Is the X-Ingress-Path fully supported?

[bartbutenaers]

Hi everybody,

I run a Tailscale vpn mesh network, and I need to access the Frigate web interface via a base-path /frigate. I am aware that this is not possible, but instead I should provide a http header X-Ingress-Path containing value /frigate. Hower the reverse proxy inside my Tailscale agent daemon is very basic, so it does not allow me to add http headers. Fortunately I found this workaround: after adding that code snippet to my Nginx conf file, I can navigate to base-path /frigate, and Nginx will automatically create the http header.

As a result my Frigate web interface is now accessible via the specified base-path. So far so good.

However parts of my web interface are not fetched correctly from the server. For example the thumbnail images:

When I remove the base-path from the url, it works fine:

But there are also other kind of resources that cannot be fetched:

It looks to me - from the Nginx.conf file - that the X-Ingress-Path is only used for the resources that are directly loaded from the root html file.

Based on this I have some questions:

1. Is this a known issue?
2. Are there any plans/resources/interest to fix this?
3. If 'no' for question 2: I am completely not familiar with Nginx, but I can "try" to have a look at this. I would like to get rid of all the manual editings in the nginx.conf file that I need to perform to set my base path. Instead it would be nice if I could set the base-path via an environment variable in my Docker compose file. Next - since Nginx doesn't seem to support such variables - use envsubst to automatically replace the placeholders in a template nginx conf file (at container startup), and create a final conf file that contains the environment variable values and will be used to start Nginx. Or if anybody has a better idea, don't hesistate to share it!

Thanks!
Bart

[bartbutenaers]

Seems that everything was working fine under the sub-path \frigate, except the images on the Explore tab.
In the Nginx config file those images are being routed based on a regex match:

        location ~* /api/.*\.(jpg|jpeg|png|webp|gif)$ {
            include auth_request.conf;
            rewrite ^/api/(.*)$ /$1 break;
            proxy_pass http://frigate_api;
            include proxy.conf;
        }

While all the other resources are being routed based on a fixed match (e.g. /api/vod/), which automatically allows the sub-path prefix /frigate to be used (and still keep matching).

However that regex will not match when I add a sub-path prefix /frigate/api/...
When I change the above code snippet by this one:

        location ~* ^(?:/.*/)?api/.*\.(jpg|jpeg|png|webp|gif)$ {
            include auth_request.conf;
            rewrite ^(?:/.*/)?api/(.*)$ /$1 break;
            proxy_pass http://frigate_api;
            include proxy.conf;
        }

Then all the images in the Explore tab are loaded nicely (both with and without the sub-path):

[bartbutenaers]

it would be nice if I could set the base-path via an environment variable in my Docker compose file. Next - since Nginx doesn't seem to support such variables - use envsubst to automatically replace the placeholders in a template nginx conf file

I have been searching in the codebase, to see if if something similar exists already. To make sure I don't reinvent hot water, and do it the Frigate way. And it looks to me that the TLS config settings are a good way to get started with this:

1. Just before NGinx is started, the get_tls_settings.py is called.
2. That python code gets the ´tls.enabled´ setting from the Frigate config yaml file (if available).
3. The value of that setting is used in a Go template file, to create dynamically a listen.conf file.
4. That conf file is included in the nginx.conf file.

I would like to implement something similar for the base_path:

1. I add something like this to the frigate config file:

   server:
      base_path: '/frigate'  # default the root path "/"
   

2. I implement a get_server_settings.py and a server.gotmpl.
3. I generate a server.conf which is included in the nginx.conf file.
4. That way the nginx config file will updated to set the $http_x_ingress_path variable to the base_path from the frigate config.

Which means you can set the base_path both via a http header (like currently already supported) and extra via the frigate config.

Is it ok if I try to implement something like that, and create a pull-request?
Thanks for reviewing my proposal!

[NickM-27]

The point is that this change is not necessary, the BASE_PATH is already used via http_x_ingress_path as this is a requirement for the addons ingress to work, so we know it works correctly

[bartbutenaers]

Sorry @NickM-27
But I am a bit lost now. How can I set the BASE_PATH without providing a http header X-Ingress-Path (which is not possible via my Tailscale agent as desceibed in my original post above)?

[NickM-27]

I see now, in that case the recommendation would be one of the following:

• put a proxy in front of Frigate that can set the header
• bind mount your modified nginx config with the necessary changes

[bartbutenaers]

Yes that is indeed currently the way to go. But I am desperately trying to simplify my (Node-RED & Tailscale based) home automation setup. You know in case I drive with my car into a tree, so that hopefully the wife and kids can maintain their home automation. But that is easier said than done unfortunately... All applications that I use allow to specify a base path, so they are reachable via a Tailscale agent (which has a very basic reverse proxy embedded).

Only Frigate doesn't allow users to specify a base path within the application, but instead it requires users to specify the base path outside the application. Which means I need to install a reverse proxy only to be able to specify a single http header variable. Which introduces a lot of complexity in my setup, that I will never be able to explain to my non-ICT familly...

Therefore I wanted to create a PR, so this all works out of the box without having to install reverse proxies.
Hopefully you understand my requirement, and allow me to create a pull request.

[NickM-27]

There is no requirement to install a reverse proxy, like I said you can just bind mount an adjusted nginx config to your liking that changes the base path behavior