to log in if the token is not refreshed for 7 days.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Authentication" />.
-
- Set **Session length** to the duration in seconds before the authentication session expires (default: 86400 / 24 hours)
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 auth:
  session_length: 86400
 ```

-</TabItem>
-</ConfigTabs>
-
 ## JWT Token Secret

 The JWT token secret needs to be kept secure. Anyone with this secret can generate valid JWT tokens to authenticate with Frigate. This should be a cryptographically random string of at least 64 characters.
@@ -143,22 +95,11 @@ Changing the secret will invalidate current tokens.

 ## Proxy configuration

-Frigate can be configured to leverage features of common upstream authentication proxies such as Authelia, Authentik, oauth2_proxy, or traefik-forward-auth. Frigate does not implement OIDC, SAML, or LDAP natively; as an NVR focused on recording and object detection, it relies on robust, battle-tested proxies to handle those protocols and passes the authenticated user and role through via headers (see below).
+Frigate can be configured to leverage features of common upstream authentication proxies such as Authelia, Authentik, oauth2_proxy, or traefik-forward-auth.

 If you are leveraging the authentication of an upstream proxy, you likely want to disable Frigate's authentication as there is no correspondence between users in Frigate's database and users authenticated via the proxy. Optionally, if communication between the reverse proxy and Frigate is over an untrusted network, you should set an `auth_secret` in the `proxy` config and configure the proxy to send the secret value as a header named `X-Proxy-Secret`. Assuming this is an untrusted network, you will also want to [configure a real TLS certificate](tls.md) to ensure the traffic can't simply be sniffed to steal the secret.

-To disable Frigate's authentication and ensure requests come only from your known proxy:
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > System > Authentication" />.
-   - Set **Enable authentication** to off
-2. Navigate to <NavPath path="Settings > System > Proxy" />.
-   - Set **Proxy secret** to `<some random long string>`
-
-</TabItem>
-<TabItem value="yaml">
+Here is an example of how to disable Frigate's authentication and also ensure the requests come only from your known proxy.

 ```yaml
 auth:
@@ -168,9 +109,6 @@ proxy:
  auth_secret: <some random long string>
 ```

-</TabItem>
-</ConfigTabs>
-
 You can use the following code to generate a random secret.

 ```shell
@@ -181,20 +119,6 @@ python3 -c 'import secrets; print(secrets.token_hex(64))'

 If you have disabled Frigate's authentication and your proxy supports passing a header with authenticated usernames and/or roles, you can use the `header_map` config to specify the header name so it is passed to Frigate. For example, the following will map the `X-Forwarded-User` and `X-Forwarded-Groups` values. Header names are not case sensitive. Multiple values can be included in the role header. Frigate expects that the character separating the roles is a comma, but this can be specified using the `separator` config entry.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Proxy" /> and configure the header mapping and separator settings.
-
-| Field                            | Description                                                                                          |
-| -------------------------------- | ---------------------------------------------------------------------------------------------------- |
-| **Separator character**          | Character separating multiple roles in the role header (default: comma). Authentik uses a pipe `\|`. |
-| **Header mapping > User header** | Header name for the authenticated username (e.g., `x-forwarded-user`)                                |
-| **Header mapping > Role header** | Header name for the authenticated role/groups (e.g., `x-forwarded-groups`)                           |
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 proxy:
  ...
@@ -204,45 +128,19 @@ proxy:
    role: x-forwarded-groups
 ```

-</TabItem>
-</ConfigTabs>
-
 Frigate supports `admin`, `viewer`, and custom roles (see below). When using port `8971`, Frigate validates these headers and subsequent requests use the headers `remote-user` and `remote-role` for authorization.

 A default role can be provided. Any value in the mapped `role` header will override the default.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Proxy" /> and set the default role.
-
-| Field            | Description                                                                                          |
-| ---------------- | ---------------------------------------------------------------------------------------------------- |
-| **Default role** | Fallback role when no role header is present (e.g., `viewer`), or `None (deny access)` to reject unmapped users |
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 proxy:
  ...
  default_role: viewer
 ```

-</TabItem>
-</ConfigTabs>
-
-Setting `default_role` to `none` denies access instead of falling back to a role. Any proxy-authenticated user whose headers do not match an explicit `role_map` entry receives a 403 response. This is useful when the upstream proxy authenticates a broader set of users than should reach Frigate, so that only mapped groups are allowed in.
-
-```yaml
-proxy:
-  ...
-  default_role: none
-```
-
 ## Role mapping

-In some environments, upstream identity providers (OIDC, SAML, LDAP, etc.) do not pass a Frigate-compatible role directly, but instead pass one or more group claims. To handle this, Frigate supports a `role_map` that translates upstream group names into Frigate's internal roles (`admin`, `viewer`, or custom). This is configurable via YAML in the configuration file:
+In some environments, upstream identity providers (OIDC, SAML, LDAP, etc.) do not pass a Frigate-compatible role directly, but instead pass one or more group claims. To handle this, Frigate supports a `role_map` that translates upstream group names into Frigate’s internal roles (`admin`, `viewer`, or custom).

 ```yaml
 proxy:
@@ -265,32 +163,19 @@ In this example:
 - If the proxy passes a role header containing `sysadmins` or `access-level-security`, the user is assigned the `admin` role.
 - If the proxy passes a role header containing `camera-viewer`, the user is assigned the `viewer` role.
 - If the proxy passes a role header containing `operators`, the user is assigned the `operator` custom role.
- If no mapping matches, Frigate falls back to `default_role` if configured, or denies access if `default_role` is `none`.
+- If no mapping matches, Frigate falls back to `default_role` if configured.
 - If `role_map` is not defined, Frigate assumes the role header directly contains `admin`, `viewer`, or a custom role name.

 **Note on matching semantics:**

 - Admin precedence: if the `admin` mapping matches, Frigate resolves the session to `admin` to avoid accidental downgrade when a user belongs to multiple groups (for example both `admin` and `viewer` groups).

-:::note
-
-If a user isn't getting the role you expect, enable debug logging to see exactly what headers Frigate is receiving from your proxy:
-
-```yaml
-logger:
-  default: info
-  logs:
-    frigate.api.auth: debug
-```
-
-:::
-
 #### Port Considerations

 **Authenticated Port (8971)**

 - Header mapping is **fully supported**.
- The `remote-role` header determines the user's privileges:
+- The `remote-role` header determines the user’s privileges:
  - **admin** → Full access (user management, configuration changes).
  - **viewer** → Read-only access.
  - **Custom roles** → Read-only access limited to the cameras defined in `auth.roles[role]`.
@@ -339,7 +224,7 @@ Frigate supports user roles to control access to certain features in the UI and

 - **admin**: Full access to all features, including user management and configuration.
 - **viewer**: Read-only access to the UI and API, including viewing cameras, review items, and historical footage. Configuration editor and settings in the UI are inaccessible.
- **Custom Roles**: Arbitrary role names (alphanumeric, dots/underscores) with specific camera permissions. These extend the system for granular access (e.g., "operator" for select cameras). The names `admin`, `viewer`, and `none` are reserved and cannot be used.
+- **Custom Roles**: Arbitrary role names (alphanumeric, dots/underscores) with specific camera permissions. These extend the system for granular access (e.g., "operator" for select cameras).

 ### Custom Roles and Camera Access

@@ -347,14 +232,6 @@ The viewer role provides read-only access to all cameras in the UI and API. Cust

 ### Role Configuration Example

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Users > Roles" /> to define custom roles and assign which cameras each role can access.
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml {11-16}
 cameras:
  front_door:
@@ -374,16 +251,13 @@ auth:
      - side_yard
 ```

-</TabItem>
-</ConfigTabs>
-
 If you want to provide access to all cameras to a specific user, just use the **viewer** role.

 ### Managing User Roles

 1. Log in as an **admin** user via port `8971` (preferred), or unauthenticated via port `5000`.
 2. Navigate to **Settings**.
-3. In the **Users** section, edit a user's role by selecting from available roles (admin, viewer, or custom).
+3. In the **Users** section, edit a user’s role by selecting from available roles (admin, viewer, or custom).
 4. In the **Roles** section, add/edit/delete custom roles (select cameras via switches). Deleting a role auto-reassigns users to "viewer".

 ### Role Enforcement
@@ -403,7 +277,7 @@ To use role-based access control, you must connect to Frigate via the **authenti

 1. Log in as an **admin** user via port `8971`.
 2. Navigate to **Settings > Users**.
-3. Edit a user's role by selecting **admin** or **viewer**.
+3. Edit a user’s role by selecting **admin** or **viewer**.

 ## API Authentication Guide

@@ -3,11 +3,6 @@ id: autotracking
 title: Camera Autotracking
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-import FaqItem from "@site/src/components/FaqItem";
-
 An ONVIF-capable, PTZ (pan-tilt-zoom) camera that supports relative movement within the field of view (FOV) can be configured to automatically track moving objects and keep them in the center of the frame.

 ![Autotracking example with zooming](/img/frigate-autotracking-example.gif)
@@ -34,44 +29,12 @@ A growing list of cameras and brands that have been reported by users to work wi

 First, set up a PTZ preset in your camera's firmware and give it a name. If you're unsure how to do this, consult the documentation for your camera manufacturer's firmware. Some tutorials for common brands: [Amcrest](https://www.youtube.com/watch?v=lJlE9-krmrM), [Reolink](https://www.youtube.com/watch?v=VAnxHUY5i5w), [Dahua](https://www.youtube.com/watch?v=7sNbc5U-k54).

-Configure the ONVIF connection and autotracking parameters for your camera. Specify the object types to track, a required zone the object must enter to begin autotracking, and the camera preset name you configured in your camera's firmware to return to when tracking has ended. Optionally, specify a delay in seconds before Frigate returns the camera to the preset.
+Edit your Frigate configuration file and enter the ONVIF parameters for your camera. Specify the object types to track, a required zone the object must enter to begin autotracking, and the camera preset name you configured in your camera's firmware to return to when tracking has ended. Optionally, specify a delay in seconds before Frigate returns the camera to the preset.

 An [ONVIF connection](cameras.md) is required for autotracking to function. Also, a [motion mask](masks.md) over your camera's timestamp and any overlay text is recommended to ensure they are completely excluded from scene change calculations when the camera is moving.

