[Config Support]:

[neurorepro]

Describe the problem you are having

I am trying to use Docker secrets with Frigate 0.15.0 to securely inject the RTSP password into the configuration file using environment variable substitution.

The secret file /run/secrets/FRIGATE_RTSP_PASSWORD is present and contains the correct password (ABCD1234), but the substitution fails, and Frigate attempts to connect using rtsp://*:*@..., leading to 401 errors.

Substitution only works if I hardcode the password in the config file. All attempts to use secrets fail despite the fact that Frigate appears to support reading /run/secrets/FRIGATE_*.

Steps to reproduce

1. Create a Docker Swarm secret with echo 'ABCD1234' | docker secret create FRIGATE_RTSP_PASSWORD -
2. Reference it in a camera path as rtsp://admin:${FRIGATE_RTSP_PASSWORD}@... in config.yml (PS: i tried with and without double quotes for the path value)
3. Deploy Frigate using Docker Swarm with that secret mounted (see stack file below)
4. Check the Frigate logs or /api/config — path is rendered as rtsp://*:*@... and camera feed fails

Version

Frigate 0.15.0-6cb5cfb

Frigate config file

mqtt: {}

cameras:
  ezviz_ty2:
    ffmpeg:
      inputs:
        - path: "rtsp://admin:${FRIGATE_RTSP_PASSWORD}@192.168.1.183:554/h264/ch01/main"
          roles:
            - detect
            - record
    detect:
      width: 1920
      height: 1080
      fps: 5
    record:
      enabled: true
      retain:
        days: 2

version: 0.15-1

Relevant Frigate log output

[2025-05-11 10:16:37] ffmpeg.ezviz_ty2.detect ERROR   : [rtsp @ ...] method DESCRIBE failed: 401 Unauthorized
[2025-05-11 10:16:37] ffmpeg.ezviz_ty2.detect ERROR   : Error opening input file rtsp://*:*@192.168.1.183:554/h264/ch01/main.

Relevant go2rtc log output

No relevant entries — issue is on Frigate’s side before go2rtc usage.

Frigate stats

No response

Operating system

Home Assistant OS

Install method

Docker Compose

docker-compose file or Docker CLI command

version: '3.8'

services:
  frigate:
    image: ghcr.io/blakeblackshear/frigate:stable
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
    secrets:
      - FRIGATE_RTSP_PASSWORD
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./config:/config
      - ./media:/media
      - type: tmpfs
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "5000:5000"

secrets:
  FRIGATE_RTSP_PASSWORD:
    external: true

Object Detector

CPU (no coral)

Screenshots of the Frigate UI's System metrics pages

No response

Any other information that may be helpful

No response

[NickM-27]

Check the Frigate logs or /api/config — path is rendered as rtsp://:@... and camera feed fails

This is done to hide the password, * is not what is actually used

[hawkeye217]

In your config file, you should not be specifying a $ before any environment variables.

See the official docs: https://docs.frigate.video/configuration/#environment-variable-substitution

[neurorepro]

Can't believe i spent so much time on trying solving it when it was that mistake, thank you so much for looking into it and spotting it right away!

[hawkeye217]

Glad it's working!