Network & remote access

Ports

Fregata’s default listeners:

Port	Service	Bound to	Notes
8971 (default)	nginx → Frigate web UI + HTTP API	0.0.0.0	HTTPS by default (self-signed cert). Set tls.enabled: false in config.yml for plain HTTP. Customizable — see networking.listen.external below.
5000 (default)	nginx → Frigate API (internal)	127.0.0.1 (default) or 0.0.0.0	Loopback-only by default. Set FREGATA_EXPOSE_INTERNAL_PORT=1 to expose to your LAN. Plain HTTP, no authentication. If this port is already taken (e.g. by macOS AirPlay Receiver, if left at the default of 5000), Fregata automatically uses port 5050 instead — see below. Customizable — see networking.listen.internal below.
1984	go2rtc admin UI	127.0.0.1 (default) or 0.0.0.0	Loopback-only by default. Set FREGATA_EXPOSE_GO2RTC_PORT=1 to expose to your LAN. Plain HTTP, no authentication.
8554	go2rtc RTSP re-stream	0.0.0.0 (default) or 127.0.0.1	LAN-exposed by default. Set FREGATA_EXPOSE_RTSP_PORT=0 to lock it to loopback-only. Plain RTSP, no authentication by default — see below to add a username/password.
8555	go2rtc WebRTC	0.0.0.0	Needed for low-latency live view from outside the Mac.

The HA integration and Fregata Mobile only need 8971. Most users don’t think about the others.

For Port 5000: Use 127.0.0.1:5000, not localhost:5000

Fregata’s port 5000 listener binds only 127.0.0.1 (IPv4) by default. If macOS’s AirPlay Receiver is enabled http://localhost:5000/... can silently land on AirPlay Receiver instead of Fregata, while http://127.0.0.1:5000/... reaches Fregata correctly. Always use the explicit 127.0.0.1 address — never localhost — when scripting against this port. (If you’ve moved the internal port with networking.listen.internal, the same AirPlay caveat only applies while it’s left at the default of 5000.)

Changing the ports with networking.listen

Frigate’s networking.listen.internal/.external config keys let you move the two ports above off their defaults:

Settings UI

1. In the web UI, go to Settings → System → Networking.
2. Under Listening ports configuration, set Internal port (default 5000) and External port (default 8971).
3. Click Save, then Restart when the page asks. Port changes always need a restart, and the menu-bar app’s Open Frigate Web UI follows the new external port. This browser tab keeps pointing at the old port, so reopen the web UI from the tray after the restart.

YAML

networking:
  listen:
    internal: 5000   # default
    external: 8971   # default

A few things worth knowing about how this behaves on Fregata:

• FREGATA_EXPOSE_INTERNAL_PORT and the AirPlay-conflict fallback above both follow whichever port ends up “internal” — not literally 5000. Set a custom internal port and those still work the same way, just on the new port number.
• Only the port number is honored. An ip:port string’s host part is parsed and discarded — Fregata’s own loopback-by-default / FREGATA_EXPOSE_INTERNAL_PORT gating still decides what interface it binds, regardless of what host you write here.
• Setting internal and external to the same port is rejected when the config is validated: Save fails in the Settings UI, and a hand-edited file fails validation at startup. A collision would let external, authenticated-path traffic land on the unauthenticated internal-port bypass described below, so Fregata refuses it rather than silently creating that hole.
• Picking a port Fregata already uses for something else (5001, 5002, 8082, 1984, 8554, 8555) is logged as a warning and will most likely stop Fregata from starting. Pick a free port.

Reaching it from another device on your LAN

Fregata is happy to serve 8971 to anything on your LAN. Just open https://<mac-ip>:8971 from a different device — the first visit shows a self-signed-certificate warning (the same one you click through on localhost). To avoid the warning on a trusted LAN, turn off Fregata’s own TLS and use http://<mac-ip>:8971:

Settings UI

1. In the web UI, go to Settings → System → TLS.
2. Turn off Enable TLS.
3. Click Save, then Restart when the page asks. Fregata now serves plain HTTP on the external port (8971 by default). This browser tab stops loading, because it still points at https://; reopen the web UI with Open Frigate Web UI in the tray, or go to http://<mac-ip>:8971.