 Note that `autotracking` is disabled by default but can be enabled in the configuration or by MQTT.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Camera configuration > ONVIF" /> for the desired camera.
-
-**ONVIF Connection**
-
-| Field                  | Description                                                                                                                                                 |
-| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **ONVIF host**         | Host of the camera being connected to. HTTP is assumed by default; prefix with `https://` for HTTPS.                                                        |
-| **ONVIF port**         | ONVIF port for device (default: 8000)                                                                                                                       |
-| **ONVIF username**     | Username for login. Some devices require admin to access ONVIF.                                                                                             |
-| **ONVIF password**     | Password for login                                                                                                                                          |
-| **Disable TLS verify** | Skip TLS verification and disable digest auth for ONVIF (default: false)                                                                                    |
-| **ONVIF profile**      | ONVIF media profile to use for PTZ control, matched by token or name. If not set, the first profile with valid PTZ configuration is selected automatically. |
-
-**Autotracking**
-
-| Field                   | Description                                                                                                                          |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| **Enable Autotracking** | Enable or disable object autotracking (default: false)                                                                               |
-| **Calibrate on start**  | Calibrate the camera on startup by measuring PTZ motor speed (default: false)                                                        |
-| **Zoom mode**           | Zoom mode during autotracking: `disabled`, `absolute`, or `relative` (default: disabled)                                             |
-| **Zoom Factor**         | Controls zoom behavior on tracked objects, between 0.1 and 0.75. Lower keeps more scene visible; higher zooms in more (default: 0.3) |
-| **Tracked objects**     | List of object types to track (default: person)                                                                                      |
-| **Required Zones**      | Zones an object must enter to begin autotracking                                                                                     |
-| **Return Preset**       | Name of ONVIF preset in camera firmware to return to when tracking ends (default: home)                                              |
-| **Return timeout**      | Seconds to delay before returning to preset (default: 10)                                                                            |
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 cameras:
  ptzcamera:
@@ -89,10 +52,6 @@ cameras:
      password: admin
      # Optional: Skip TLS verification from the ONVIF server (default: shown below)
      tls_insecure: False
-      # Optional: ONVIF media profile to use for PTZ control, matched by token or name. (default: shown below)
-      # If not set, the first profile with valid PTZ configuration is selected automatically.
-      # Use this when your camera has multiple ONVIF profiles and you need to select a specific one.
-      profile: None
      # Optional: PTZ camera object autotracking. Keeps a moving object in
      # the center of the frame by automatically moving the PTZ camera.
      autotracking:
@@ -129,16 +88,13 @@ cameras:
        movement_weights: []
 ```

-</TabItem>
-</ConfigTabs>
-
 ## Calibration

 PTZ motors operate at different speeds. Performing a calibration will direct Frigate to measure this speed over a variety of movements and use those measurements to better predict the amount of movement necessary to keep autotracked objects in the center of the frame.

 Calibration is optional, but will greatly assist Frigate in autotracking objects that move across the camera's field of view more quickly.

-To begin calibration, set `calibrate_on_startup` for your camera to `True` and restart Frigate. Frigate will then make a series of small and large movements with your camera. Don't move the PTZ manually while calibration is in progress. Once complete, camera motion will stop and your config file will be automatically updated with a `movement_weights` parameter to be used in movement calculations. You should not modify this parameter manually.
+To begin calibration, set the `calibrate_on_startup` for your camera to `True` and restart Frigate. Frigate will then make a series of small and large movements with your camera. Don't move the PTZ manually while calibration is in progress. Once complete, camera motion will stop and your config file will be automatically updated with a `movement_weights` parameter to be used in movement calculations. You should not modify this parameter manually.

 After calibration has ended, your PTZ will be moved to the preset specified by `return_preset`.

@@ -162,13 +118,13 @@ Every PTZ camera is different, so autotracking may not perform ideally in every

 The object tracker in Frigate estimates the motion of the PTZ so that tracked objects are preserved when the camera moves. In most cases 5 fps is sufficient, but if you plan to track faster moving objects, you may want to increase this slightly. Higher frame rates (> 10fps) will only slow down Frigate and the motion estimator and may lead to dropped frames, especially if you are using experimental zooming.

-A fast [detector](object_detectors.md) is recommended. CPU detectors will not perform well or won't work at all. You can watch Frigate's [debug viewer](/usage/live#the-single-camera-view) for your camera to see a thicker colored box around the object currently being autotracked.
+A fast [detector](object_detectors.md) is recommended. CPU detectors will not perform well or won't work at all. You can watch Frigate's debug viewer for your camera to see a thicker colored box around the object currently being autotracked.

 ![Autotracking Debug View](/img/autotracking-debug.gif)

 A full-frame zone in `required_zones` is not recommended, especially if you've calibrated your camera and there are `movement_weights` defined in the configuration file. Frigate will continue to autotrack an object that has entered one of the `required_zones`, even if it moves outside of that zone.

-Some users have found it helpful to adjust the zone `inertia` value. See the [configuration reference](advanced/reference.md).
+Some users have found it helpful to adjust the zone `inertia` value. See the [configuration reference](index.md).

 ## Zooming

@@ -188,96 +144,30 @@ In security and surveillance, it's common to use "spotter" cameras in combinatio

 ## Troubleshooting and FAQ

-### Camera Compatibility
-
-<FaqItem id="which-ptz-camera-should-i-use-for-autotracking" question="Which PTZ camera should I use for autotracking?">
-
-See the community-maintained list of [ONVIF PTZ camera recommendations](cameras.md#onvif-ptz-camera-recommendations) for cameras and brands reported to work (and not work) with autotracking. This is not an exhaustive list that is frequently updated, so other cameras not listed may also work well. Frigate's autotracking was developed with a Dahua SD1A404XB-GNR (now sold as the EmpireTech PTZ1A4M-4X-S2), and Dahua / EmpireTech PTZs are the most consistently reported as working well.
-
-When comparing models:
-
- Verify ONVIF support first. See [Checking ONVIF camera support](#checking-onvif-camera-support) above.
- Favor a camera with a fast PTZ motor. Cameras with slow motors may fail [calibration](#calibration) and will struggle to keep up with objects that move across the field of view quickly.
-
-</FaqItem>
-
-<FaqItem id="does-autotracking-work-with-reolink-ptz-cameras" question="Does autotracking work with Reolink PTZ cameras?">
-
-No. Reolink cameras (including the TrackMix series) lack the ONVIF FOV RelativeMove firmware support that Frigate's autotracker requires, so autotracking will not work with any current Reolink PTZ. Their video streams and basic PTZ controls still work in Frigate. If you want object tracking on a Reolink PTZ, you will need to use the tracking feature built into the camera's firmware, which is proprietary and operates independently of Frigate.
-
-</FaqItem>
-
-<FaqItem id="im-seeing-an-error-in-the-logs-that-my-camera-is-still-in-onvif-moving-status-what-does-this-mean" question={"I'm seeing an error in the logs that my camera \"is still in ONVIF 'MOVING' status.\" What does this mean?"}>
-
-There are two possible known reasons for this (and perhaps others yet unknown): a slow PTZ motor or buggy camera firmware. Frigate uses an ONVIF parameter provided by the camera, `MoveStatus`, to determine when the PTZ's motor is moving or idle. According to some users, Hikvision PTZs (even with the latest firmware), are not updating this value after PTZ movement. Unfortunately there is no workaround to this bug in Hikvision firmware, so autotracking will not function correctly and should be disabled in your config. This may also be the case with other non-Hikvision cameras utilizing Hikvision firmware, such as some Annke models. In rare cases the vendor may provide fixed firmware on request; for example, Annke has supplied firmware that resolves this for the CZ504 (see the [camera recommendations list](cameras.md#onvif-ptz-camera-recommendations)).
-
-</FaqItem>
-
-<FaqItem id="calibration-seems-to-have-completed-but-the-camera-is-not-actually-moving-to-track-my-object-why" question="Calibration seems to have completed, but the camera is not actually moving to track my object. Why?">
-
-Some cameras have firmware that reports that FOV RelativeMove, the ONVIF command that Frigate uses for autotracking, is supported. However, if the camera does not pan or tilt when an object comes into the required zone, your camera's firmware does not actually support FOV RelativeMove. One such camera is the Uniview IPC672LR-AX4DUPK. It actually moves its zoom motor instead of panning and tilting and does not follow the ONVIF standard whatsoever.
-
-</FaqItem>
-
-### Calibration Issues
-
-<FaqItem id="i-tried-calibrating-my-camera-but-the-logs-show-that-it-is-stuck-at-0-and-frigate-is-not-starting-up" question="I tried calibrating my camera, but the logs show that it is stuck at 0% and Frigate is not starting up.">
-
-This is often caused by the same reason as the "MOVING" status error above - the `MoveStatus` ONVIF parameter is not changing due to a bug in your camera's firmware. Also, see the note above: Frigate's web UI and all other cameras will be unresponsive while calibration is in progress. This is expected and normal. But if you don't see log entries every few seconds for calibration progress, your camera is not compatible with autotracking.
-
-</FaqItem>
-
-<FaqItem id="frigate-reports-an-error-saying-that-calibration-has-failed-why" question="Frigate reports an error saying that calibration has failed. Why?">
-
-Calibration measures the amount of time it takes for Frigate to make a series of movements with your PTZ. This error message is recorded in the log if these values are too high for Frigate to support calibrated autotracking. This is often the case when your camera's motor or network connection is too slow or your camera's firmware doesn't report the motor status in a timely manner.
-
-Some things to try:
-
- If your camera's firmware has a PTZ or motor speed setting, set it to the fastest available speed and calibrate again.
- Run without calibration: remove the `movement_weights` line from your config, set `calibrate_on_startup` to `False`, and restart.
-
-If calibration consistently fails, this often means your camera's motor is too slow and autotracking will behave unpredictably or won't be able to keep up with moving objects.
-
-</FaqItem>
-
-<FaqItem id="autotracking-is-erratic-or-moves-the-camera-in-the-wrong-direction" question="Autotracking is erratic, moves the camera in the wrong direction, or zooms past my object. Why?">
-
-Frigate uses the `movement_weights` measured during calibration to predict how far the camera needs to move to keep an object centered, so inaccurate values produce movements that don't seem to make sense: overshooting, moving the opposite direction, or zooming in on an object's last known position and losing it entirely. This is almost always a calibration issue.
-
- Remove the `movement_weights` entry from your config and restart Frigate to run without calibration. If tracking improves, try recalibrating.
- Recalibrate several times. The `movement_weights` values should be close to each other after each run. If they vary significantly between runs, your camera may not be reporting its motor status reliably, and you may get better results without calibration.
- If you are using zooming, a high `zoom_factor` can cause the camera to zoom in too far and lose the object. Try a lower value.
-
-Remember to recalibrate whenever you change your `return_preset`, change your camera's detect `fps`, or enable zooming after calibrating with it disabled.
-
-</FaqItem>
-
-### Tracking Behavior
-
-<FaqItem id="the-autotracker-loses-track-of-my-object-why" question="The autotracker loses track of my object. Why?">
+### The autotracker loses track of my object. Why?

 There are many reasons this could be the case. If you are using experimental zooming, your `zoom_factor` value might be too high, the object might be traveling too quickly, the scene might be too dark, there are not enough details in the scene (for example, a PTZ looking down on a driveway or other monotone background without a sufficient number of hard edges or corners), or the scene is otherwise less than optimal for Frigate to maintain tracking.

 Your camera's shutter speed may also be set too low so that blurring occurs with motion. Check your camera's firmware to see if you can increase the shutter speed.

-Watching Frigate's debug view can help to determine a possible cause. The autotracked object will have a thicker colored box around it. If the camera consistently zooms in on the object and then loses it, see [Autotracking is erratic, moves the camera in the wrong direction, or zooms past my object. Why?](#autotracking-is-erratic-or-moves-the-camera-in-the-wrong-direction) above.
+Watching Frigate's debug view can help to determine a possible cause. The autotracked object will have a thicker colored box around it.

-</FaqItem>
+### I'm seeing an error in the logs that my camera "is still in ONVIF 'MOVING' status." What does this mean?

-<FaqItem id="im-seeing-this-error-in-the-logs-autotracker-motion-estimator-couldnt-get-transformations-what-does-this-mean" question={"I'm seeing this error in the logs: \"Autotracker: motion estimator couldn't get transformations\". What does this mean?"}>
+There are two possible known reasons for this (and perhaps others yet unknown): a slow PTZ motor or buggy camera firmware. Frigate uses an ONVIF parameter provided by the camera, `MoveStatus`, to determine when the PTZ's motor is moving or idle. According to some users, Hikvision PTZs (even with the latest firmware), are not updating this value after PTZ movement. Unfortunately there is no workaround to this bug in Hikvision firmware, so autotracking will not function correctly and should be disabled in your config. This may also be the case with other non-Hikvision cameras utilizing Hikvision firmware.
+
+### I tried calibrating my camera, but the logs show that it is stuck at 0% and Frigate is not starting up.
+
+This is often caused by the same reason as above - the `MoveStatus` ONVIF parameter is not changing due to a bug in your camera's firmware. Also, see the note above: Frigate's web UI and all other cameras will be unresponsive while calibration is in progress. This is expected and normal. But if you don't see log entries every few seconds for calibration progress, your camera is not compatible with autotracking.
+
+### I'm seeing this error in the logs: "Autotracker: motion estimator couldn't get transformations". What does this mean?

 To maintain object tracking during PTZ moves, Frigate tracks the motion of your camera based on the details of the frame. If you are seeing this message, it could mean that your `zoom_factor` may be set too high, the scene around your detected object does not have enough details (like hard edges or color variations), or your camera's shutter speed is too slow and motion blur is occurring. Try reducing `zoom_factor`, finding a way to alter the scene around your object, or changing your camera's shutter speed.

-</FaqItem>
+### Calibration seems to have completed, but the camera is not actually moving to track my object. Why?

-<FaqItem id="why-does-object-detection-pause-briefly-when-the-camera-moves" question="Why does object detection pause briefly when the camera moves?">
+Some cameras have firmware that reports that FOV RelativeMove, the ONVIF command that Frigate uses for autotracking, is supported. However, if the camera does not pan or tilt when an object comes into the required zone, your camera's firmware does not actually support FOV RelativeMove. One such camera is the Uniview IPC672LR-AX4DUPK. It actually moves its zoom motor instead of panning and tilting and does not follow the ONVIF standard whatsoever.

-When the PTZ moves, the entire frame changes at once. Frigate's motion detection treats sudden scene-wide changes (like a lightning flash, an infrared mode switch, or a camera move) specially and pauses detection momentarily until the scene stabilizes. This is expected and normal, and detection resumes shortly after the camera stops moving. If detection does not resume once the camera is stationary, use the [debug view](/usage/live#the-single-camera-view) to see what is happening.
+### Frigate reports an error saying that calibration has failed. Why?

-</FaqItem>
-
-<FaqItem id="can-i-turn-autotracking-on-and-off-automatically" question="Can I turn autotracking on and off automatically?">
-
-Yes. Autotracking can be toggled per camera at runtime over MQTT with the [`frigate/<camera_name>/ptz_autotracker/set`](../integrations/mqtt.md#frigatecamera_nameptz_autotrackerset) topic, and the [Home Assistant integration](../integrations/home-assistant.md) exposes a switch for it. This pairs well with the "spotter" camera automations described in [Usage applications](#usage-applications) above, for example only enabling autotracking at night or when nobody is home.
-
-</FaqItem>
+Calibration measures the amount of time it takes for Frigate to make a series of movements with your PTZ. This error message is recorded in the log if these values are too high for Frigate to support calibrated autotracking. This is often the case when your camera's motor or network connection is too slow or your camera's firmware doesn't report the motor status in a timely manner. You can try running without calibration (just remove the `movement_weights` line from your config and restart), but if calibration fails, this often means that autotracking will behave unpredictably.
@@ -3,18 +3,8 @@ id: bird_classification
 title: Bird Classification
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
 Bird classification identifies known birds using a quantized Tensorflow model. When a known bird is recognized, its common name will be added as a `sub_label`. This information is included in the UI, filters, as well as in notifications.

-:::info
-
-Bird classification requires a one-time internet connection to download the classification model and label map from GitHub. Once cached, models work fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
-
-:::
-
 ## Minimum System Requirements

 Bird classification runs a lightweight tflite model on the CPU, there are no significantly different system requirements than running Frigate itself.
@@ -25,18 +15,7 @@ The classification model used is the MobileNet INat Bird Classification, [availa

 ## Configuration

-Bird classification is disabled by default and must be enabled before it can be used. Bird classification is a global configuration setting.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Enrichments > Object classification" />.
-
- Set **Bird classification config > Bird classification** to on
- Set **Bird classification config > Minimum score** to the desired confidence score (default: 0.9)
-
-</TabItem>
-<TabItem value="yaml">
+Bird classification is disabled by default, it must be enabled in your config file before it can be used. Bird classification is a global configuration setting.

