Issues with Frigate Behind Nginx and Authelia [Support]:

[Jake-Simek]

Describe the problem you are having

I have frigate exposed to port 5000 behind nginx and I have it secured with authelia. Frigtate is up and running just fine. The issue i am having is when i access frigate anything on a specified path, ie, /config, doesnt load. I know this has something to do with headers like mentioned in the docs, me, chatgpt, and google cant seem to figure it out. Thank you in advance for your help.

Version

Docker :Latest

What browser(s) are you using?

Firefox Private 128.6.0esr (64-bit)

Frigate config file

mqtt:
  enabled: False  # Enable if using MQTT/Home Assistant

cameras:
  studio:
    ffmpeg:
      inputs:
        - path: "rtsp://admin:2Hard2guess@192.168.1.196:554/StreamingSetting?version=1.0&action=getRTSPStream&ChannelID=1&ChannelName=Channel1&EncoderPort=0"  # Your camera RTSP
          roles:
            - detect
          #  - record
    detect:
      width: 1280
      height: 720
      fps: 5

auth:
  enabled: False  # Authelia handles authentication

Relevant Frigate log output

none

Relevant go2rtc log output

none

FFprobe output from your camera

n/a

Frigate stats

n/a

Install method

Docker Compose

docker-compose file or Docker CLI command

version: "3.9"
services:
  frigate:
    image: ghcr.io/blakeblackshear/frigate:stable  # Latest stable version
    container_name: frigate
    restart: unless-stopped
    volumes:
      - ./config:/config
      - ./media:/media/frigate  # Replace with your storage path
      - type: tmpfs
        target: /tmp/cache
        tmpfs:
          size: 1000000000  # 1GB tmpfs for cache
    ports:
      - "5000:5000"  # Internal API
      - "8554:8554"  # RTSP feeds
    #environment:
     # - FRIGATE_RTSP_PASSWORD=your_password_here  # Optional
    networks:
      - frigate_network

  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    restart: unless-stopped
    volumes:
      - ./authelia:/config
    expose:
      - 9091  # Internal port
    environment:
      - TZ=America/New_York  # Adjust timezone
    networks:
      - frigate_network

  nginx:
    image: nginx:latest
    container_name: nginx
    restart: unless-stopped
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro  # Mount self-signed certs
    ports:
      - "192.168.1.4:80:80"    # Bind to specific host IP
      - "192.168.1.4:443:443"  # Bind to specific host IP
    depends_on:
      - frigate
      - authelia
    networks:
      - frigate_network

networks:
  frigate_network:
    driver: bridge

Object Detector

CPU (no coral)

Network connection

Wired

Camera make and model

n/a

Screenshots of the Frigate UI's System metrics pages

No response

Any other information that may be helpful

this is my nginx.conf

worker_processes 1;

events {
worker_connections 1024;
}

http {
upstream frigate {
server frigate:5000;
}
upstream authelia {
server authelia:9091;
}

server {
    listen 80;
    server_name 192.168.1.4;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name 192.168.1.4;

    ssl_certificate /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;

    

    # Global websocket upgrade directives for proxy connections
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    # Authelia portal
    location /authelia {
        proxy_pass http://authelia/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Uri $request_uri;
        proxy_pass_header Content-Type;
    }

    # Authelia static assets (bypass auth)
    location /static/ {
        proxy_pass http://authelia/static/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_pass_header Content-Type;
    }

    # Authelia locales (bypass auth)
    location /locales/ {
        proxy_pass http://authelia/locales/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_pass_header Content-Type;
    }

    # Authelia API endpoints (bypass auth except /api/authz)
    location /api/ {
        proxy_pass http://authelia/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_pass_header Content-Type;
    }

    # Authelia auth request for /api/authz
    location /api/authz {
        proxy_pass http://authelia/api/authz;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Original-URL $scheme://$host$request_uri;
        proxy_set_header X-Original-Method $request_method;
        proxy_set_header X-Forwarded-Method $request_method;
        proxy_set_header X-Forwarded-Uri $request_uri;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "0";
    }

    # Protected Frigate location (requires Authelia authentication)
    location / {
        auth_request /api/authz/auth-request;
        auth_request_set $user $upstream_http_x_authelia_user;
        auth_request_set $email $upstream_http_x_authelia_email;

        # Handle 401 from Authelia
        error_page 401 =302 @authelia_login;

        # Pass to Frigate (with websocket upgrade headers)
        proxy_pass http://frigate;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;

        # Reapply websocket upgrade directives in this location
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_http_version 1.1;
    }

    # Redirect to Authelia login on 401
    location @authelia_login {
        return 302 https://192.168.1.4/authelia/?rd=$scheme://$host$request_uri;
    }
}

}

[Jake-Simek]

This issue was due to the /api path being shared on authelia and frigate. Some have had success fixing this issue with putting frigate behind a subpath such as /frigate, but there are some complications with this. To fix this for my setup, I decided to run frigate on its own VM with its own domain and path.