[tang-vu]

Ready for independent review (2026-09-15). Candidate 66aca82e309ea1590103f7777e65484ea9ff7ba6 has a successful GitHub check rollup and no base-branch conflict at this review snapshot. This supersedes earlier draft-status wording only. All validation gaps, migration requirements, live gates and independent human review requirements below remain in force; this is not a merge-ready approval.

Frigate's published browser port currently forwards to internal port 5000, where its UI/API bypass login. Forward it to the authenticated HTTPS listener on container port 8971 and carry HTTPS browser metadata through catalog generation, service discovery, API responses and dashboard/sidebar links.

Why this matters

An operator can enable Frigate authentication yet still expose an unauthenticated browser/API through the ODS port mapping. With the exact shipped 0.15.0 image, a disposable instance returned 200 for /api/config through the old HTTP mapping and 401 through HTTPS 8971. The corrected mapping enforces the application's configured authentication at the published browser boundary. Loopback remains the default binding; internal health still uses HTTP port 5000.

The producer is service.ui_scheme: https; catalog and installed-manifest readers preserve it, API/sidebar/status serializers carry it, and browser URL generation uses it. Only https selects TLS; existing services retain HTTP defaults and explicit public_url overrides keep precedence. The README covers generated first-login credentials, persistent accounts/JWT secret, self-signed certificates, existing TLS/auth overrides, trusted reverse proxies and rollback. The camera RTSP password is distinct from web login credentials. This change preserves existing operator configuration and cannot require login if auth.enabled was explicitly disabled.

Regenerating the catalog also restores metadata for the already-tracked, disabled-by-default pixel-inference service that was absent from the checked-in catalog. Its manifest and .disabled Compose file are unchanged; this is discovery metadata, not activation. Other catalog additions in this batch contain the same generated entry, which must appear only once in the combined catalog.

Overlap check

Searched open and closed PRs for Frigate auth, Frigate 8971, Frigate TLS, serviceUrl https and ui_scheme; searched changed production paths for Frigate, URL helpers/registry, catalog generator and API manifest/link readers. #404 restricts bind addresses; #387/#716 concern credential/setup configuration. #1760 adds explicit public-URL overrides, whose precedence is preserved. #1613 changes generic link/path navigation and Chroma health, but does not switch Frigate to its authenticated listener or propagate HTTPS browser metadata. #4735/#4753/#4779 validate user-provided URL strings, a separate input contract. No existing PR covers this published Frigate authentication boundary.

Validation

• New full Extensions-page regression fails on the old http://localhost:8971 link and passes on https://localhost:8971. Installed-manifest/API regression also fails before the change. Focused dashboard, extension, URL and sidebar-registry suites: 50 passed. Lint: 0 errors, 598 existing warnings. Production build passes.
• API manifest scanning and external-link/status handoffs: focused 150 passed; full dashboard API 2,850 passed, 1 skipped, with two existing warnings.
• Real exact-image Compose test: published plan no longer contains target 5000; HTTPS rejects missing/invalid credentials, accepts the generated account, permits authenticated config/user requests, and the same account works after recreation. JWT secret persists. Catalog + live boundary: 2 passed in 166 seconds. No cameras, model download or GPU inference are used. Only the disposable fixture's self-signed certificate is exempted from client trust validation. All fixture containers/networks were removed.
• One earlier live run became unhealthy during startup under the shared host workload; its logs were not retained, so the cause is not claimed resolved. The subsequent full run with diagnostic capture passed using the same production recipe. An earlier UI run also hit a worker-start timeout; the complete focused rerun passed. The path-filtered image workflow repeats the live authentication test independently.
• Scoped pre-commit and git diff --check pass. make gate reproduces the existing root/WSL no-sudo fixture failure; the complete local gate is not claimed green.

Still requires independent human review of the authentication and link changes. Live evidence covers Linux amd64 only; browser certificate onboarding, cameras/RTSP/WebRTC, hardware acceleration, ARM and native macOS/Windows activation remain unverified. Port 5000 is still trusted inside the Docker network; RTSP/WebRTC controls are outside this web-listener change. Restore a cold configuration/database backup if an unrelated upgrade needs rollback, and retain the authenticated mapping: reverting it removes browser login enforcement again. Upstream 0.15.0 contract: https://github.com/blakeblackshear/frigate/blob/v0.15.0/docs/docs/configuration/authentication.md.

Final candidate 66aca82e309ea1590103f7777e65484ea9ff7ba6: 33 successful CI checks, 4 conditionally skipped; no pending or failed checks.

Batch integration receipt

This is one of 30 independently branched public-beta PRs. The published synthetic integration head is 61f4c6fccc81bea697f4941683fefb5089ba77f4, built from baseline d49ad4bbc760be319de7f4c9b9a93b1f18fe3922 in this reproducible order:

#4946 → #4948 → #4951 → #4954 → #4972 → #4960 → #4961 → #4957 → #4964 → #4967 → #4968 → #4971 → #4975 → #4976 → #4984 → #4982 → #4990 → #4988 → #4989 → #4997 → #5003 → #5006 → #5007 → #5009 → #5012 → #5011 → #5013 → #5014 → #5020 → #5021

Reconciliation preserved all 146 files owned by a single PR byte-for-byte against their exact candidate heads. The eight shared paths preserve both CLI STT/TTS commands and help, every added Makefile test, both environment schema additions and all Extensions UI behavior. LanguageTool and Kroki both remain headless API entries. Canonical regeneration yields 76 catalog entries and 47 library manifests; all README rows are retained. Shared-file changes need these additive resolutions when merged independently.

Combined validation: 2,852 API tests passed / 1 skipped; 1,082 UI tests passed; 47 manifests passed; all 12 added Makefile commands passed; 12 catalog boundary tests passed / 12 opt-in runtime tests skipped in this combined run. Individual exact-image results remain documented above. UI lint/build, scoped secret hooks, diff checks, four platform smoke tests and installer simulation passed. Compose plans for NVIDIA/AMD/Apple each contain 20 services and no duplicate published bindings across the core plus 12 new recipes; this is static plan evidence, not simultaneous startup or GPU inference.

The first unrestricted UI run timed out in two tests under concurrent load; the complete rerun used --maxWorkers=2 with unchanged assertions and timeouts and passed. ESLint reports zero errors and 603 warnings, including the existing JSX usage-detection pattern. Full local make gate still fails the no-sudo Docker baseline covered by #3158. BATS records 416 passed / 5 failed on this root/WSL host (platform detection, root preflight and a 15 GiB versus 20 GiB free-space expectation). Neither full local gate nor BATS is described as green.

This integration receipt supplements each PR's own regression and does not waive its independent review, live hardware/browser/upgrade gates or rollback requirements. The PRs remain drafts; none was merged upstream.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.