 ```yaml
 classification:
@@ -44,9 +23,6 @@ classification:
    enabled: true
 ```

-</TabItem>
-</ConfigTabs>
-
 ## Advanced Configuration

 Fine-tune bird classification with these optional parameters:
@@ -1,34 +1,20 @@
 # Birdseye

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
 In addition to Frigate's Live camera dashboard, Birdseye allows a portable heads-up view of your cameras to see what is going on around your property / space without having to watch all cameras that may have nothing happening. Birdseye allows specific modes that intelligently show and disappear based on what you care about.

-Birdseye can be viewed by adding the "Birdseye" camera to a Camera Group in the Web UI. Add a Camera Group by pressing the pencil icon in the sidebar on the Live page, and choose "Birdseye" as one of the cameras.
+Birdseye can be viewed by adding the "Birdseye" camera to a Camera Group in the Web UI. Add a Camera Group by pressing the "+" icon on the Live page, and choose "Birdseye" as one of the cameras.

 Birdseye can also be used in Home Assistant dashboards, cast to media devices, etc.

-:::note
-
-Each camera tile in Birdseye is composed from the frames of the stream assigned the `detect` role, so a camera's image quality in Birdseye matches its detect stream resolution rather than a higher-resolution recording stream. If a camera looks low quality in Birdseye, increasing the detect width and height (or assigning the `detect` role to a higher-resolution stream) is what affects it. See [setting up camera inputs](./cameras.md#setting-up-camera-inputs) for how roles are assigned.
-
-:::
-
 ## Birdseye Behavior

-### Birdseye Activity Types
+### Birdseye Modes

-Birdseye offers independent activity types that control when cameras are shown. Multiple activity types can be listed together.
+Birdseye offers different modes to customize which cameras show under which circumstances.

- **continuous:** The camera is always included
- **motion:** The camera is included when motion was detected within the last 30 seconds
- **all_objects:** The camera is included when a tracked object is present, active or stationary
- **alerts:** The camera is included while an alert review item is in progress
- **detections:** The camera is included while a detection review item is in progress
-
-`alerts` and `detections` follow the review item's own lifetime, so the camera is removed as soon as the review item ends. Which objects qualify for each is set in [review configuration](./review.md).
+- **continuous:** All cameras are always included
+- **motion:** Cameras that have detected motion within the last 30 seconds are included
+- **objects:** Cameras that have tracked an active object within the last 30 seconds are included

 ### Custom Birdseye Icon

@@ -36,60 +22,28 @@ A custom icon can be added to the birdseye background by providing a 180x180 ima

 ### Birdseye view override at camera level

-To include a camera in Birdseye view only for specific circumstances, or exclude it entirely, configure Birdseye at the camera level.
+If you want to include a camera in Birdseye view only for specific circumstances, or just don't include it at all, the Birdseye setting can be set at the camera level.

-<ConfigTabs>
-<TabItem value="ui">
-
-**Global settings:** Navigate to <NavPath path="Settings > System > Birdseye" /> to configure the default Birdseye behavior for all cameras.
-
-**Per-camera overrides:** Navigate to <NavPath path="Settings > Camera configuration > Birdseye" /> to override the activity types or disable Birdseye for a specific camera.
-
-| Field                  | Description                                                |
-| ---------------------- | ---------------------------------------------------------- |
-| **Enable Birdseye**    | Whether this camera appears in Birdseye view               |
-| **Activity types**     | Conditions that determine when to show the camera          |
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml {10-12,15-16}
+```yaml {8-10,12-14}
 # Include all cameras by default in Birdseye view
 birdseye:
  enabled: True
-  modes:
-    - continuous
+  mode: continuous

 cameras:
  front:
-    # Only include the "front" camera in Birdseye view when an alert is in progress
+    # Only include the "front" camera in Birdseye view when objects are detected
    birdseye:
-      modes:
-        - alerts
+      mode: objects
  back:
    # Exclude the "back" camera from Birdseye view
    birdseye:
      enabled: False
 ```

-</TabItem>
-</ConfigTabs>
-
 ### Birdseye Inactivity

-By default birdseye shows all cameras that have had the configured activity in the last 30 seconds. This threshold can be configured, and applies to the `motion` and `all_objects` activity types only.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Birdseye" />.
-
-| Field                    | Description                                                                 |
-| ------------------------ | --------------------------------------------------------------------------- |
-| **Inactivity threshold** | Seconds of inactivity before a camera is hidden from Birdseye (default: 30) |
-
-</TabItem>
-<TabItem value="yaml">
+By default birdseye shows all cameras that have had the configured activity in the last 30 seconds, this can be configured:

 ```yaml
 birdseye:
@@ -98,28 +52,12 @@ birdseye:
  inactivity_threshold: 15
 ```

-</TabItem>
-</ConfigTabs>
-
 ## Birdseye Layout

 ### Birdseye Dimensions

 The resolution and aspect ratio of birdseye can be configured. Resolution will increase the quality but does not affect the layout. Changing the aspect ratio of birdseye does affect how cameras are laid out.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Birdseye" />.
-
-| Field      | Description                                     |
-| ---------- | ----------------------------------------------- |
-| **Width**  | Birdseye output width in pixels (default: 1280) |
-| **Height** | Birdseye output height in pixels (default: 720) |
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 birdseye:
  enabled: True
@@ -127,27 +65,16 @@ birdseye:
  height: 720
 ```

-</TabItem>
-</ConfigTabs>
-
 ### Sorting cameras in the Birdseye view

-It is possible to override the order of cameras that are being shown in the Birdseye view. The order is set at the camera level (when using YAML).
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Birdseye" /> and in the **Camera order** field, use the drag handle next to each camera name to control the display order.
-
-</TabItem>
-<TabItem value="yaml">
+It is possible to override the order of cameras that are being shown in the Birdseye view.
+The order needs to be set at the camera level.

 ```yaml
 # Include all cameras by default in Birdseye view
 birdseye:
  enabled: True
-  modes:
-    - continuous
+  mode: continuous

 cameras:
  front:
@@ -160,26 +87,13 @@ cameras:
      order: 2
 ```

-</TabItem>
-</ConfigTabs>
-
 _Note_: Cameras are sorted by default using their name to ensure a constant view inside Birdseye.

 ### Birdseye Cameras

 It is possible to limit the number of cameras shown on birdseye at one time. When this is enabled, birdseye will show the cameras with most recent activity. There is a cooldown to ensure that cameras do not switch too frequently.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Birdseye" />.
-
-| Field                    | Description                                                                         |
-| ------------------------ | ----------------------------------------------------------------------------------- |
-| **Layout > Max cameras** | Maximum number of cameras shown at once (e.g., `1` for only the most active camera) |
-
-</TabItem>
-<TabItem value="yaml">
+For example, this can be configured to only show the most recently active camera.

 ```yaml {3-4}
 birdseye:
@@ -188,31 +102,13 @@ birdseye:
    max_cameras: 1
 ```

-</TabItem>
-</ConfigTabs>
-
 ### Birdseye Scaling

 By default birdseye tries to fit 2 cameras in each row and then double in size until a suitable layout is found. The scaling can be configured with a value between 1.0 and 5.0 depending on use case.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Birdseye" />.
-
-| Field                       | Description                                              |
-| --------------------------- | -------------------------------------------------------- |
-| **Layout > Scaling factor** | Camera scaling factor between 1.0 and 5.0 (default: 2.0) |
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml {3-4}
 birdseye:
  enabled: True
  layout:
    scaling_factor: 3.0
 ```
-
-</TabItem>
-</ConfigTabs>
@@ -3,8 +3,6 @@ id: camera_specific
 title: Camera Specific Configurations
 ---

-import NavPath from "@site/src/components/NavPath";
-
 :::note

 This page makes use of presets of FFmpeg args. For more information on presets, see the [FFmpeg Presets](/configuration/ffmpeg_presets) page.
@@ -150,34 +148,19 @@ WEB Digest Algorithm  - MD5

 Reolink has many different camera models with inconsistently supported features and behavior. The below table shows a summary of various features and recommendations.

-| Camera Resolution | Camera Generation         | Recommended Stream Type           | Additional Notes                                                                            |
-| ----------------- | ------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------- |
-| 5MP or lower      | All                       | http-flv                          | Stream is h264                                                                              |
-| 6MP or higher     | Latest (ex: Duo3, CX-8##) | http-flv with ffmpeg 8.0, or rtsp | This uses the new http-flv-enhanced over H265 which requires ffmpeg 8.0 (Frigate's default) |
-| 6MP or higher     | Older (ex: RLC-8##)       | rtsp                              |                                                                                             |
+| Camera Resolution | Camera Generation         | Recommended Stream Type           | Additional Notes                                                        |
+| ----------------- | ------------------------- | --------------------------------- | ----------------------------------------------------------------------- |
+| 5MP or lower      | All                       | http-flv                          | Stream is h264                                                          |
+| 6MP or higher     | Latest (ex: Duo3, CX-8##) | http-flv with ffmpeg 8.0, or rtsp | This uses the new http-flv-enhanced over H265 which requires ffmpeg 8.0 |
+| 6MP or higher     | Older (ex: RLC-8##)       | rtsp                              |                                                                         |

-Frigate works much better with newer Reolink cameras that are setup with the below options:
+Frigate works much better with newer reolink cameras that are setup with the below options:

 If available, recommended settings are:

 - `On, fluency first` this sets the camera to CBR (constant bit rate)
 - `Interframe Space 1x` this sets the iframe interval to the same as the frame rate

-#### Setup via the Add Camera Wizard
-
-The [Add Camera Wizard](cameras.md#adding-a-camera-with-the-add-camera-wizard) is the recommended way to add a standard Reolink camera. Before starting, make sure [HTTP is enabled](https://support.reolink.com/articles/360003452893-How-to-Access-Reolink-Cameras-NVRs-Home-Hub-Locally-via-Web-Browsers/) in the camera's advanced network settings. The wizard uses the camera's HTTP API to determine its resolution and choose the recommended stream type from the table above.
-
-1. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />.
-2. Choose **Manual selection** as the stream detection method and select **Reolink** as the camera brand.
-3. The wizard queries the camera and automatically uses an http-flv stream for cameras 5MP and lower, or an RTSP stream for higher resolution cameras.
-4. In the validation step, enable **Use stream compatibility mode** for http-flv streams when the wizard recommends it.
-
-If you use the **Probe camera** method instead, the discovered stream URLs will be RTSP. For Reolink cameras where http-flv is recommended, the wizard will show a warning in the validation step.
-
-The wizard covers standard single-camera setups. For two way talk, cameras connected through a Reolink NVR, or audio transcoding for WebRTC live view, configure the camera manually as shown below.
-
-#### Manual configuration
-
 According to [this discussion](https://github.com/blakeblackshear/frigate/issues/3235#issuecomment-1135876973), the http video streams seem to be the most reliable for Reolink.

 Cameras connected via a Reolink NVR can be connected with the http stream, use `channel[0..15]` in the stream url for the additional channels.
@@ -192,7 +175,7 @@ Reolink's latest cameras support two way audio via go2rtc and other applications

 NOTE: The RTSP stream can not be prefixed with `ffmpeg:`, as go2rtc needs to handle the stream to support two way audio.

-Ensure [HTTP is enabled](https://support.reolink.com/articles/360003452893-How-to-Access-Reolink-Cameras-NVRs-Home-Hub-Locally-via-Web-Browsers/) in the camera's advanced network settings. To use two way talk with Frigate, see the [Live view documentation](/configuration/live#two-way-talk).
+Ensure HTTP is enabled in the camera's advanced network settings. To use two way talk with Frigate, see the [Live view documentation](/configuration/live#two-way-talk).

 :::

@@ -204,7 +187,7 @@ go2rtc:
      - "ffmpeg:http://reolink_ip/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=username&password=password#video=copy#audio=copy#audio=opus"
    your_reolink_camera_sub:
      - "ffmpeg:http://reolink_ip/flv?port=1935&app=bcs&stream=channel0_ext.bcs&user=username&password=password"
-    # example for connecting to a Reolink camera that supports two way talk
+    # example for connectin to a Reolink camera that supports two way talk
    your_reolink_camera_twt:
      - "ffmpeg:http://reolink_ip/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=username&password=password#video=copy#audio=copy#audio=opus"
      - "rtsp://username:password@reolink_ip/Preview_01_sub"
@@ -242,14 +225,13 @@ cameras:
          roles:
            - detect
 ```
-
 </details>

 ### Unifi Protect Cameras

-:::note
+:::note 

-Unifi G5s cameras and newer need a Unifi Protect server to enable rtsps stream, it's not possible to enable it in standalone mode.
+Unifi G5s cameras and newer need a Unifi Protect server to enable rtsps stream, it's not posible to enable it in standalone mode.

 :::

@@ -264,7 +246,7 @@ go2rtc:
      - rtspx://192.168.1.1:7441/abcdefghijk
 ```

-[See the go2rtc docs for more information](https://github.com/AlexxIT/go2rtc/tree/v1.9.14#source-rtsp)
+[See the go2rtc docs for more information](https://github.com/AlexxIT/go2rtc/tree/v1.9.10#source-rtsp)

 In the Unifi 2.0 update Unifi Protect Cameras had a change in audio sample rate which causes issues for ffmpeg. The input rate needs to be set for record if used directly with unifi protect.

