MirrorHub/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-15 22:36:23 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

nixos/frigate: fix recording and serving of clips/recordings

Browse source 
Frigate does string prefix matching for paths, which isn't exactly
compatible with dynamically provisioned directories of systemd, where
/var/cache/frigate is actually a symlink to /var/cache/private/frigate.

Because we are unlikely to get this fixed upstream, this is one of the
reason we should stop using DynamicUser= here.

The other being, that nginx needs to be able to serve clips and
recordings from both the CacheDirectory and the StateDirectory, and
nginx being a member on a group that may only exist after it was started
up doesn't work reliably.

This is also why we relax the umask to allow g+r/g+rx for newly created
files. Existing installs may need the following permissions fix to get
things going.

```
find /var/lib/frigate/recordings -type d -exec chmod g+rx {} \;
find /var/lib/frigate/recordings -type f -exec chmod g+r {} \;
find /var/cache/frigate -type f -exec chmod g+r {} \;
```

Co-Authored-By: Daniel Barlow <dan@telent.net>
This commit is contained in:
Martin Weinelt 2023-07-27 18:27:34 +02:00
parent bdddb46f4b
commit 3086313e4c
No known key found for this signature in database
GPG key ID: 87C1E9888F856759
1 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
nixos/modules/services/video/frigate.nix
View file

@ -322,6 +322,16 @@ in
'';
};
systemd.services.nginx.serviceConfig.SupplementaryGroups = [
"frigate"
];
users.users.frigate = {
isSystemUser = true;
group = "frigate";
};
users.groups.frigate = {};
systemd.services.frigate = {
after = [
"go2rtc.service"
@ -349,15 +359,18 @@ in
serviceConfig = {
ExecStart = "${cfg.package.python.interpreter} -m frigate";
DynamicUser = true;
User = "frigate";
Group = "frigate";
UMask = "0027";
StateDirectory = "frigate";
UMask = "0077";
StateDirectoryMode = "0750";
# Caches
PrivateTmp = true;
CacheDirectory = "frigate";
CacheDirectoryMode = "0750";
BindPaths = [
"/migrations:${cfg.package}/share/frigate/migrations:ro"