YAML

tls:
  enabled: false

Then choose Restart Frigate from the tray.

A couple of practical notes:

• Use a hostname, not an IP. Bonjour gives you <mac-name>.local for free; bookmarking that survives DHCP shuffles. Set the hostname in System Settings → General → Sharing → Local hostname.
• macOS firewall. If you’ve enabled it (System Settings → Network → Firewall), the first inbound connection to Fregata triggers the standard “allow incoming connections” prompt. Allow it once and the rule sticks.

Fregata Mobile: away from home

Fregata Mobile, the free iPhone, iPad and Apple Watch app (public beta), talks to Fregata directly. There is no Fregata cloud in between, so away from home your phone needs a way to reach your Mac.

The app needs one port: 8971, the one that asks for a sign-in. Don’t point it at 5000: it has no sign-in, so it should stay off the internet, and alerts registered through it are lost while sign-in is on (see the caution under Option A). Live video and the app’s live updates use WebSocket connections on that same port, so the app doesn’t need 8555.

You give the app two addresses, At home and Away:

	Address
At home	https://<mac-ip>:8971
Away	https://<tailscale-ip>:8971, or the domain of a reverse proxy

It tries both, uses whichever answers, and switches by itself as you move between networks. Either one on its own is enough: if a single address works everywhere, put it under Away and leave At home empty.

Ways to make the Mac reachable, simplest first:

• Tailscale or another VPN. Install it on the Mac and on the phone, sign both in to the same account, and use the Mac’s Tailscale address under Away. Nothing is exposed to the internet. See the Tailscale paragraph under Exposing it to the public internet.
• Cloudflare Tunnel or another reverse proxy. Point it at port 8971 as in Putting Fregata behind a reverse proxy, and let WebSocket connections through. If Cloudflare Access sits in front, give the app a service token as custom headers.
• Port forwarding. It works, but read Exposing it to the public internet first.

Fregata’s default certificate is self-signed. On a home-network address the app trusts it the first time and remembers it. On any other address it shows the certificate’s fingerprint and asks before trusting it. A real certificate from a reverse proxy needs no question.

Without an Away address, alerts still reach the phone away from home, but without their picture, and live view and recordings only work at home.

Only Fregata can do the next part: when the NVR is Fregata, the app steps recordings down on a slow connection and opens live view on a lighter stream away from home. Recordings need adaptive transcoding turned on for the camera, and live view also needs Enable live-view transcoding.

Behind a reverse proxy or tunnel

Fregata gives viewers it thinks are at home the original stream, with no ladder: any address in the LAN networks list of the adaptive transcoding settings. Behind a reverse proxy or a tunnel such as Cloudflare Tunnel, Fregata can see the proxy’s address instead of the phone’s. When that address is on your network, every viewer gets the original stream. Add the proxy’s address under Trusted proxies (Settings → System → Authentication, in its advanced settings; auth.trusted_proxies in config.yml), or remove its range from LAN networks. A VPN that hands out 10.x or 192.168.x addresses has the same effect: see LAN bypass.

The app’s own pages cover the rest: Away from home and Connect your server.

Putting Fregata behind a reverse proxy

A common setup: Caddy or Traefik on a NAS or small Linux box, terminating TLS, and proxying to the Mac. The minimum Caddyfile:

cameras.your-house.example {
    reverse_proxy http://10.0.1.42:8971
}

Caddy gets you a Let’s Encrypt cert, HTTP/2, websocket upgrade (needed for live MSE/WebRTC), and a clean URL.

Turn Fregata’s own TLS off behind a proxy

Fregata serves HTTPS with a self-signed cert by default, and you don’t want two layers of TLS. Turn TLS off (Settings → System → TLS → Enable TLS, or tls.enabled: false in ~/Fregata/config/config.yml, exactly as in the box under Reaching it from another device on your LAN) and restart, so Fregata serves plain HTTP on 8971 (still reachable from your LAN, so keep it off untrusted networks) and the proxy terminates real TLS — that’s what makes the http://…:8971 upstream above correct.

