Mirrors/blakeblackshear.frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2024-11-21 19:07:46 +01:00
Code Issues Projects Releases Wiki Activity

Update TLS docs with certbot instructions (#12141)

Browse Source 
* Update tls.md

Update TLS docs with certbot instructions

* Apply suggestions from code review

Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>

---------

Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
This commit is contained in:
On Freund 2024-06-25 02:06:23 +03:00 committed by GitHub
parent 00e235867a
commit c3455518c2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/docs/configuration/tls.md
View File

@ -24,12 +24,24 @@ TLS certificates can be mounted at `/etc/letsencrypt/live/frigate` using a bind
frigate: frigate:
... ...
volumes: volumes:
- /path/to/your/certificate_folder:/etc/letsencrypt/live/frigate - /path/to/your/certificate_folder:/etc/letsencrypt/live/frigate:ro
... ...
``` ```
Within the folder, the private key is expected to be named `privkey.pem` and the certificate is expected to be named `fullchain.pem`. Within the folder, the private key is expected to be named `privkey.pem` and the certificate is expected to be named `fullchain.pem`.
Note that certbot uses symlinks, and those can't be followed by the container unless it has access to the targets as well, so if using certbot you'll also have to mount the `archive` folder for your domain, e.g.:
```yaml
frigate:
...
volumes:
- /etc/letsencrypt/live/frigate:/etc/letsencrypt/live/frigate:ro
- /etc/letsencrypt/archive/frigate:/etc/letsencrypt/archive/frigate:ro
...
```
Frigate automatically compares the fingerprint of the certificate at `/etc/letsencrypt/live/frigate/fullchain.pem` against the fingerprint of the TLS cert in NGINX every minute. If these differ, the NGINX config is reloaded to pick up the updated certificate. Frigate automatically compares the fingerprint of the certificate at `/etc/letsencrypt/live/frigate/fullchain.pem` against the fingerprint of the TLS cert in NGINX every minute. If these differ, the NGINX config is reloaded to pick up the updated certificate.
If you issue Frigate valid certificates you will likely want to configure it to run on port 443 so you can access it without a port number like `https://your-frigate-domain.com` by mapping 8080 to 443. If you issue Frigate valid certificates you will likely want to configure it to run on port 443 so you can access it without a port number like `https://your-frigate-domain.com` by mapping 8080 to 443.