limited access no login account

[TomW1605]

hi, i want to setup my server so that it uses authentication and needs a login to access some cameras. but it is still going to be local only and for the times i need to tell my parents how to check them for something spesific i dont want to have to have them log in. ideally i would like it to still work the same as the port 5000 does now but with read only and limited camera access is there a way to do this?

[inkeep-ai-assistant[bot]]

---

There isn't a built-in port that provides unauthenticated viewer-only access with limited cameras. Port 5000 is the internal unauthenticated port, but it grants full admin-level access to everything. (1)

However, you can achieve something similar using proxy authentication with header mapping. If you set up a reverse proxy (like nginx) in front of Frigate, you can:

1. Configure the proxy to pass headers that assign a custom role with limited camera access
2. Set a default_role so users without credentials get viewer-level access to specific cameras (1)

Here's an example configuration approach:

proxy:
  header_map:
    user: x-forwarded-user
    role: x-forwarded-groups
  default_role: viewer
  auth_secret: None

(2)

You can also define custom roles that limit access to specific cameras:

cameras:
  front_door:
    # ... camera config
  side_yard:
    # ... camera config
  garage:

(1)

Custom roles allow you to specify which cameras a role can access. Users assigned a custom role get read-only access limited to those designated cameras - they can only view Live, Review/History, Explore, and Export for the permitted cameras. (1)

For your parents' use case, you could:

• Set up a simple reverse proxy that passes a header assigning them to a custom role
• That custom role would only have access to the specific cameras you want them to see
• No login required if your proxy handles the header injection automatically for local network requests

📚 Sources:

1. Authentication
2. Full Reference Config

---

Have another question? Just tag @inkeep.

[TomW1605]

this dosnt seem to be working. i have the proxy config setup as described here with the auth role setup and auth itself disabled as described in the docs.

auth:
  enabled: false
  roles:
    guest:
      - side_gate
      - front_door
      - driveway

proxy:
  header_map:
    user: x-forwarded-user
    role: x-forwarded-groups
  default_role: viewer
  auth_secret: None

and i have nginx setup as described in the docs as well (though with ssl disabled)

server {
  set $forward_scheme https;
  set $server         "192.168.3.9"; # FRIGATE SERVER LOCATION
  set $port           8971;

  listen 80;
  #listen 443 ssl;
  http2 on;

  server_name _;

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $http_connection;
  proxy_http_version 1.1;

  #access_log /data/logs/proxy-host-40_access.log proxy;
  #error_log /data/logs/proxy-host-40_error.log warn;

  location / {
    proxy_pass $forward_scheme://$server:$port;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    proxy_set_header x-forwarded-user "guest";
    proxy_set_header x-forwarded-groups "guest";
  }
}

with this setup im still getting redirected to the login page when i go to the server on port 80, im assuming im missing something

[inkeep-ai-assistant[bot]]

---

The issue is that you're connecting to port 8971 (the authenticated port) but with auth.enabled: false, you need to ensure your proxy is properly forwarding WebSocket connections and the headers are being passed correctly. (1)

A few things to check:

1. Disable TLS in Frigate when using a reverse proxy that terminates SSL. Add this to your config: (2)

tls:
  enabled: false

(3)

2. WebSocket configuration - Your nginx config needs to properly handle WebSocket upgrades. The error Header HTTP_UPGRADE is not defined in similar setups indicates WebSocket headers aren't being passed correctly. (4) Try this nginx configuration:

location / {
    proxy_pass http://192.168.3.9:8971;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_http_version 1.1;
    
    proxy_set_header x-forwarded-user "guest";
    proxy_set_header x-forwarded-groups "guest";
}

location /ws {
    proxy_pass http://192.168.3.9:8971/ws;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_http_version 1.1;
}

location /live/ {
    proxy_pass http://192.168.3.9:8971/live/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_http_version 1.1;
}

(2)

3. Use http not https for the backend connection since you're disabling TLS in Frigate. Change $forward_scheme to http.

4. Custom roles should be defined under auth.roles even when auth.enabled: false: (1)

auth:
  enabled: false
  roles:
    guest:
      - side_gate
      - front_door
      - driveway

(1)

The proxy configuration looks correct for header mapping. Make sure Frigate is actually receiving the headers by checking the logs after a request.

📚 Sources:

1. Authentication
2. Setting up a reverse proxy
3. Full Reference Config
4. [Config Support]: Using domain prevents accessing single camera feeds

---

Have another question? Just tag @inkeep.

[TomW1605]

nope, still not working, same thing