mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-09-14 06:28:28 -04:00
Josh Hawkins
3be59c9c18
* Run the frigate service as the frigate user * Run go2rtc as its own restricted user * Run nginx as the frigate user with writable state in /tmp/nginx * Disable bandwidth stats gracefully when not running as root * Hand TensorRT model cache ownership to the runtime user * Document non-root operation and per-hardware device access * Create /media/frigate after the ownership sweep * Assert non-root services, JWT migration, and escape hatch in CI * only write the sweep sentinel when a media volume is mounted * tolerate homekit config chown failures in the go2rtc run script * chown the s6 log pipe so non-root nginx can reopen /dev/stdout * set HOME to /config for non-root services * run smoke nginx -t and the write probe as the runtime user * re-own the nginx shm cache on service restart * discard stdout for the unprivileged smoke nginx -t * unwrap hard-wrapped prose in the installation docs * report progress during the ownership sweep * document EXTRA_GROUPS as the only device access path for dropped services * expand the non-root device access docs with diagnosis steps and udev rules * document network storage ownership and the remaining detector hardware * skip lost+found during the ownership sweep * hand /tmp/cache to the runtime user before services start * make bundled models readable by the runtime user * reload nginx by signaling the master instead of parsing its config as root * harden root writes into unprivileged-owned paths Restrict the sweep sentinel to a mount at or below /media/frigate so a parent /media mount cannot bless a later-shadowed volume. Rebuild /tmp/nginx root-owned each start so root's cp and tempio writes cannot follow a symlink an unprivileged nginx planted in the previous run. * collapse the duplicated sentinel comment * add a service-runs-as-root helper for granular root services * validate FRIGATE_ROOT_SERVICES and fail fast on unknown names * let services listed in FRIGATE_ROOT_SERVICES skip the privilege drop * record the root-services mode in the sentinel and sweep small trees each boot * cache the runtime ids in the ownership helper * chown recordings, previews, and exports to the runtime user at create * chown the database files after init * recommend FRIGATE_ROOT_SERVICES in the bandwidth stats warning * assert granular root services in CI * document FRIGATE_ROOT_SERVICES * own every directory level created for a recording segment * clear the cached runtime ids when ownership tests finish * skip missing media paths in the per-boot ownership sweep * clarify granular root services docs * clean up * install acl for device access grants * grant runtime users access to mapped device nodes at boot * assert device access grants in CI * document automatic device access grants * stop telling users device access needs host side setup * clarify the non-root docs * link the migration script to the repo * group the manual device setup under one section * harden against symlink attacks /config is owned by the unprivileged runtime user after the ownership sweep, so root operations on files there could be redirected by a planted symlink. - go2rtc HomeKit setup: replace the root yq/jq normalization and chown with an O_NOFOLLOW helper (prepare_homekit.py), so a symlink at go2rtc_homekit.yml can't redirect a root write or chown onto another file - go2rtc binary override: ignore /config/go2rtc whenever the service runs as root, so a planted binary can't exec as root under FRIGATE_ROOT_SERVICES - sweep sentinel: read and write it through safe-sentinel, which trusts only a root-owned regular file and never follows a symlink, so it can't be forged to skip the migration or symlinked to clobber a root file - ownership sweep: chown with -execdir so a parent directory swapped for a symlink mid-walk can't redirect the chown out of the volume - validate inputs: restrict DEVICE_ACL_PATHS to /dev, require nonzero numeric EXTRA_GROUPS, and reject PUID/PGID that collide with the go2rtc ids - docs: correct the TLS key ownership note to match what actually happens * tweak docs * stop the ownership sweep chasing entries other mechanisms own * keep custom binaries out of root services only under granular root
203 lines
5.7 KiB
TypeScript
203 lines
5.7 KiB
TypeScript
import type { SidebarsConfig } from "@docusaurus/plugin-content-docs";
|
|
import { PropSidebarItemLink } from "@docusaurus/plugin-content-docs";
|
|
import frigateHttpApiSidebar from "./docs/integrations/api/sidebar";
|
|
|
|
const sidebars: SidebarsConfig = {
|
|
docs: {
|
|
Frigate: [
|
|
"frigate/index",
|
|
"frigate/hardware",
|
|