If you’d rather leave Fregata on HTTPS, point the upstream at https://…:8971 and tell the proxy to skip upstream cert verification — the cert is self-signed (Caddy: transport http { tls_insecure_skip_verify }).

Exposing it to the public internet

Short answer: don’t, unless you absolutely mean to.

Long answer: if you do, the bare minimum:

1. Put it behind a real reverse proxy with TLS (Caddy, Traefik, Cloudflare Tunnel).
2. Keep Frigate’s authentication on. It’s enabled by default, and the admin password was set in the welcome wizard (see Your dashboard sign-in). The box below shows how to confirm it.
3. Restrict by source IP at the proxy if you can.
4. Don’t expose 8554 (RTSP) or 1984 (go2rtc admin) to the internet under any circumstance. Neither has authentication by default.

Settings UI

In the web UI, go to Settings → System → Authentication and check that Enable authentication is on.

YAML

auth:
  enabled: true

The reasonable middle path for “I want to check my cameras from my phone” is Tailscale or a similar mesh VPN: install on the Mac and on your phone, hit https://<tailscale-ip>:8971 from anywhere (click through the self-signed warning once). The Tailscale tunnel is already encrypted end-to-end, so if you’d rather skip the warning, turn off TLS (Settings → System → TLS, or tls.enabled: false; see above) and use http://<tailscale-ip>:8971. No public exposure, near-zero attack surface. On an iPhone or iPad, Fregata Mobile works the same way: put the Tailscale address under its Away setting.

Mac sleep and Wake-On-Demand

Fregata keeps the system awake while it’s running. As soon as the menu-bar status reads Running, the supervisor takes a ProcessInfo activity assertion with .idleSystemSleepDisabled and holds it until Frigate stops, errors out, or you quit the app. You don’t need to touch System Settings; the display is still free to sleep, only the system itself stays awake.

This means the boring 24/7 install case — Mac mini in a closet, Fregata launched at login, never restarted — just works.

Caveats worth knowing about:

• A laptop that closes its lid still sleeps. Lid closure is a hardware-level signal that overrides every software assertion. If you need 24/7 detection, run on a desktop or use clamshell mode with an external display attached.
• The activity is released on .error and .stopping. A Fregata that crashed or was stopped by you doesn’t strand the Mac awake.
• Belt-and-braces: if you want the same behavior even when Fregata isn’t running, System Settings → Energy Saver / Battery → “Prevent automatic sleeping when display is off” (desktop) or “Prevent automatic sleeping on power adapter” (laptop).
• caffeinate command or the Amphetamine app are still useful to prevent your Mac from sleeping when Fregata isn’t yet running.

Using the API from local automation tools

Tools like Node-RED or custom scripts that run on your LAN can talk to Fregata’s HTTP API. There are two ways to do it:

Option A — Port 8971 with a Bearer token (recommended)

This is the standard path and keeps authentication in place.

1. POST to http://<mac-ip>:8971/api/login with your credentials:

   { "user": "admin", "password": "your-password" }

2. The response body contains a JWT. Store it in a Node-RED flow variable or script environment.
3. Add Authorization: Bearer <token> to every subsequent request.

Tokens are valid for 24 hours by default. To keep a script running indefinitely, re-POST to /api/login on a timer (every 23 hours is safe).

Alternatively, turn authentication off. Port 8971 then requires no credentials at all, which may be simpler if the network is fully trusted:

Settings UI

1. In the web UI, go to Settings → System → Authentication.
2. Turn off Enable authentication.
3. Click Save, then Restart when the page asks.

YAML

auth:
  enabled: false

Fregata Mobile: use port 8971 for alerts

Live view and recordings work in Fregata Mobile over either port, but alerts are registered to an account. Over port 8971 that’s the account the app signs in with. Over port 5000, Frigate treats every request as an anonymous user that has no account, so while sign-in is on (Fregata’s default) the registration reports success, saves nothing, and no alerts arrive.