@@ -287,6 +269,7 @@ Some community members have found better performance on Wyze cameras by using an
 To use a USB camera (webcam) with Frigate, the recommendation is to use go2rtc's [FFmpeg Device](https://github.com/AlexxIT/go2rtc?tab=readme-ov-file#source-ffmpeg-device) support:

 - Preparation outside of Frigate:
+
  - Get USB camera path. Run `v4l2-ctl --list-devices` to get a listing of locally-connected cameras available. (You may need to install `v4l-utils` in a way appropriate for your Linux distribution). In the sample configuration below, we use `video=0` to correlate with a detected device path of `/dev/video0`
  - Get USB camera formats & resolutions. Run `ffmpeg -f v4l2 -list_formats all -i /dev/video0` to get an idea of what formats and resolutions the USB Camera supports. In the sample configuration below, we use a width of 1024 and height of 576 in the stream and detection settings based on what was reported back.
  - If using Frigate in a container (e.g. Docker on TrueNAS), ensure you have USB Passthrough support enabled, along with a specific Host Device (`/dev/video0`) + Container Device (`/dev/video0`) listed.
@@ -3,78 +3,6 @@ id: cameras
 title: Camera Configuration
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
-## Adding a camera with the Add Camera Wizard
-
-The Add Camera Wizard is the recommended way to add a camera. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />, or use it from the [setup wizard](../guides/getting_started.md#configuring-frigate) on a new install. The wizard connects to your camera, tests each stream, and writes the camera's configuration for you, including the [go2rtc](go2rtc.md) restream and the live view stream mapping, so a standard setup needs no hand-written YAML.
-
-### Step 1: Name and connection
-
-Enter a name for the camera along with its host or IP address and credentials, then choose how the wizard should find the camera's streams:
-
- **Probe camera** queries the camera over ONVIF (the ONVIF port is usually 80 or 8080) and asks it for its stream URLs. Some cameras use a separate ONVIF/service account rather than the device admin user, and some require **Use digest authentication** to be enabled.
- **Manual selection** builds a stream URL from a template for the camera brand you pick (Dahua/Amcrest/EmpireTech, Hikvision/Uniview/Annke, Ubiquiti, Reolink, Axis, TP-Link, or Foscam). Choose **Other** to enter a custom RTSP URL directly. Non-RTSP stream types must be [configured manually](#setting-up-camera-inputs).
-
-The name you enter is lowercased and spaces become underscores. If the result still isn't a valid config key, the wizard generates a safe name and stores what you typed as `friendly_name`.
-
-### Step 2: Probe or snapshot
-
-In probe mode, the wizard reports what the camera returned (manufacturer, model, firmware, profile count, and whether PTZ, presets, and [autotracking](autotracking.md) are supported) along with the RTSP URLs it discovered. Test each candidate to see its resolution, frame rate, and codecs together with a snapshot, then select the one you want to use.
-
-In manual mode, the wizard tests the templated URL and shows the same metadata and snapshot.
-
-If no RTSP URLs are found, the credentials may be wrong or the camera may not support ONVIF. Go back and use manual selection instead.
-
-### Step 3: Stream configuration
-
-Assign [roles](#setting-up-camera-inputs) to the stream, and use **Add Another Stream** to add the camera's other streams, for example a substream for `detect` alongside the main stream for `record`. At least one stream must have the `detect` role before you can continue.
-
-**Reduce connections to camera** routes that input through the go2rtc restream so Frigate and the live view share a single connection to the camera instead of each opening their own. See [restream](restream.md) for more detail.
-
-### Step 4: Validation and testing
-
-Connect each stream to get a live preview, an estimated bandwidth figure, and a list of validation results. The wizard checks for the most common misconfigurations, including:
-
- A detect resolution that is too high (increased resource usage) or too low for reliable detection, or one it could not probe at all
- A stream marked `record` whose audio codec is not AAC, or that has no audio at all
- A stream marked `audio` that carries no audio stream
- Using a restreamed input for the `record` role
- Brand-specific issues, such as an RTSP stream on a Reolink camera that should use http-flv, or a Dahua/Hikvision substream selected for `detect`
-
-**Use stream compatibility mode** passes the stream through go2rtc's ffmpeg module. Enable it if a stream fails to load after several attempts. Note that this also prevents [two way talk](/configuration/live#two-way-talk) from being detected for that stream.
-
-**Save New Camera** writes the configuration and starts the camera right away. No restart is required.
-
-Other features, including [hardware acceleration](hardware_acceleration_video.md), [two way talk](/configuration/live#two-way-talk), and audio transcoding, is configured after the camera has been added. For camera model specific quirks, see the [camera specific](camera_specific.md) docs.
-
-## Deleting a camera
-
-Click **Delete Camera** in <NavPath path="Settings > Global configuration > Camera management" />, choose the camera, and confirm. Deleting a camera requires the `admin` role and cannot be undone.
-
-:::warning
-
-Deleting a camera permanently removes its recordings, tracked objects, and configuration. If you only want to stop processing a camera, set its state to **Off** or **Disabled** in <NavPath path="Settings > Global configuration > Camera management" /> instead. See [camera state](/configuration/live#camera-state).
-
-:::
-
-Deleting a camera removes:
-
- The camera's section of your config file, along with its entries in any [role](authentication.md#user-roles) camera list. A custom role left with no cameras is removed as well.
- Every database record for the camera: tracked objects, review items, recordings, previews, timeline entries, the saved region grid, and [triggers](semantic_search.md#triggers).
- Every media file for the camera: recordings, snapshots, thumbnails, and preview clips.
-
-[Exports](/usage/exports) are kept by default, so saved footage survives the deletion of the camera it came from. Turn on **Also delete exports for this camera** in the confirmation step to remove those too.
-
-The camera's processes are stopped and the change takes effect immediately, so no restart is required. If the resulting config cannot be parsed, Frigate restores the previous config and reports an error instead of leaving Frigate in a broken state.
-
-Two things are not cleaned up for you:
-
- **go2rtc streams.** Frigate makes a best effort to stop a running [go2rtc](go2rtc.md) stream named after the camera, but stream entries in your config file remain and are recreated on the next restart. Remove them in <NavPath path="Settings > System > go2rtc streams" /> or in your config file.
- **Camera groups.** A deleted camera stays listed in any [camera group](#setting-up-camera-groups) that referenced it. The group skips the missing camera, so this is harmless, but you can edit the group to drop the stale entry.
-
 ## Setting Up Camera Inputs

 Several inputs can be configured for each camera and the role of each input can be mixed and matched based on your needs. This allows you to use a lower resolution stream for object detection, but create recordings from a higher resolution stream, or vice versa.
@@ -83,33 +11,11 @@ A camera is enabled by default but can be disabled by using `enabled: False`. Ca

 Each role can only be assigned to one input per camera. The options for roles are as follows:

-| Role         | Description                                                                                                  |
-| ------------ | ------------------------------------------------------------------------------------------------------------ |
-| `detect`     | Main feed for object detection. [docs](object_detectors.md)                                                  |
-| `record`     | Saves segments of the video feed based on configuration settings. [docs](record.md)                          |
-| `record_sub` | Saves segments of a second, lower quality stream with its own retention. [docs](record.md#sub-stream-recording) |
-| `audio`      | Feed for audio based detection. [docs](audio_detectors.md)                                                   |
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Camera configuration > Streams (FFmpeg)" />.
-
-| Field             | Description                                                         |
-| ----------------- | ------------------------------------------------------------------- |
-| **Camera inputs** | List of input stream definitions (paths and roles) for this camera. |
-
-For each input you can choose its source: select **Restream (go2rtc)** to pick an existing [go2rtc stream](restream.md) from a dropdown (Frigate uses the `rtsp://127.0.0.1:8554/<stream>` path and `preset-rtsp-restream` input args for that input automatically), or **Manual input path** to type the stream URL directly.
-
-Navigate to <NavPath path="Settings > Camera configuration > Object detection" />.
-
-| Field             | Description                                                                                            |
-| ----------------- | ------------------------------------------------------------------------------------------------------ |
-| **Detect width**  | Width (pixels) of frames used for the detect stream; leave empty to use the native stream resolution.  |
-| **Detect height** | Height (pixels) of frames used for the detect stream; leave empty to use the native stream resolution. |
-
-</TabItem>
-<TabItem value="yaml">
+| Role     | Description                                                                         |
+| -------- | ----------------------------------------------------------------------------------- |
+| `detect` | Main feed for object detection. [docs](object_detectors.md)                         |
+| `record` | Saves segments of the video feed based on configuration settings. [docs](record.md) |
+| `audio`  | Feed for audio based detection. [docs](audio_detectors.md)                          |

 ```yaml
 mqtt:
@@ -130,18 +36,7 @@ cameras:
      height: 720 # <- optional, by default Frigate tries to automatically detect resolution
 ```

-</TabItem>
-</ConfigTabs>
-
-Additional cameras are simply added under the camera configuration section.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and use the [Add Camera Wizard](#adding-a-camera-with-the-add-camera-wizard) to configure each additional camera.
-
-</TabItem>
-<TabItem value="yaml">
+Additional cameras are simply added to the config under the `cameras` entry.

 ```yaml
 mqtt: ...
@@ -151,9 +46,6 @@ cameras:
  side: ...
 ```

-</TabItem>
-</ConfigTabs>
-
 :::note

 If you only define one stream in your `inputs` and do not assign a `detect` role to it, Frigate will automatically assign it the `detect` role. Frigate will always decode a stream to support motion detection, Birdseye, the API image endpoints, and other features, even if you have disabled object detection with `enabled: False` in your config's `detect` section.
@@ -172,19 +64,7 @@ Not every PTZ supports ONVIF, which is the standard protocol Frigate uses to com

 :::

-Configure the ONVIF connection for your camera to enable PTZ controls.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > Camera configuration > ONVIF" /> and select your camera.
-   - Set **ONVIF host** to your camera's IP address, e.g.: `10.0.10.10`
-   - Set **ONVIF port** to your camera's ONVIF port, e.g.: `8000`
-   - Set **ONVIF username** to your camera's ONVIF username, e.g.: `admin`
-   - Set **ONVIF password** to your camera's ONVIF password, e.g.: `password`
-
-</TabItem>
-<TabItem value="yaml">
+Add the onvif section to your camera in your configuration file:

 ```yaml {4-8}
 cameras:
@@ -197,9 +77,6 @@ cameras:
      password: password
 ```

-</TabItem>
-</ConfigTabs>
-
 If the ONVIF connection is successful, PTZ controls will be available in the camera's WebUI.

 :::note
@@ -214,13 +91,6 @@ If your ONVIF camera does not require authentication credentials, you may still

 :::

-If a camera connects but fails to authenticate, two optional fields can help:
-
- `tls_insecure`: Skips TLS certificate verification and sends the ONVIF password as plaintext (`PasswordText`) instead of a hashed digest (`PasswordDigest`). Some cameras reject the digest token and only accept plaintext. This weakens connection security, so only enable it on a trusted local network.
- `ignore_time_mismatch`: ONVIF authentication tokens include a timestamp, and a camera will reject the token if its clock differs too much from Frigate's. Enabling this makes Frigate compensate for the time offset so authentication can still succeed. Running NTP on both the camera and the Frigate host is the recommended fix; only use this in a "safe" environment, as it slightly weakens token validation.
-
-If your camera has multiple ONVIF profiles, you can specify which one to use for PTZ control with the `profile` option, matched by token or name. When not set, Frigate selects the first profile with a valid PTZ configuration. Check the Frigate debug logs (`frigate.ptz.onvif: debug`) to see available profile names and tokens for your camera.
-
 An ONVIF-capable camera that supports relative movement within the field of view (FOV) can also be configured to automatically track moving objects and keep them in the center of the frame. For autotracking setup, see the [autotracking](autotracking.md) docs.

 ## ONVIF PTZ camera recommendations
@@ -250,7 +120,7 @@ The FeatureList on the [ONVIF Conformant Products Database](https://www.onvif.or
 | Hikvision DS-2DE3A404IWG-E/W |      ✅      |      ✅      |                                                                                                                                                                                                                                                                   |
 | Reolink                      |      ✅      |      ❌      |                                                                                                                                                                                                                                                                   |
 | Speco O8P32X                 |      ✅      |      ❌      |                                                                                                                                                                                                                                                                   |
-| Sunba 405-D20X               |      ✅      |      ❌      | Incomplete ONVIF support reported on original, and 4k models. All models are suspected incompatible.                                                                                                                                                              |
+| Sunba 405-D20X               |      ✅      |      ❌      | Incomplete ONVIF support reported on original, and 4k models. All models are suspected incompatable.                                                                                                                                                              |
 | Tapo                         |      ✅      |      ❌      | Many models supported, ONVIF Service Port: 2020                                                                                                                                                                                                                   |
 | Uniview IPC672LR-AX4DUPK     |      ✅      |      ❌      | Firmware says FOV relative movement is supported, but camera doesn't actually move when sending ONVIF commands                                                                                                                                                    |
 | Uniview IPC6612SR-X33-VG     |      ✅      |      ✅      | Leave `calibrate_on_startup` as `False`. A user has reported that zooming with `absolute` is working.                                                                                                                                                             |
@@ -258,15 +128,13 @@ The FeatureList on the [ONVIF Conformant Products Database](https://www.onvif.or

 ## Setting up camera groups

-Camera groups let you organize cameras together with a shared name and icon, making it easier to review and filter them. A default group for all cameras is always available.
+:::tip

-<ConfigTabs>
-<TabItem value="ui">
+It is recommended to set up camera groups using the UI.

