Moving from Zoneminder with ZMNinja app to Frigate NVR. How do you
deal with accessing frigate remotely since it doesn't seem to have
user accounts and login feature?
reddit / selfhosted

----------------------------------------------------------------------
turt1eb · 2023-11-25 19:49

After 8+ years of using Zoneminder I'm looking to move to something
less resource intensive and have tested Frigate with a USB Coral
device and really like how little cpu this uses. Only issue is I can't
figure out how to recreate the ease of use I get by using ZMNinja app
on my phone.  So, for those of you using Frigate how do you access it
remotely on your phone that doesn't involve first connecting to your
home network using VPN/Wireguard/Tailscale?

Currently I use Nginx-Proxy-Manger to forward secure connections to my
Zoneminder server and use Zoneminder's built in authentication.

----------------------------------------------------------------------
pm_something_u_love · 2023-11-25 20:17

You can use nginx reverse proxy with basic HTTP auth over SSL. Or even
better set up a two factor auth system with nginx. You'll probably
need to set this stuff up in nginx server blocks, I  think NPM is
pretty limited in what it exposes to the GUI.

I'm not sure what ZM capabilities were but for notifications and stuff
like that you can use Home Assistant. That also has some pretty good
remote access features if you can put in the time to set it up.

----------------------------------------------------------------------
benjamingolub · 2023-11-26 07:15

VPN. Wireguard will auto connect my iPhone when I leave my home
network.

----------------------------------------------------------------------
barry_flash · 2023-11-26 13:43

I added Authentik for authentication.

----------------------------------------------------------------------
turt1eb · 2023-11-26 16:27

Thanks, I'll look into it.

----------------------------------------------------------------------
turt1eb · 2023-11-26 16:34

Thanks, I looked into my NPM setup further and turns out the GUI does
have an option to create access lists that can be assigned per host.
Now I need to look into HA because there is no way I can give access
to the Frigate UI to my family as I don't see any basic monitor and
events view that doesn't also include access to configuration options.

----------------------------------------------------------------------
turt1eb · 2023-11-26 16:37

Interesting, is that feature just part of the wireguard app, or so you
have something else that knows when you are no longer on your home
network enabling wireguard? Also, what do you use to view your cameras
and events on mobile?

----------------------------------------------------------------------
benjamingolub · 2023-11-26 16:39

It’s baked into the Wireguard iOS app. Not sure android has the
feature or not. Inside the app you define when to auto connect. I
choose cellular or any WiFi except my home ssid.

To view cameras and events I use HomeAssistant integration to push
notifications.

----------------------------------------------------------------------
pm_something_u_love · 2023-11-26 18:42

You can do that in nginx. Create a server block with a location / with
auth_basic set to a specific htpasswd file and another /config
location within the same server block with auth_basic pointing to a
different htpasswd file.

----------------------------------------------------------------------
turt1eb · 2023-11-26 19:58

That's a great idea! And yes an example would be appreciated.

----------------------------------------------------------------------
pm_something_u_love · 2023-11-26 20:52

I had a play around and unfortunately I can't get it to work due to
the way Frigate loads the config when you go to the main page. Nginx
only prompts for auth when you go to the config page then hit F5 as
that's when it sees the request for /config.

There will be a way to make it work, I just don't know what it is :)

This might be a starting point for you anyway.

    server {
    listen 443 ssl;
        ssl_certificate
/etc/letsencrypt/live/yourdomain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain/privkey.pem;


#allow only RFC 1912
    allow 192.168.0.0/16;
    allow 172.16.0.0/12;
    allow 10.0.0.0/8;
    deny all;

    proxy_buffering off;

    server_name frigate frigate.local;

    location / {
        proxy_pass http://frigate:5000/;
        proxy_set_header Host $host;
    }

    location /config {
        proxy_pass http://frigate:5000/config;
        proxy_set_header Host $host;
        auth_basic "Please login";
        auth_basic_user_file /path/to/.htpasswd;
    }
}

----------------------------------------------------------------------
turt1eb · 2023-11-26 22:11

Thanks for taking the time to look into that on your end and for the
example starting point.