"frigate/planning_setup",
|
|
"frigate/installation",
|
|
"frigate/updating",
|
|
"frigate/camera_setup",
|
|
"frigate/video_pipeline",
|
|
"frigate/network_requirements",
|
|
"frigate/glossary",
|
|
],
|
|
Guides: [
|
|
"guides/getting_started",
|
|
"guides/ha_notifications",
|
|
"guides/ha_network_storage",
|
|
"guides/reverse_proxy",
|
|
],
|
|
Usage: [
|
|
"usage/live",
|
|
"usage/review",
|
|
"usage/history",
|
|
"usage/explore",
|
|
"usage/exports",
|
|
],
|
|
Configuration: [
|
|
"configuration/config",
|
|
"configuration/config_overrides",
|
|
{
|
|
type: "category",
|
|
label: "Detectors",
|
|
items: [
|
|
"configuration/object_detectors",
|
|
"configuration/audio_detectors",
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Enrichments",
|
|
items: [
|
|
"configuration/semantic_search",
|
|
"configuration/face_recognition",
|
|
"configuration/license_plate_recognition",
|
|
"configuration/bird_classification",
|
|
{
|
|
type: "category",
|
|
label: "Custom Classification",
|
|
link: {
|
|
type: "generated-index",
|
|
title: "Custom Classification",
|
|
description: "Configuration for custom classification models",
|
|
},
|
|
items: [
|
|
"configuration/custom_classification/state_classification",
|
|
"configuration/custom_classification/object_classification",
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Generative AI",
|
|
link: {
|
|
type: "generated-index",
|
|
title: "Generative AI",
|
|
description: "Generative AI Features",
|
|
},
|
|
items: [
|
|
"configuration/genai/genai_config",
|
|
"configuration/genai/genai_review",
|
|
"configuration/genai/genai_objects",
|
|
],
|
|
},
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Cameras",
|
|
items: [
|
|
"configuration/cameras",
|
|
"configuration/review",
|
|
"configuration/record",
|
|
"configuration/snapshots",
|
|
"configuration/motion_detection",
|
|
"configuration/birdseye",
|
|
"configuration/live",
|
|
"configuration/restream",
|
|
"configuration/autotracking",
|
|
"configuration/camera_specific",
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Objects",
|
|
items: [
|
|
"configuration/object_filters",
|
|
"configuration/masks",
|
|
"configuration/zones",
|
|
"configuration/objects",
|
|
"configuration/stationary_objects",
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Hardware Acceleration",
|
|
items: [
|
|
"configuration/hardware_acceleration_video",
|
|
"configuration/hardware_acceleration_enrichments",
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Extra Configuration",
|
|
items: [
|
|
"configuration/authentication",
|
|
"configuration/notifications",
|
|
"configuration/profiles",
|
|
"configuration/go2rtc",
|
|
"configuration/ffmpeg_presets",
|
|
"configuration/pwa",
|
|
"configuration/tls",
|
|
"configuration/non_root",
|
|
],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Advanced Configuration",
|
|
items: [
|
|
"configuration/advanced/system",
|
|
"configuration/advanced/reference",
|
|
{
|
|
type: "link",
|
|
label: "Go2RTC Configuration Reference",
|
|
href: "https://github.com/AlexxIT/go2rtc/tree/v1.9.14#configuration",
|
|
} as PropSidebarItemLink,
|
|
],
|
|
},
|
|
],
|
|
Integrations: [
|
|
"integrations/plus",
|
|
"integrations/home-assistant",
|
|
// This is the HTTP API generated by OpenAPI
|
|
{
|
|
type: "category",
|
|
label: "HTTP API",
|
|
link: {
|
|
type: "generated-index",
|
|
title: "Frigate HTTP API",
|
|
description: "HTTP API",
|
|
slug: "/integrations/api/frigate-http-api",
|
|
},
|
|
items: frigateHttpApiSidebar,
|
|
},
|
|
"integrations/mqtt",
|
|
"integrations/homekit",
|
|
"configuration/metrics",
|
|
"integrations/third_party_extensions",
|
|
],
|
|
"Frigate+": [
|
|
"plus/index",
|
|
"plus/annotating",
|
|
"plus/first_model",
|
|
"plus/faq",
|
|
],
|
|
Troubleshooting: [
|
|
"troubleshooting/faqs",
|
|
"troubleshooting/common_errors",
|
|
"troubleshooting/go2rtc",
|
|
"troubleshooting/recordings",
|
|
"troubleshooting/dummy-camera",
|
|
{
|
|
type: "category",
|
|
label: "Troubleshooting Hardware",
|
|
link: {
|
|
type: "generated-index",
|
|
title: "Troubleshooting Hardware",
|
|
description: "Troubleshooting Problems with Hardware",
|
|
},
|
|
items: ["troubleshooting/gpu", "troubleshooting/edgetpu"],
|
|
},
|
|
{
|
|
type: "category",
|
|
label: "Troubleshooting Resource Usage",
|
|
link: {
|
|
type: "generated-index",
|
|
title: "Troubleshooting Resource Usage",
|
|
description: "Troubleshooting issues with resource usage",
|
|
},
|
|
items: ["troubleshooting/cpu", "troubleshooting/memory"],
|
|
},
|
|
],
|
|
Development: [
|
|
"development/contributing",
|
|
"development/contributing-boards",
|
|
],
|
|
},
|
|
};
|
|
|
|
export default sidebars;
|