Turning sign-in off doesn’t stop alerts in Fregata: they’re filed under the admin account Fregata creates at first launch. (Stock Frigate with sign-in off from the start has no such account, which is why Fregata Mobile’s own docs say alerts need sign-in.) Still, with sign-in off anyone who can reach port 8971 has full access, so leave it on if that port is reachable from outside your network, and use the bearer token above for scripts.

Option B — Port 5000 with FREGATA_EXPOSE_INTERNAL_PORT=1

Port 5000 is nginx’s internal proxy. It has no authentication middleware — requests arrive at the API already labelled as admin. By default it only accepts connections from the same Mac. Setting the environment variable opens it to your whole LAN.

No authentication — everyone on your LAN gets admin access

Any device that can reach port 5000 can read your recordings, change your config, and control your cameras with no login. Only enable this on a private network you fully control (home LAN behind a router). Do not enable it on shared, public, or semi-trusted networks.

To enable, add FREGATA_EXPOSE_INTERNAL_PORT=1 in the tray’s Settings → Environment Variables… and restart Fregata. A warning appears in the Fregata log every time Fregata starts while the flag is set, so you always have a visible reminder that the port is open.

Point your automation tool at http://<mac-ip>:5000/api/… — no Authorization header needed.

Port 5000 already in use? Check for AirPlay Receiver

macOS’s AirPlay Receiver (System Settings → General → AirDrop & Handoff) permanently binds port 5000 — and 7000 — on all interfaces whenever it’s turned on, which collides with the LAN-exposed listener above. You do not need to disable AirPlay Receiver to work around this: Fregata detects the conflict at startup and automatically serves the same unauthenticated endpoint on port 5050 instead, while port 5000 itself stays loopback-only.

This automatic fallback only applies when FREGATA_EXPOSE_INTERNAL_PORT=1 is set. Without it, port 5000 stays loopback-only and there’s no bind conflict to detect — but AirPlay Receiver can still shadow it on the IPv6 side; see Use 127.0.0.1:5000, not localhost:5000 above.

Check the Fregata log for a line like:

FREGATA_EXPOSE_INTERNAL_PORT is set, but port 5000 is already bound by
<process> (commonly macOS's AirPlay Receiver). Falling back to port 5050
for LAN-exposed unauthenticated access instead; port 5000 itself stays
loopback-only.

If that line appears, point your automation tool at port 5050 instead of 5000 — everything else (no Authorization header needed) stays the same. If 5050 is also taken on your network, set FREGATA_INTERNAL_PORT_FALLBACK to a free port of your choice in the tray’s Settings → Environment Variables… (it can’t be a port Fregata uses internally — see the environment variables reference for the full list).

Option C — Port 1984 with FREGATA_EXPOSE_GO2RTC_PORT=1

This one’s for tools that need to talk to go2rtc directly — reading or changing restream config, or pulling an RTSP/WebRTC feed — rather than going through Frigate’s API. Most automation should use Option A or B instead; reach for this only if go2rtc itself is what you need.

No authentication on go2rtc’s admin API

go2rtc has no login of its own. Anyone who can reach port 1984 can read and change your stream configuration and pull camera feeds directly. Only enable this on a private network you fully control.

To enable, add FREGATA_EXPOSE_GO2RTC_PORT=1 in the tray’s Settings → Environment Variables… and restart Fregata, then point your tool at http://<mac-ip>:1984/api/…. Unlike port 5000, there’s no conflict fallback to worry about — go2rtc runs as its own process, so a failed bind only affects go2rtc, and port 1984 isn’t known to collide with anything on macOS.

Option D — Port 8554, locking it down with FREGATA_EXPOSE_RTSP_PORT=0

Port 8554 is go2rtc’s RTSP restream, and unlike the other ports on this page it’s open to your LAN by default — tools that want to pull the RTSP restream directly (VLC, Home Assistant’s RTSP camera platform, another NVR) can connect to rtsp://<mac-ip>:8554/<camera_name> with no extra configuration.

No authentication on the RTSP restream, by default

The RTSP feed has no login of its own by default. Anyone who can reach port 8554 can watch (and, for cameras with two-way talk configured, potentially control) your camera streams directly. If you don’t need this from another machine, lock it down; if you do need LAN access, add a username/password (below) instead of leaving it open.

