From b957d88ff644d83d39367db4859034978b352f28 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Fri, 22 May 2026 23:09:00 +0100
Subject: [PATCH] frigate: gate frontend with Authelia, not just API routes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 services/frigate.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/services/frigate.nix b/services/frigate.nix
index da78fd9..48c943e 100644
--- a/services/frigate.nix
+++ b/services/frigate.nix
@@ -94,6 +94,13 @@
         '';
       };
 
+      # The Frigate module serves the frontend from "/" without auth_request,
+      # so unauthenticated users see a broken loading page instead of being
+      # redirected to Authelia. Gate it behind auth too.
+      locations."/".extraConfig = lib.mkAfter ''
+        auth_request /auth;
+      '';
+
       # Redirect 401 → Authelia login portal
       extraConfig = lib.mkAfter ''
         error_page 401 =302 https://auth.nordhammer.it/?rd=$scheme://$http_host$request_uri;