-On the Live dashboard, press the **pencil icon** in the main navigation to add a new camera group. Configure the group name, select which cameras to include, choose an icon, and set the display order.
+:::

-</TabItem>
-<TabItem value="yaml">
+Cameras can be grouped together and assigned a name and icon, this allows them to be reviewed and filtered together. There will always be the default group for all cameras.

 ```yaml
 camera_groups:
@@ -278,9 +146,6 @@ camera_groups:
    order: 0
 ```

-</TabItem>
-</ConfigTabs>
-
 ## Two-Way Audio

 See the guide [here](/configuration/live/#two-way-talk)
@@ -1,378 +0,0 @@
---
-id: config
-title: Frigate Configuration
---
-
-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
-Frigate can be configured through the **Settings UI** or by editing the YAML configuration file directly. The Settings UI is the recommended approach. It provides validation and a guided experience for all configuration options.
-
-## Using the Settings UI
-
-The Settings UI groups every configuration option into sections that are listed in the left-hand menu. Each section presents a guided form with validation, so you don't need to remember the structure of the YAML or look up option names by hand.
-
-### Global vs. camera-level configuration
-
-Settings are organized into two scopes:
-
- **Global configuration**: values under <NavPath path="Settings > Global configuration" /> apply to every camera by default. This is where you set the baseline behavior for object detection, recording, snapshots, motion, and so on.
- **Camera configuration**: values under <NavPath path="Settings > Camera configuration" /> apply to a single camera. Use the camera selector button at the top of these pages to choose which camera you are editing.
-
-When a camera-level section is left untouched, the camera simply inherits the global values. Changing a value on a camera page **overrides** the global value for that camera only: the global setting and every other camera are unaffected. This mirrors how the YAML works, where a value set under `cameras.<name>` takes precedence over the same value set at the top level. See [Global and Camera-Level Configuration](./config_overrides.md) for the full details, including how lists and maps are handled and which settings must be enabled globally first.
-
-To undo an override and go back to inheriting from the parent scope, use the reset button at the bottom of the section:
-
- On a camera section, the button is labeled **Reset to Global** and restores the camera to the global value.
- On a global section, the button is labeled **Reset to Default** and restores Frigate's built-in default.
-
-Resetting asks for confirmation and cannot be undone once applied.
-
-### Saving changes and the Save All button
-
-Edits are not applied until you save them. As soon as you change a value, the UI tracks it as a pending change:
-
- The edited section shows a **Modified** badge, and the changed fields are highlighted.
- A **You have unsaved changes** notice appears above the section's **Save** and **Undo** buttons. **Save** commits just that section; **Undo** discards its pending edits.
-
-Because pending changes can span multiple sections (and multiple cameras), the header provides a **Save All** button that writes every pending change at once. Next to it, **Review pending changes** opens a summary that lists each pending edit with its scope (Global or a specific camera), the affected field, and the new value, so you can confirm exactly what will be written before committing. **Undo All** discards every pending change across all sections.
-
-### Restart-required indicators
-
-Most settings take effect immediately, but some require Frigate to restart before they apply. Fields that require a restart are marked with a small restart icon and a **Restart required** tooltip next to the field label.
-
-When you save a change that touches one of these fields, Frigate confirms the save and reminds you that a restart is needed (for example, _"Settings saved successfully. Restart Frigate to apply your changes."_). The notification includes a one-click **Restart Frigate** action so you can apply the change right away, or you can continue editing and restart later.
-
-### The colored dots in the camera configuration menu
-
-When you are working under <NavPath path="Settings > Camera configuration" />, small colored dots can appear next to a section's name in the menu. They give you an at-a-glance summary of that section's state for the selected camera:
-
- **Blue dot**: this section **overrides the global configuration**. One or more values in the section have been set specifically for this camera and differ from the global defaults.
- **Profile-colored dot**: when you are viewing a [camera profile](./profiles.md), a dot in that profile's assigned color indicates the section is **overridden by that profile**. Each profile is given its own distinct color so you can tell at a glance which sections it changes.
- **Amber dot**: this section has **unsaved changes**. It appears alongside the **Modified** badge whenever you have pending edits in the section that haven't been saved yet.
-
-Hover over any dot to see a tooltip describing what it means. Open a section to see exactly which fields are overridden: the section header indicates how many fields differ from the global (or base) configuration.
-
-## Configuration File Location
-
-For users who prefer to edit the YAML configuration file directly, it is recommended to start with a minimal configuration and add to it as described in [the getting started guide](../guides/getting_started.md).
-
- **Home Assistant App:** `/addon_configs/<addon_directory>/config.yml` (see [directory list](#accessing-app-config-dir))
- **All other installations:** Map to `/config/config.yml` inside the container
-
-It can be named `config.yml` or `config.yaml`, but if both files exist `config.yml` will be preferred and `config.yaml` will be ignored.
-
-A minimal starting configuration:
-
-```yaml
-mqtt:
-  enabled: False
-
-cameras:
-  dummy_camera: # <--- this will be changed to your actual camera later
-    enabled: False
-    ffmpeg:
-      inputs:
-        - path: rtsp://127.0.0.1:554/rtsp
-          roles:
-            - detect
-```
-
-## Accessing the Home Assistant App configuration directory {#accessing-app-config-dir}
-
-When running Frigate through the HA App, the Frigate `/config` directory is mapped to `/addon_configs/<addon_directory>` in the host, where `<addon_directory>` is specific to the variant of the Frigate App you are running.
-
-| App Variant                | Configuration directory                   |
-| -------------------------- | ----------------------------------------- |
-| Frigate                    | `/addon_configs/ccab4aaf_frigate`         |
-| Frigate (Full Access)      | `/addon_configs/ccab4aaf_frigate-fa`      |
-| Frigate Beta               | `/addon_configs/ccab4aaf_frigate-beta`    |
-| Frigate Beta (Full Access) | `/addon_configs/ccab4aaf_frigate-fa-beta` |
-
-**Whenever you see `/config` in the documentation, it refers to this directory.**
-
-If for example you are running the standard App variant and use the [VS Code App](https://github.com/hassio-addons/addon-vscode) to browse your files, you can click _File_ > _Open folder..._ and navigate to `/addon_configs/ccab4aaf_frigate` to access the Frigate `/config` directory and edit the `config.yaml` file. You can also use the built-in config editor in the Frigate UI.
-
-## VS Code Configuration Schema
-
-VS Code supports JSON schemas for automatically validating configuration files. You can enable this feature by adding `# yaml-language-server: $schema=http://frigate_host:5000/api/config/schema.json` to the beginning of the configuration file. Replace `frigate_host` with the IP address or hostname of your Frigate server. If you're using both VS Code and Frigate as an App, you should use `ccab4aaf-frigate` instead. Make sure to expose the internal unauthenticated port `5000` when accessing the config from VS Code on another machine.
-
-## Environment Variable Substitution
-
-Frigate supports the use of environment variables starting with `FRIGATE_` **only** where specifically indicated in the [reference config](./advanced/reference.md). See [substitution sources and precedence](./advanced/system.md#substitution-sources-and-precedence) for where those values can come from, including `secrets.yaml`. For example, the following values can be replaced at runtime by using environment variables:
-
-```yaml
-mqtt:
-  host: "{FRIGATE_MQTT_HOST}"
-  user: "{FRIGATE_MQTT_USER}"
-  password: "{FRIGATE_MQTT_PASSWORD}"
-```
-
-```yaml
- path: rtsp://{FRIGATE_RTSP_USER}:{FRIGATE_RTSP_PASSWORD}@10.0.10.10:8554/unicast
-```
-
-```yaml
-onvif:
-  host: "192.168.1.12"
-  port: 8000
-  user: "{FRIGATE_RTSP_USER}"
-  password: "{FRIGATE_RTSP_PASSWORD}"
-```
-
-```yaml
-go2rtc:
-  rtsp:
-    username: "{FRIGATE_GO2RTC_RTSP_USERNAME}"
-    password: "{FRIGATE_GO2RTC_RTSP_PASSWORD}"
-```
-
-```yaml
-genai:
-  my_provider:
-    api_key: "{FRIGATE_GENAI_API_KEY}"
-```
-
-## Common configuration examples
-
-Here are some common starter configuration examples. These can be configured through the Settings UI or via YAML. Refer to the [reference config](./advanced/reference.md) for detailed information about all config values.
-
-### Raspberry Pi Home Assistant App with USB Coral
-
- Single camera with 720p, 5fps stream for detect
- MQTT connected to the Home Assistant Mosquitto App
- Hardware acceleration for decoding video
- USB Coral detector
- Save all video with any detectable motion for 7 days regardless of whether any objects were detected or not
- Continue to keep all video if it qualified as an alert or detection for 30 days
- Save snapshots for 30 days
- Motion mask for the camera timestamp
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > System > MQTT" /> and configure the MQTT connection to your Home Assistant Mosquitto broker
-2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `Raspberry Pi (H.264)`
-3. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown
-4. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
-5. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
-6. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
-7. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> to add a motion mask for the camera timestamp
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-mqtt:
-  host: core-mosquitto
-  user: mqtt-user
-  password: xxxxxxxxxx
-
-ffmpeg:
-  hwaccel_args: preset-rpi-64-h264
-
-models:
-  - devices:
-      - edgetpu:usb
-
-record:
-  enabled: True
-  motion:
-    days: 7
-  alerts:
-    retain:
-      days: 30
-      mode: motion
-  detections:
-    retain:
-      days: 30
-      mode: motion
-
-snapshots:
-  enabled: True
-  retain:
-    default: 30
-
-cameras:
-  name_of_your_camera:
-    detect:
-      width: 1280
-      height: 720
-      fps: 5
-    ffmpeg:
-      inputs:
-        - path: rtsp://10.0.10.10:554/rtsp
-          roles:
-            - detect
-    motion:
-      mask:
-        timestamp:
-          friendly_name: "Camera timestamp"
-          enabled: true
-          coordinates: "0.000,0.427,0.002,0.000,0.999,0.000,0.999,0.781,0.885,0.456,0.700,0.424,0.701,0.311,0.507,0.294,0.453,0.347,0.451,0.400"
-```
-
-</TabItem>
-</ConfigTabs>
-
-### Standalone Intel Mini PC with USB Coral
-
- Single camera with 720p, 5fps stream for detect
- MQTT disabled (not integrated with Home Assistant)
- VAAPI hardware acceleration for decoding video
- USB Coral detector
- Save all video with any detectable motion for 7 days regardless of whether any objects were detected or not
- Continue to keep all video if it qualified as an alert or detection for 30 days
- Save snapshots for 30 days
- Motion mask for the camera timestamp
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > System > MQTT" /> and set **Enable MQTT** to off
-2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `VAAPI (Intel/AMD GPU)`
-3. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown
-4. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
-5. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
-6. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
-7. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> to add a motion mask for the camera timestamp
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-mqtt:
-  enabled: False
-
-ffmpeg:
-  hwaccel_args: preset-vaapi
-
-models:
-  - devices:
-      - edgetpu:usb
-
-record:
-  enabled: True
-  motion:
-    days: 7
-  alerts:
-    retain:
-      days: 30
-      mode: motion
-  detections:
-    retain:
-      days: 30
-      mode: motion
-
-snapshots:
-  enabled: True
-  retain:
-    default: 30
-
-cameras:
-  name_of_your_camera:
-    detect:
-      width: 1280
-      height: 720
-      fps: 5
-    ffmpeg:
-      inputs:
-        - path: rtsp://10.0.10.10:554/rtsp
-          roles:
-            - detect
-    motion:
-      mask:
-        timestamp:
-          friendly_name: "Camera timestamp"
-          enabled: true
-          coordinates: "0.000,0.427,0.002,0.000,0.999,0.000,0.999,0.781,0.885,0.456,0.700,0.424,0.701,0.311,0.507,0.294,0.453,0.347,0.451,0.400"
-```
-
-</TabItem>
-</ConfigTabs>
-
-### Home Assistant integrated Intel Mini PC with OpenVINO
-
- Single camera with 720p, 5fps stream for detect
- MQTT connected to same MQTT server as Home Assistant
- VAAPI hardware acceleration for decoding video
- OpenVINO detector
- Save all video with any detectable motion for 7 days regardless of whether any objects were detected or not
- Continue to keep all video if it qualified as an alert or detection for 30 days
- Save snapshots for 30 days
- Motion mask for the camera timestamp
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > System > MQTT" /> and configure the connection to your MQTT broker
-2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `VAAPI (Intel/AMD GPU)`
-3. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Intel GPU** from the **Hardware** dropdown
-4. On the same model, open the **Custom Model** tab and configure the OpenVINO model path and settings
-5. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
-6. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
-7. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
-8. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> to add a motion mask for the camera timestamp
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-mqtt:
-  host: 192.168.X.X # <---- same mqtt broker that home assistant uses
-  user: mqtt-user
-  password: xxxxxxxxxx
-
-ffmpeg:
-  hwaccel_args: preset-vaapi
-
-models:
-  - devices:
-      - openvino:AUTO
-    width: 300
-    height: 300
-    input_tensor: nhwc
-  input_pixel_format: bgr
-  path: /openvino-model/ssdlite_mobilenet_v2.xml
-  labelmap_path: /openvino-model/coco_91cl_bkgr.txt
-
-record:
-  enabled: True
-  motion:
-    days: 7
-  alerts:
-    retain:
-      days: 30
-      mode: motion
-  detections:
-    retain:
-      days: 30
-      mode: motion
-
-snapshots:
-  enabled: True
-  retain:
-    default: 30
-
-cameras:
-  name_of_your_camera:
-    detect:
-      width: 1280
-      height: 720
-      fps: 5
-    ffmpeg:
-      inputs:
-        - path: rtsp://10.0.10.10:554/rtsp
-          roles:
-            - detect
-    motion:
-      mask:
-        timestamp:
-          friendly_name: "Camera timestamp"
-          enabled: true
-          coordinates: "0.000,0.427,0.002,0.000,0.999,0.000,0.999,0.781,0.885,0.456,0.700,0.424,0.701,0.311,0.507,0.294,0.453,0.347,0.451,0.400"
-```
-
-</TabItem>
-</ConfigTabs>
@@ -1,244 +0,0 @@
---
-id: config_overrides
-title: Global and Camera-Level Configuration
---
-
-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
-Most of Frigate's configuration can be set once for all cameras and then adjusted for individual cameras. The global value acts as the default for every camera, and any camera can override it.
-
-This page explains how that inheritance works. For a tour of the Settings UI itself, see [Frigate Configuration](./config.md).
-
-## The basics
-
-Set a value globally and every camera uses it. Set the same value on a camera and that camera uses its own value instead.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > Global configuration > Object detection" /> and set **Detect FPS** to `5`. Every camera now detects at 5 fps.
-2. Navigate to <NavPath path="Settings > Camera configuration > Object detection" />, select the `driveway` camera, and set **Detect FPS** to `10`.
-
-The `driveway` camera now detects at 10 fps. Every other camera still uses the global value of 5.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-detect:
-  fps: 5 # every camera detects at 5 fps
-
-cameras:
-  front_door:
-    ffmpeg: ...
-  driveway:
-    ffmpeg: ...
-    detect:
-      fps: 10 # except this one
-```
-
-`front_door` inherits `fps: 5`, and `driveway` uses `10`.
-
-</TabItem>
-</ConfigTabs>
-
-## Overrides apply per value, not per section
-
-Overriding one value in a section does not detach the rest of that section. Everything you don't set on the camera still comes from the global configuration.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-If you set a camera's **Motion threshold** but leave **Contour area** alone, only the threshold is overridden. The contour area continues to follow <NavPath path="Settings > Global configuration > Motion detection" />, and changing it there still affects that camera.
-
-Open a section to see which values are overridden: the section header indicates how many fields differ from the global configuration.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-motion:
-  threshold: 30
-  contour_area: 10
-
-cameras:
-  driveway:
-    motion:
-      threshold: 40
-```
-
-The `driveway` camera ends up with `threshold: 40` and `contour_area: 10`. Only the value you wrote was overridden.
-
-</TabItem>
-</ConfigTabs>
-
-## Returning a camera to the global value
-
-<ConfigTabs>
-<TabItem value="ui">
-
-A camera section that has its own values shows an **Overridden** badge. To remove the override and go back to inheriting, use the **Reset to Global** button at the bottom of the section.
-
-</TabItem>
-<TabItem value="yaml">
-
-Frigate treats a camera value as an override because it is written in the config file, not because it differs from the global value. Repeating the global value under a camera still creates an override:
-
-```yaml
-snapshots:
-  enabled: true
-
-cameras:
-  driveway:
-    snapshots:
-      enabled: true # this is an override, even though it matches
-```
-
-If you later change the global `snapshots.enabled` to `false`, `driveway` keeps saving snapshots, because it has its own value. To make a camera follow the global value again, delete the key from the camera rather than setting it to match.
-
-</TabItem>
-</ConfigTabs>
-
-## Lists replace, maps merge
-
-This is the distinction that surprises people most.
-
-**Lists are replaced entirely.** A camera's list does not add to the global list, it takes its place.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-The camera page shows the objects the camera is currently tracking, starting from the global list. Changing that selection under <NavPath path="Settings > Camera configuration > Objects" /> replaces the list for that camera, so make sure every object you want tracked is selected, not just the ones you are adding.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-objects:
-  track:
-    - person
-    - car
-
-cameras:
-  backyard:
-    objects:
-      track:
-        - dog # backyard tracks ONLY dog, not person or car
-```
-
-To track `dog` in addition to the global objects, list all of them on the camera.
-
-</TabItem>
-</ConfigTabs>
-
-An empty list is a valid override, and is the normal way to opt a camera out of something:
-
-```yaml
-review:
-  alerts:
-    labels:
-      - person
-
-cameras:
-  street:
-    review:
-      alerts:
-        labels: [] # this camera never creates alerts
-```
-
-**Maps are merged key by key.** A camera can add an entry without redeclaring the others.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Adding a filter for one object under <NavPath path="Settings > Camera configuration > Objects" /> does not remove the filters inherited from <NavPath path="Settings > Global configuration > Objects" />. The camera keeps both.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-objects:
-  filters:
-    person:
-      min_area: 5000
-
-cameras:
-  driveway:
-    objects:
-      filters:
-        car:
-          min_area: 10000
-```
-
-The `driveway` camera ends up with both the `car` filter it defined and the `person` filter from the global configuration.
-
-</TabItem>
-</ConfigTabs>
-
-## Which settings can be overridden
-
-Most, but not all. The [full reference config](./advanced/reference.md) is the authoritative source: sections that support camera-level overrides are marked with the comment `# NOTE: Can be overridden at the camera level`. In the UI, a setting can be overridden if it appears under both <NavPath path="Settings > Global configuration" /> and <NavPath path="Settings > Camera configuration" />.
-
-A few things worth knowing beyond that:
-
- Some sections are **global only** and have no camera-level equivalent, including `go2rtc`, `genai` providers, `classification`, `telemetry`, `camera_groups`, and `ui`.
- Some sections exist **only at the camera level**, such as `zones` and `onvif`.
- Some sections are **partially overridable**, meaning a camera accepts only a few of the keys available globally. `face_recognition`, `lpr`, and `audio_transcription` work this way, and the reference config notes which keys apply.
-
-## Enrichments that must be enabled globally first
-
-License plate recognition and face recognition are special: the global setting is not just a default, it is a switch that must be on before any camera can use the feature. Enabling one on a camera while it is disabled globally is a configuration error, and Frigate will refuse to start:
-
-```
-Camera driveway has lpr enabled but lpr is disabled at the global level of the config. You must enable lpr at the global level.
-```
-
-Enable the feature globally, then turn it off on the cameras that don't need it.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-1. Navigate to <NavPath path="Settings > Global configuration > License plate recognition" /> and enable **LPR**.
-2. Navigate to <NavPath path="Settings > Camera configuration > License plate recognition" />, select each camera that should not run LPR, and disable the **Enable LPR** toggle.
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-lpr:
-  enabled: true
-
-cameras:
-  driveway:
-    ffmpeg: ... # inherits lpr, enabled
-  backyard:
-    ffmpeg: ...
-    lpr:
-      enabled: false # opted out
-```
-
-</TabItem>
-</ConfigTabs>
-
-:::note
-
-This applies only to `lpr` and `face_recognition`, because the global setting controls whether the supporting background process starts at all. Other features do not work this way. Audio transcription, for example, can be enabled on a single camera without being enabled globally.
-
-:::
-
-## Profiles
-
-[Profiles](./profiles.md) add a further layer on top of everything described above. A profile is a named set of camera overrides that you can switch on and off while Frigate is running, for example to change detection and recording behavior when you leave the house.
-
-Profiles are applied on top of a camera's already-resolved configuration, so a profile value wins over both the camera and the global value while that profile is active. Profiles cover a subset of the camera sections and do not modify your config file.
-
-## Summary
-
- A camera inherits every value you don't set on it.
- Overriding one value does not detach the rest of the section.
- Writing a value on a camera overrides it, even if it matches the global value. Remove it to inherit again.
- Lists replace the global list. Maps merge into it.
- An empty list is an override, not an omission.
- `lpr` and `face_recognition` must be enabled globally before a camera can use them.
@@ -3,23 +3,13 @@ id: object_classification
 title: Object Classification
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
 Object classification allows you to train a custom MobileNetV2 classification model to run on tracked objects (persons, cars, animals, etc.) to identify a finer category or attribute for that object. Classification results are visible in the Tracked Object Details pane in Explore, through the `frigate/tracked_object_details` MQTT topic, in Home Assistant sensors via the official Frigate integration, or through the event endpoints in the HTTP API.