To restrict it to loopback-only, add FREGATA_EXPOSE_RTSP_PORT=0 in the tray’s Settings → Environment Variables… and restart Fregata. A warning appears in the Fregata log every time Fregata starts while the port is locked down, so you always have a visible reminder. Same posture as port 1984 — no conflict fallback to worry about, since go2rtc runs as its own process and port 8554 isn’t known to collide with anything on macOS.

To add a username/password instead of locking the port down entirely, set go2rtc.rtsp.username/password in config.yml:

config.yml only. The Settings UI only manages go2rtc streams, not the other go2rtc options.

go2rtc:
  rtsp:
    username: "admin"
    password: "pass"

Clients then connect with rtsp://admin:pass@<mac-ip>:8554/<camera_name>. This is go2rtc’s own credential check, independent of Frigate’s auth.enabled and separate from the username/password your cameras use upstream.

Custom go2rtc stream sources

go2rtc can build a stream by running a command on your Mac — an exec: source (usually a custom ffmpeg pipeline), or an echo:/expr: source that shells out to compute the stream URL. These enable genuinely useful setups: splitting a dual-fisheye camera, burning in a drawtext timestamp, or GPU-accelerated rotation (go2rtc’s built-in #rotate is CPU-only, so rotation is done with a VideoToolbox exec: pipeline). By design, though, they run arbitrary local commands.

Restricted by default

Fregata rejects exec:, echo:, and expr: stream sources by default, matching upstream Frigate. If your config.yml defines one, that stream is removed from the generated go2rtc config and a line is written to the Frigate log naming it — so a camera that quietly disappears from live view after you add a custom source has a matching explanation in the log:

go2rtc stream 'my_cam' uses a restricted source (echo/expr/exec), disabled
by default for security; removing it. Set GO2RTC_ALLOW_ARBITRARY_EXEC=true
to allow.

The same default-deny covers the { url: … } map form and the PUT /go2rtc/streams admin API.

Allowing custom sources

If you genuinely need one, set GO2RTC_ALLOW_ARBITRARY_EXEC=true in the menu-bar tray’s Settings → Environment Variables…, then restart Fregata — environment-variable changes take effect only when Frigate starts. This is the Fregata equivalent of the environment: block you’d use with Frigate on Docker.

The exec: streams Fregata generates for itself — the birdseye restream and the adaptive-live rungs — are always allowed; this switch gates only the sources you write into go2rtc.streams.

The {{output}} token and brace-doubling

Stream values are expanded with Python’s str.format() before go2rtc sees them, so you can reference {FRIGATE_*} environment variables directly (this is upstream Frigate’s behavior). The catch: every literal { or } in the value must be doubled. That is why go2rtc’s RTSP output placeholder is written {{output}} — it collapses to the {output} token go2rtc fills in — and why an ffmpeg expansion like drawtext’s %{localtime} has to be written %{{localtime}}.

config.yml only. The go2rtc streams page in Settings refuses exec:, echo:, and expr: sources, so add them in config.yml.

go2rtc:
  streams:
    front_custom:
      # {{output}} -> {output}; {FRIGATE_CAM_PW} is filled from the environment
      - "exec:ffmpeg -hwaccel videotoolbox -i rtsp://user:{FRIGATE_CAM_PW}@10.0.0.5/main -c:v h264_videotoolbox -f rtsp {{output}}"

A value that isn’t a valid format string — an un-doubled {output}, a bare %{localtime}, an empty {} — is dropped with an explanatory log line rather than passed through raw (an un-collapsed brace would reach ffmpeg literally and the camera would silently 404-loop). Brace-doubling is required whether or not GO2RTC_ALLOW_ARBITRARY_EXEC is set — the env var only decides whether a successfully-expanded restricted source is kept.

Ports for Home Assistant

If you’re running HA on a different host, see the Home Assistant guide — the integration needs to reach 8971 and (if you’ve enabled it) MQTT on whatever broker you’re using.