Services are ready.

modules/services/frigate.nix

@@ -3,15 +3,16 @@
 with lib;
 
 let
+  frigateVersion = "0.16.4";
   helper = import ./lib.nix { inherit config pkgs lib; };
   cfg = config.numbus.services.frigate;
 in
 
 helper.mkPodmanService {
-  name = "frigate";
   description = "Frigate, your fully-local NVR (Network Video Recorder)";
-  defaultPort = "8971";
+  name = "frigate";
   pod = "home-assistant";
+  defaultPort = "8971";
   scheme = "https";
   dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" "home-assistant.service" ];
 
@@ -27,7 +28,7 @@ helper.mkPodmanService {
   composeText = ''
     services:
       frigate:
-        image: ghcr.io/blakeblackshear/frigate:stable
+        image: ghcr.io/blakeblackshear/frigate:${frigateVersion}
         container_name: frigate
         hostname: frigate
         shm_size: "256mb"
@@ -50,8 +51,12 @@ ${lib.optionalString (cfg.devices != []) ''
         devices:
 ${lib.concatStringsSep "\n" (map (d: "        - \"${d}\"") cfg.devices)}
 ''}
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
+        stop_grace_period: 30s
         restart: unless-stopped
-
     networks:
       home-assistant:
         external: true