-:::info
-
-Training a custom object classification model requires an internet connection to download MobileNetV2 base weights. By default these weights are not cached in `/config/`, so they are downloaded again after the container is recreated. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
-
-:::
-
 ## Minimum System Requirements

 Object classification models are lightweight and run very fast on CPU.

-Training the model does briefly use a high amount of system resources for about 1-3 minutes per training run. On lower-power devices, training may take longer.
+Training the model does briefly use a high amount of system resources for about 1–3 minutes per training run. On lower-power devices, training may take longer.

 A CPU with AVX + AVX2 instructions is required for training and inference.

@@ -37,7 +27,7 @@ For object classification:
 ### Classification Type

 - **Sub label**:
-  - Applied to the object's `sub_label` field.
+  - Applied to the object’s `sub_label` field.
  - Ideal for a single, more specific identity or type.
  - Example: `cat` → `Leo`, `Charlie`, `None`.

@@ -65,7 +55,7 @@ This two-step verification prevents false positives by requiring consistent pred

 ### Sub label

- **Known pet vs unknown**: For `dog` objects, set sub label to your pet's name (e.g., `buddy`) or `none` for others.
+- **Known pet vs unknown**: For `dog` objects, set sub label to your pet’s name (e.g., `buddy`) or `none` for others.
 - **Mail truck vs normal car**: For `car`, classify as `mail_truck` vs `car` to filter important arrivals.
 - **Delivery vs non-delivery person**: For `person`, classify `delivery` vs `visitor` based on uniform/props.

@@ -78,27 +68,7 @@ This two-step verification prevents false positives by requiring consistent pred

 ## Configuration

-Object classification is configured as a custom classification model. Each model has its own name and settings. Specify which object labels should be classified.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to the **Classification** page from the main navigation sidebar, then click **Add Classification**.
-
-In the **Create New Classification** dialog:
-
-| Field                   | Description                                                   |
-| ----------------------- | ------------------------------------------------------------- |
-| **Name**                | A name for your classification model (e.g., `dog`)            |
-| **Type**                | Select **Object** for object classification                   |
-| **Object Label**        | The object label to classify (e.g., `dog`, `person`, `car`)   |
-| **Classification Type** | Whether to assign results as a **Sub Label** or **Attribute** |
-| **Classes**             | The class names the model will learn to distinguish between   |
-
-The `threshold` (default: `0.8`) can be adjusted in the YAML configuration.
-
-</TabItem>
-<TabItem value="yaml">
+Object classification is configured as a custom classification model. Each model has its own name and settings. You must list which object labels should be classified.

 ```yaml
 classification:
@@ -112,9 +82,6 @@ classification:

 An optional config, `save_attempts`, can be set as a key under the model name. This defines the number of classification attempts to save in the Recent Classifications tab. For object classification models, the default is 200.

-</TabItem>
-</ConfigTabs>
-
 ## Training the model

 Creating and training the model is done within the Frigate UI using the `Classification` page. The process consists of two steps:
@@ -135,47 +102,18 @@ If examples for some of your classes do not appear in the grid, you can continue

 ### Improving the Model

-:::tip Diversity matters far more than volume
-
-Selecting dozens of nearly identical images is one of the fastest ways to degrade model performance. MobileNetV2 can overfit quickly when trained on homogeneous data. The model learns what _that exact moment_ looked like rather than what actually defines the class. **This is why Frigate does not implement bulk training in the UI.**
-
-For more detail, see [Frigate Tip: Best Practices for Training Face and Custom Classification Models](https://github.com/blakeblackshear/frigate/discussions/21374).
-
-:::
-
- **Start small and iterate**: Begin with a small, representative set of images per class. Models often begin working well with surprisingly few examples and improve naturally over time.
- **Favor hard examples**: When images appear in the Recent Classifications tab, prioritize images scoring below 90-100% or those captured under new lighting, weather, or distance conditions.
- **Avoid bulk training similar images**: Training large batches of images that already score 100% (or close) adds little new information and increases the risk of overfitting.
- **The wizard is just the starting point**: You don't need to find and label every class upfront. Missing classes will naturally appear in Recent Classifications, and those images tend to be more valuable because they represent new conditions and edge cases.
 - **Problem framing**: Keep classes visually distinct and relevant to the chosen object types.
- **Preprocessing**: Ensure examples reflect object crops similar to Frigate's boxes; keep the subject centered.
- **Crop size**: Aim for crops of at least 100×100 pixels (a 10,000 pixel area). Crops smaller than ~80×80 get stretched 3-7× by the model's 224×224 input resize and tend to collapse into a generic "blob" region of feature space where identity becomes unreliable. If most of your detections are small because the camera is far from the subject, consider repositioning the camera for closer crops.
- **Class balance**: Aim to keep your largest class within ~3× the count of your smallest. Beyond that, the model becomes biased toward the dominant class and tends to default borderline predictions to it (the "everything looks like Buddy" failure mode).
+- **Data collection**: Use the model’s Recent Classification tab to gather balanced examples across times of day, weather, and distances.
+- **Preprocessing**: Ensure examples reflect object crops similar to Frigate’s boxes; keep the subject centered.
+- **Labels**: Keep label names short and consistent; include a `none` class if you plan to ignore uncertain predictions for sub labels.
 - **Threshold**: Tune `threshold` per model to reduce false assignments. Start at `0.8` and adjust based on validation.

-:::tip `none` works differently from named classes
-
-Named classes work best with visually uniform examples. Every Buddy photo should look like Buddy. The `none` class needs the opposite: visual diversity across sizes, framings, and qualities, because at inference it has to absorb everything that isn't one of your named classes. Don't apply the same "only keep large, well-framed images" rule to `none` that you would to a named class. Mix in small crops, partial views, and false positives deliberately - otherwise the model has no signal for "small/ambiguous thing = not one of my known classes" and will force those crops into a named class by default.
-
-:::
-
 ## Debugging Classification Models

 To troubleshoot issues with object classification models, enable debug logging to see detailed information about classification attempts, scores, and consensus calculations.

 Enable debug logs for classification models by adding `frigate.data_processing.real_time.custom_classification: debug` to your `logger` configuration. These logs are verbose, so only keep this enabled when necessary. Restart Frigate after this change.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Logging" />.
-
- Set **Logging level** to `debug`
- Set **Per-process log level > `frigate.data_processing.real_time.custom_classification`** to `debug` for verbose classification logging
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 logger:
  default: info
@@ -184,9 +122,6 @@ logger:
    frigate.data_processing.real_time.custom_classification: debug
 ```

-</TabItem>
-</ConfigTabs>
-
 The debug logs will show:

 - Classification probabilities for each attempt
@@ -3,23 +3,13 @@ id: state_classification
 title: State Classification
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-
 State classification allows you to train a custom MobileNetV2 classification model on a fixed region of your camera frame(s) to determine a current state. The model can be configured to run on a schedule and/or when motion is detected in that region. Classification results are available through the `frigate/<camera_name>/classification/<model_name>` MQTT topic and in Home Assistant sensors via the official Frigate integration.

