[Support]: Configuring frigate path with caddy proxy

[Wazbat]

Describe the problem you are having

I'm trying to expose my frigate instance to the web, utilising a combination of Cloudflare Access, Tunnels, and finally a Caddy reverse proxy for path level routing
My current setup is:

1. A cloudflare application, configured to require auth on all requests to apps.example.com
2. A cloudflare tunnel, configured to forward requests to apps.example.com to http://caddy:80
3. An instance of Caddy, with the following config:

# Specifying http here to disable cert generation
http://apps.example.com {
    redir /frigate /frigate/ 308
    reverse_proxy /frigate/* http://frigate:5000 {
        header_up X-Ingress-Path "/frigate"
    }
}

I've been fighting this for a good few hours now. I've tried setting FRIGATE_BASE_PATH (caused tls errors and a login portal to appear, which I don't want as cloudflare handles auth), stripping the path, etc
I've had lots of different problems, and I'm just not sure what I'm doing wrong.

I've checked the docs for other examples and I did find an example on reverse proxy setup, however it only shows a config for a subdomain, not a path setup like this

Version

0.16.0-c2f8de9

Install method

Docker Compose

docker-compose file or Docker CLI command

version: "3.8"
services:
  frigate:
    container_name: frigate
    privileged: true
    restart: unless-stopped
    image: ghcr.io/blakeblackshear/frigate:stable-rk
    shm_size: "512mb" 
    devices:
      - /dev/rknpu:/dev/rknpu
    volumes:
      - /srv/dev-disk-by-uuid-10f43d65-0ee2-4f06-b7bb-d951f59af3fd/appdata/frigate/config:/config
      - /srv/dev-disk-by-uuid-10f43d65-0ee2-4f06-b7bb-d951f59af3fd/NVR/media/frigate:/media/frigate
      - type: tmpfs
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      # Frigate's main Web UI port
      - "5000:5000"
      # Authenticated UI and API
      - "8971:8971"
      - "8554:8554"      # RTSP
      - "8555:8555/tcp"  # WebRTC
      - "8555:8555/udp"  # WebRTC
    environment:
      FRIGATE_RTSP_PASSWORD: "blah"
    networks:
      - caddy-net
networks:
  caddy-net:
    external: true

Object Detector

RKNN

Network connection

Wired

[inkeep-ai-assistant[bot]]

Frigate can be run behind a reverse proxy with path-based routing, but there are some specifics to be aware of:

• The recommended method for setting a custom base path (like /frigate) is to have your reverse proxy set the X-Ingress-Path HTTP header to the desired path. In your Caddy config, you are already setting header_up X-Ingress-Path "/frigate", which is correct for this purpose(1).
• Frigate expects to run at the root path (/) by default. When using a path prefix, all upstream requests must include the correct header, and your proxy must rewrite URLs accordingly(1).
• If you cannot set the header for some reason, you can also set the FRIGATE_BASE_PATH environment variable, but this is intended for setups where adding the header is not feasible(1).
• When using a path-based proxy, some users have reported issues due to Frigate's use of absolute paths for web assets(2). This can cause resources (JS, images, etc.) to fail to load unless the proxy rewrites those URLs or Frigate is run at the root path.
• The official reverse proxy documentation only provides subdomain-based examples and does not cover path-based routing in detail(3).

Given these constraints:

• Setting X-Ingress-Path is supported, but you may still encounter issues with absolute asset paths(1)(2).
• Workarounds include using a subdomain instead of a path, or implementing additional URL rewriting in your proxy to handle asset paths(2).

Check these sources for more details and examples:

• Setting up a reverse proxy
• Advanced Options
• Use relative paths for web assets

📚 Sources:

1. Advanced Options
2. Use relative paths for web assets
3. Setting up a reverse proxy

---

Have another question? Just tag @inkeep.