Sugget to Change Network Configuration Documentation Page slightly

[luckylinux]

I am using Caddy Reverse Proxy in front of Frigate (I assume the same Issue would occur with Traefik Reverse Proxy).

If I disable TLS acconding to the Manual or even the Beta/RC Manual then Port 5000 stops working.

Config Section:

# TLS Configuration
tls:
  enabled: False

Environment Variables in .env File:

# Define Application Port
APPLICATION_PORT_NOAUTH=5000
APPLICATION_PORT_AUTH=8971

Relevant part of Caddyfile:

    # Internal unauthenticated UI and API access. Access to this port should be limited. Intended to be used within the docker network for services that integrate with Frigate.
    reverse_proxy http://[::1]:{$APPLICATION_PORT_NOAUTH}

I had to also use a Custom Network Configuration since I mainly rely on IPv6.

This is basically straight up from the Official Documentation:

# intended for internal traffic, not protected by auth
# listen 5000;

{{ if not .enabled }}
# intended for external traffic, protected by auth
listen [::1]:8971 ipv6only=off;
{{ else }}
# intended for external traffic, protected by auth
listen [::1]:8971 ipv6only=off ssl;

# intended for internal traffic, not protected by auth
listen [::1]:5000 ipv6only=off;

ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;

# generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
# https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;

# modern configuration
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

# ACME challenge location
location /.well-known/acme-challenge/ {
    default_type "text/plain";
    root /etc/letsencrypt/www;
}
{{ end }}

I suggest to add port 5000 also in the non-TLS Enabled Section, since you are going to have a reverse Proxy either way:

# intended for internal traffic, not protected by auth
# listen 5000;

{{ if not .enabled }}
# intended for external traffic, protected by auth
listen [::1]:8971 ipv6only=off;

# intended for internal traffic, not protected by auth
listen [::1]:5000 ipv6only=off;

{{ else }}
# intended for external traffic, protected by auth
listen [::1]:8971 ipv6only=off ssl;

# intended for internal traffic, not protected by auth
listen [::1]:5000 ipv6only=off;

ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;

# generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
# https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;

# modern configuration
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;

# ACME challenge location
location /.well-known/acme-challenge/ {
    default_type "text/plain";
    root /etc/letsencrypt/www;
}
{{ end }}

Basically adding

# intended for internal traffic, not protected by auth
listen [::1]:5000 ipv6only=off;

In the NON-TLS Enabled Section 😃.

It took me a while to understand why I could only connect on one Port and not the other in either Case using IPv6-Only Connections:

• When TLS was Disabled I could only connect on Port 8971 which require User Authentication, while Port 5000 would be completely unreachable and Caddy would give HTTP Error Code 502 (missing listening Directive in listen.gotmpl for Port 5000 in the non-TLS Enabled Case AND IPv6 Stack)
• When TLS was Enabled I could only connect on port 5000 since Caddy would give HTTP Error Code 502 when connecting to the TLS-Enabled NGINX