-:::info
-
-Training a custom state classification model requires an internet connection to download MobileNetV2 base weights. By default these weights are not cached in `/config/`, so they are downloaded again after the container is recreated. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
-
-:::
-
 ## Minimum System Requirements

 State classification models are lightweight and run very fast on CPU.

-Training the model does briefly use a high amount of system resources for about 1-3 minutes per training run. On lower-power devices, training may take longer.
+Training the model does briefly use a high amount of system resources for about 1–3 minutes per training run. On lower-power devices, training may take longer.

 A CPU with AVX + AVX2 instructions is required for training and inference.

@@ -43,25 +33,7 @@ For state classification:

 ## Configuration

-State classification is configured as a custom classification model. Each model has its own name and settings. Provide at least one camera crop under `state_config.cameras`.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to the **Classification** page from the main navigation sidebar, select the **States** tab, then click **Add Classification**.
-
-In the **Create New Classification** dialog:
-
-| Field       | Description                                                                          |
-| ----------- | ------------------------------------------------------------------------------------ |
-| **Name**    | A name for your state classification model (e.g., `front_door`)                      |
-| **Type**    | Select **State** for state classification                                            |
-| **Classes** | The state names the model will learn to distinguish between (e.g., `open`, `closed`) |
-
-After creating the model, the wizard will guide you through selecting the camera crop area and assigning training examples. The `threshold` (default: `0.8`), `motion`, and `interval` settings can be adjusted in the YAML configuration.
-
-</TabItem>
-<TabItem value="yaml">
+State classification is configured as a custom classification model. Each model has its own name and settings. You must provide at least one camera crop under `state_config.cameras`.

 ```yaml
 classification:
@@ -73,18 +45,11 @@ classification:
        interval: 10 # also run every N seconds (optional)
        cameras:
          front:
-            # [x1, y1, x2, y2] as decimals between 0 and 1, relative to the
-            # camera's detect resolution
-            crop: [0.0, 0.25, 0.3, 0.85]
+            crop: [0, 180, 220, 400]
 ```

-Crop coordinates are normalized: each value is a fraction of the camera's `detect` width or height, not a pixel value. Drawing the crop in the UI wizard writes these values for you.
-
 An optional config, `save_attempts`, can be set as a key under the model name. This defines the number of classification attempts to save in the Recent Classifications tab. For state classification models, the default is 100.

-</TabItem>
-</ConfigTabs>
-
 ## Training the model

 Creating and training the model is done within the Frigate UI using the `Classification` page. The process consists of three steps:
@@ -105,21 +70,10 @@ Once some images are assigned, training will begin automatically.

 ### Improving the Model

-:::tip Diversity matters far more than volume
-
-Selecting dozens of nearly identical images is one of the fastest ways to degrade model performance. MobileNetV2 can overfit quickly when trained on homogeneous data. The model learns what _that exact moment_ looked like rather than what actually defines the state. This often leads to models that work perfectly under the original conditions but become unstable when day turns to night, weather changes, or seasonal lighting shifts. **This is why Frigate does not implement bulk training in the UI.**
-
-For more detail, see [Frigate Tip: Best Practices for Training Face and Custom Classification Models](https://github.com/blakeblackshear/frigate/discussions/21374).
-
-:::
-
- **Start small and iterate**: Begin with a small, representative set of images per class. Models often begin working well with surprisingly few examples and improve naturally over time.
 - **Problem framing**: Keep classes visually distinct and state-focused (e.g., `open`, `closed`, `unknown`). Avoid combining object identity with state in a single model unless necessary.
 - **Data collection**: Use the model's Recent Classifications tab to gather balanced examples across times of day and weather.
 - **When to train**: Focus on cases where the model is entirely incorrect or flips between states when it should not. There's no need to train additional images when the model is already working consistently.
- **Favor hard examples**: When images appear in the Recent Classifications tab, prioritize images scoring below 90-100% or those captured under new conditions (e.g., first snow of the year, seasonal changes, objects temporarily in view, insects at night). These represent scenarios different from the default state and help prevent overfitting.
- **Avoid bulk training similar images**: Training large batches of images that already score 100% (or close) adds little new information and increases the risk of overfitting.
- **The wizard is just the starting point**: You don't need to find and label every state upfront. Missing states will naturally appear in Recent Classifications, and those images tend to be more valuable because they represent new conditions and edge cases.
+- **Selecting training images**: Images scoring below 100% due to new conditions (e.g., first snow of the year, seasonal changes) or variations (e.g., objects temporarily in view, insects at night) are good candidates for training, as they represent scenarios different from the default state. Training these lower-scoring images that differ from existing training data helps prevent overfitting. Avoid training large quantities of images that look very similar, especially if they already score 100% as this can lead to overfitting.

 ## Debugging Classification Models

@@ -127,17 +81,6 @@ To troubleshoot issues with state classification models, enable debug logging to

 Enable debug logs for classification models by adding `frigate.data_processing.real_time.custom_classification: debug` to your `logger` configuration. These logs are verbose, so only keep this enabled when necessary. Restart Frigate after this change.

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > System > Logging" />.
-
- Set **Logging level** to `debug`
- Set **Per-process log level > `frigate.data_processing.real_time.custom_classification`** to `debug` for verbose classification logging
-
-</TabItem>
-<TabItem value="yaml">
-
 ```yaml
 logger:
  default: info
@@ -146,9 +89,6 @@ logger:
    frigate.data_processing.real_time.custom_classification: debug
 ```

-</TabItem>
-</ConfigTabs>
-
 The debug logs will show:

 - Classification probabilities for each attempt
@@ -3,19 +3,8 @@ id: face_recognition
 title: Face Recognition
 ---

-import ConfigTabs from "@site/src/components/ConfigTabs";
-import TabItem from "@theme/TabItem";
-import NavPath from "@site/src/components/NavPath";
-import FaqItem from "@site/src/components/FaqItem";
-
 Face recognition identifies known individuals by matching detected faces with previously learned facial data. When a known `person` is recognized, their name will be added as a `sub_label`. This information is included in the UI, filters, as well as in notifications.

-:::info
-
-Face recognition requires a one-time internet connection to download detection and embedding models from GitHub. Once cached, models work fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
-
-:::
-
 ## Model Requirements

 ### Face Detection
@@ -51,115 +40,56 @@ The `large` model is optimized for accuracy, an integrated or discrete GPU / NPU

 ## Configuration

-Face recognition is disabled by default and must be enabled before it can be used. Face recognition is a global configuration setting.
-
-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Enrichments > Face recognition" />.
-
- Set **Enable face recognition** to on
-
-</TabItem>
-<TabItem value="yaml">
+Face recognition is disabled by default, face recognition must be enabled in the UI or in your config file before it can be used. Face recognition is a global configuration setting.

 ```yaml
 face_recognition:
  enabled: true
 ```

-</TabItem>
-</ConfigTabs>
-
 Like the other real-time processors in Frigate, face recognition runs on the camera stream defined by the `detect` role in your config. To ensure optimal performance, select a suitable resolution for this stream in your camera's firmware that fits your specific scene and requirements.

 ## Advanced Configuration

-Fine-tune face recognition with these optional parameters. The only optional parameters that can be set at the camera level are `enabled` and `min_area`.
+Fine-tune face recognition with these optional parameters at the global level of your config. The only optional parameters that can be set at the camera level are `enabled` and `min_area`.

 ### Detection

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Enrichments > Face recognition" />.
-
- **Detection threshold**: Face detection confidence score required before recognition runs. This field only applies to the standalone face detection model; `min_score` should be used to filter for models that have face detection built in.
+- `detection_threshold`: Face detection confidence score required before recognition runs:
  - Default: `0.7`
- **Minimum face area**: Minimum size (in pixels) a face must be before recognition runs. Depending on the resolution of your camera's `detect` stream, you can increase this value to ignore small or distant faces.
-  - Default: `750` pixels
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-face_recognition:
-  enabled: true
-  detection_threshold: 0.7
-  min_area: 750
-```
-
-</TabItem>
-</ConfigTabs>
+  - Note: This is field only applies to the standalone face detection model, `min_score` should be used to filter for models that have face detection built in.
+- `min_area`: Defines the minimum size (in pixels) a face must be before recognition runs.
+  - Default: `500` pixels.
+  - Depending on the resolution of your camera's `detect` stream, you can increase this value to ignore small or distant faces.

 ### Recognition

-<ConfigTabs>
-<TabItem value="ui">
-
-Navigate to <NavPath path="Settings > Enrichments > Face recognition" />.
-
- **Model size**: Which model size to use, options are `small` or `large`.
- **Unknown score threshold**: Min score to mark a person as a potential match; matches at or below this will be marked as unknown.
-  - Default: `0.8`
- **Recognition threshold**: Recognition confidence score required to add the face to the object as a sub label.
-  - Default: `0.9`
- **Minimum faces**: Min face recognitions for the sub label to be applied to the person object.
+- `model_size`: Which model size to use, options are `small` or `large`
+- `unknown_score`: Min score to mark a person as a potential match, matches at or below this will be marked as unknown.
+  - Default: `0.8`.
+- `recognition_threshold`: Recognition confidence score required to add the face to the object as a sub label.
+  - Default: `0.9`.
+- `min_faces`: Min face recognitions for the sub label to be applied to the person object.
  - Default: `1`
- **Save attempts**: Number of images of recognized faces to save for training.
-  - Default: `200`
- **Blur confidence filter**: Enables a filter that calculates how blurry the face is and adjusts the confidence based on this.
-  - Default: `True`
- **Device**: Target a specific device to run the face recognition model on (multi-GPU installation). This setting is only applicable when using the `large` model. See [onnxruntime's provider options](https://onnxruntime.ai/docs/execution-providers/).
-  - Default: `None`
-
-</TabItem>
-<TabItem value="yaml">
-
-```yaml
-face_recognition:
-  enabled: true
-  model_size: small
-  unknown_score: 0.8
-  recognition_threshold: 0.9
-  min_faces: 1
-  save_attempts: 200
-  blur_confidence_filter: true
-  device: None
-```
-
-</TabItem>
-</ConfigTabs>
+- `save_attempts`: Number of images of recognized faces to save for training.
+  - Default: `200`.
+- `blur_confidence_filter`: Enables a filter that calculates how blurry the face is and adjusts the confidence based on this.
+  - Default: `True`.
+- `device`: Target a specific device to run the face recognition model on (multi-GPU installation).
+  - Default: `None`.
+  - Note: This setting is only applicable when using the `large` model. See [onnxruntime's provider options](https://onnxruntime.ai/docs/execution-providers/)

 ## Usage

 Follow these steps to begin:

-1. **Enable face recognition** in your configuration and restart Frigate.
+1. **Enable face recognition** in your configuration file and restart Frigate.
 2. **Upload one face** using the **Add Face** button's wizard in the Face Library section of the Frigate UI. Read below for the best practices on expanding your training set.
 3. When Frigate detects and attempts to recognize a face, it will appear in the **Train** tab of the Face Library, along with its associated recognition confidence.
 4. From the **Train** tab, you can **assign the face** to a new or existing person to improve recognition accuracy for the future.

