From e09cbb0cb58ea3980c372a7fa227d01882b929c7 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Fri, 22 May 2026 21:49:33 +0100
Subject: [PATCH] frigate: use proxy auth mode with Authelia headers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 services/frigate.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/services/frigate.nix b/services/frigate.nix
index 3879920..281250f 100644
--- a/services/frigate.nix
+++ b/services/frigate.nix
@@ -12,7 +12,11 @@
 
       settings = {
         mqtt.enabled = false;
-        auth.enabled = false;
+
+        # Delegate authentication to Authelia via reverse proxy headers.
+        # The nginx /auth location sends requests to Authelia, which returns
+        # Remote-User on success. Frigate picks this up via proxy header_map.
+        auth.proxy.header_map.user = "Remote-User";
 
         cameras.kids_bedroom = {
           enabled = true;