 ## Creating a Robust Training Set

-:::tip
-
-**The short version:** Start with a few clear, front-facing photos of each person. As faces are detected in the Recent Recognitions tab, train clear images that scored lower, adding variety (different angles, lighting, and expressions) slowly. Diversity matters far more than volume, and low-quality images hurt recognition more than they help.
-
-For a step-by-step narrative of these best practices (and the same principles applied to state and object classification), see the [Frigate Tips: Best Practices for Training](https://github.com/blakeblackshear/frigate/discussions/21374) discussion.
-
-:::
-
 The number of images needed for a sufficient training set for face recognition varies depending on several factors:

 - Diversity of the dataset: A dataset with diverse images, including variations in lighting, pose, and facial expressions, will require fewer images per person than a less diverse dataset.
@@ -180,7 +110,7 @@ When choosing images to include in the face training set it is recommended to al
 - If it is difficult to make out details in a persons face it will not be helpful in training.
 - Avoid images with extreme under/over-exposure.
 - Avoid blurry / pixelated images.
- Avoid training on infrared (gray-scale). The models are trained on color images and will not be able to extract features from gray-scale images.
+- Avoid training on infrared (gray-scale). The models are trained on color images and will be able to extract features from gray-scale images.
 - Using images of people wearing hats / sunglasses may confuse the model.
 - Do not upload too many similar images at the same time, it is recommended to train no more than 4-6 similar images for each person to avoid over-fitting.

@@ -190,27 +120,9 @@ When choosing images to include in the face training set it is recommended to al

 The Recent Recognitions tab in the face library displays recent face recognition attempts. Detected face images are grouped according to the person they were identified as potentially matching.

-Each face image is labeled with a name (or `Unknown`) along with the confidence score of that recognition attempt. Images are grouped by the person they were matched against, not by who they actually are, so a group labeled with a person's name can contain a crop that is really someone else but happened to score as a partial match. The name and score shown on each individual crop describe that single attempt.
+Each face image is labeled with a name (or `Unknown`) along with the confidence score of the recognition attempt. While each image can be used to train the system for a specific person, not all images are suitable for training.

-While each image can be used to train the system for a specific person, not all images are suitable for training. Refer to the guidelines below for best practices on selecting images for training.
-
-### How Frigate Decides Who a Person Is
-
-Recognition does not happen one frame at a time. While a `person` is in view, Frigate runs face recognition on many frames, not just a single frame. The final `sub_label` is decided from all of those attempts together, weighted by the area of each face (larger, closer faces count more), not from any single frame.
-
-This has a few practical consequences:
-
- A handful of wrong guesses on blurry or distant frames usually do not change the result. If Frigate sees a person as "Tom, Tom, Sam, Tom, Tom," it will still conclude the person was Tom.
- The goal is not for every individual face crop to be correct. The goal is for each person to be recognized correctly overall, across all the faces captured while they were present.
- A single very high confidence match will not by itself assign a sub label. Recognition must be consistent. See [I see scores above the threshold in the Recent Recognitions tab, but a sub label wasn't assigned?](#i-see-scores-above-the-threshold-in-the-recent-recognitions-tab-but-a-sub-label-wasnt-assigned) below.
-
-### Which Faces Are Worth Training?
-
-Whether a face is worth training has little to do with what it was recognized as. A crop is a good training candidate when all of these are true:
-
- It did not already score high and correctly. Faces that are already recognized confidently add little and increase the risk of over-fitting.
- It is clear enough to be useful: not blurry, not heavily off-axis, not infrared (gray-scale). If it is hard for you to make out the face, it will not help the model.
- It adds something new: a different angle, lighting, expression, or distance than what you already have.
+Refer to the guidelines below for best practices on selecting images for training.

 ### Step 1 - Building a Strong Foundation

@@ -226,81 +138,39 @@ Once front-facing images are performing well, start choosing slightly off-angle

 ## FAQ

-### Getting Recognition Working
-
-<FaqItem id="how-do-i-debug-face-recognition-issues" question="How do I debug Face Recognition issues?">
+### How do I debug Face Recognition issues?

 Start with the [Usage](#usage) section and re-read the [Model Requirements](#model-requirements) above.

-1. Enable debug logs to see exactly what Frigate is doing.
-   - Enable debug logs for face recognition by adding `frigate.data_processing.real_time.face: debug` to your `logger` configuration. Restart Frigate after this change.
-
-     ```yaml
-     logger:
-       default: info
-       logs:
-         # highlight-next-line
-         frigate.data_processing.real_time.face: debug
-     ```
-
-   - These logs report where the pipeline stopped for each `person` object, such as no face being found within the person's bounding box, the detected face being smaller than `min_area`, or a face being recognized but scoring too low.
-   - If you see no face-related messages at all, also add `frigate.embeddings.maintainer: debug` to confirm that the face processor was created at startup and that `person` updates are reaching it.
-
-2. Ensure `person` is being _detected_. A `person` will automatically be scanned by Frigate for a face. Any detected faces will appear in the Recent Recognitions tab in the Frigate UI's Face Library.
+1. Ensure `person` is being _detected_. A `person` will automatically be scanned by Frigate for a face. Any detected faces will appear in the Recent Recognitions tab in the Frigate UI's Face Library.

   If you are using a Frigate+ or `face` detecting model:
-   - Watch the [debug view](/usage/live#the-single-camera-view) to ensure that `face` is being detected along with `person`.
+   - Watch the debug view (Settings --> Debug) to ensure that `face` is being detected along with `person`.
   - You may need to adjust the `min_score` for the `face` object if faces are not being detected.

   If you are **not** using a Frigate+ or `face` detecting model:
   - Check your `detect` stream resolution and ensure it is sufficiently high enough to capture face details on `person` objects.
   - You may need to lower your `detection_threshold` if faces are not being detected.

-3. Any detected faces will then be _recognized_.
+2. Any detected faces will then be _recognized_.
   - Make sure you have trained at least one face per the recommendations above.
   - Adjust `recognition_threshold` settings per the suggestions [above](#advanced-configuration).

-</FaqItem>
+### Detection does not work well with blurry images?

-<FaqItem id="does-face-recognition-run-on-the-recording-stream" question="Does face recognition run on the recording stream?">
-
-Face recognition does not run on the recording stream, this would be suboptimal for many reasons:
-
-1. The latency of accessing the recordings means the notifications would not include the names of recognized people because recognition would not complete until after.
-2. The embedding models used run on a set image size, so larger images will be scaled down to match this anyway.
-3. Motion clarity is much more important than extra pixels, over-compression and motion blur are much more detrimental to results than resolution.
-
-</FaqItem>
-
-### Improving Accuracy and Training
-
-<FaqItem id="detection-does-not-work-well-with-blurry-images" question="Detection does not work well with blurry images?">
-
-Accuracy is definitely going to be improved with higher quality cameras / streams. It is important to look at the DORI (Detection Observation Recognition Identification) range of your camera, if that specification is posted. This specification explains the distance from the camera that a person can be detected, observed, recognized, and identified. The identification range is the most relevant here, and the distance listed by the camera is the furthest that face recognition will realistically work.
+Accuracy is definitely a going to be improved with higher quality cameras / streams. It is important to look at the DORI (Detection Observation Recognition Identification) range of your camera, if that specification is posted. This specification explains the distance from the camera that a person can be detected, observed, recognized, and identified. The identification range is the most relevant here, and the distance listed by the camera is the furthest that face recognition will realistically work.

 Some users have also noted that setting the stream in camera firmware to a constant bit rate (CBR) leads to better image clarity than with a variable bit rate (VBR).

-</FaqItem>
-
-<FaqItem id="can-i-train-faces-for-people-who-only-appear-at-night" question="Can I train faces for people who only appear at night?">
-
-The embedding models are trained on color images, so gray-scale and infrared (IR) faces sit in a different feature distribution and are more easily confused with other people. Prefer color images, and avoid mixing gray-scale samples in early while you are building a foundation. If someone only ever appears at night, gray-scale training is acceptable, but keep those samples limited and as clear as possible, and add them only once color recognition is stable for your other people.
-
-</FaqItem>
-
-<FaqItem id="why-cant-i-bulk-upload-photos" question="Why can't I bulk upload photos?">
+### Why can't I bulk upload photos?

 It is important to methodically add photos to the library, bulk importing photos (especially from a general photo library) will lead to over-fitting in that particular scenario and hurt recognition performance.

-</FaqItem>
-
-<FaqItem id="why-cant-i-bulk-reprocess-faces" question="Why can't I bulk reprocess faces?">
+### Why can't I bulk reprocess faces?

 Face embedding models work by breaking apart faces into different features. This means that when reprocessing an image, only images from a similar angle will have its score affected.

-</FaqItem>
-
-<FaqItem id="why-do-unknown-people-score-similarly-to-known-people" question="Why do unknown people score similarly to known people?">
+### Why do unknown people score similarly to known people?

 This can happen for a few different reasons, but this is usually an indicator that the training set needs to be improved. This is often related to over-fitting:

@@ -310,54 +180,33 @@ This can happen for a few different reasons, but this is usually an indicator th

 Review your face collections and remove most of the unclear or low-quality images. Then, use the **Reprocess** button on each face in the **Train** tab to evaluate how the changes affect recognition scores.

-Avoid training on images that already score highly, as this can lead to over-fitting. Instead, focus on relatively clear images that score lower (ideally with different lighting, angles, and conditions) to help the model generalize more effectively.
+Avoid training on images that already score highly, as this can lead to over-fitting. Instead, focus on relatively clear images that score lower - ideally with different lighting, angles, and conditions—to help the model generalize more effectively.

-</FaqItem>
-
-<FaqItem id="should-i-correct-a-face-that-was-recognized-as-the-wrong-person" question="Should I correct a face that was recognized as the wrong person?">
-
-Only if it is a good image. Reassigning a face does add it to that person's training set, but two things are true at once:
-
- Reassigning a single misclassified frame has a small effect. The image is weighted against every other sample for that person, so correcting 1 frame out of 20 will not move recognition much. Occasional wrong guesses on poor frames are normal and do not need to be fixed.
- Reassigning a poor image (blurry, off-angle, low-resolution, gray-scale) can hurt more than the misidentification did, because low-quality samples degrade recognition for that whole person.
-
-So the decision is about image quality, not about the wrong label. If the crop is clear, well-lit, and reasonably front-facing, and it scored low or was wrong, assigning it to the correct person is useful. If you can barely make out the face yourself, ignore it; do not train it just to correct the label.
-
-If a person is repeatedly misidentified, do not keep reassigning the same frame. Instead, remove low-quality or misleading images and add a few high-quality samples to the correct person. See [Why do unknown people score similarly to known people?](#why-do-unknown-people-score-similarly-to-known-people) above.
-
-</FaqItem>
-
-<FaqItem id="frigate-misidentified-a-face-can-i-tell-it-that-a-face-is-not-a-specific-person" question={'Frigate misidentified a face. Can I tell it that a face is "not" a specific person?'}>
+### Frigate misidentified a face. Can I tell it that a face is "not" a specific person?

 No, face recognition does not support negative training (i.e., explicitly telling it who someone is _not_). Instead, the best approach is to improve the training data by using a more diverse and representative set of images for each person.
 For more guidance, refer to the section above on improving recognition accuracy.

-This also applies to a stranger who is repeatedly matched to a known person (for example, a delivery driver recognized as you). Do not create a profile for them and do not reassign their faces to yourself, as this pollutes your training set and makes recognition worse. Leave the detection as unknown and improve the known person's training set instead. Face recognition learns who someone is, not who they are not.
+### I see scores above the threshold in the Recent Recognitions tab, but a sub label wasn't assigned?

-</FaqItem>
+The Frigate considers the recognition scores across all recognition attempts for each person object. The scores are continually weighted based on the area of the face, and a sub label will only be assigned to person if a person is confidently recognized consistently. This avoids cases where a single high confidence recognition would throw off the results.

-<FaqItem id="i-see-scores-above-the-threshold-in-the-recent-recognitions-tab-but-a-sub-label-wasnt-assigned" question="I see scores above the threshold in the Recent Recognitions tab, but a sub label wasn't assigned?">
-
-Frigate considers the recognition scores across all recognition attempts for each person object. The scores are continually weighted based on the area of the face, and a sub label will only be assigned to person if a person is confidently recognized consistently. This avoids cases where a single high confidence recognition would throw off the results.
-
-</FaqItem>
-
-### Compatibility and Maintenance
-
-<FaqItem id="can-i-use-other-face-recognition-software-like-doubletake-at-the-same-time-as-the-built-in-face-recognition" question="Can I use other face recognition software like DoubleTake at the same time as the built in face recognition?">
+### Can I use other face recognition software like DoubleTake at the same time as the built in face recognition?

 No, using another face recognition service will interfere with Frigate's built in face recognition. When using double-take the sub_label feature must be disabled if the built in face recognition is also desired.

-</FaqItem>
+### Does face recognition run on the recording stream?

-<FaqItem id="i-get-an-unknown-error-when-taking-a-photo-directly-with-my-iphone" question="I get an unknown error when taking a photo directly with my iPhone">
+Face recognition does not run on the recording stream, this would be suboptimal for many reasons:
+
+1. The latency of accessing the recordings means the notifications would not include the names of recognized people because recognition would not complete until after.
+2. The embedding models used run on a set image size, so larger images will be scaled down to match this anyway.
+3. Motion clarity is much more important than extra pixels, over-compression and motion blur are much more detrimental to results than resolution.
+
+### I get an unknown error when taking a photo directly with my iPhone

 By default iOS devices will use HEIC (High Efficiency Image Container) for images, but this format is not supported for uploads. Choosing `large` as the format instead of `original` will use JPG which will work correctly.

-</FaqItem>
-
-<FaqItem id="how-can-i-delete-the-face-database-and-start-over" question="How can I delete the face database and start over?">
+### How can I delete the face database and start over?

 Frigate does not store anything in its database related to face recognition. You can simply delete all of your faces through the Frigate UI or remove the contents of the `/media/frigate/clips/faces` directory.
-
-</FaqItem>