Frigate + Home Assistant: An NVR That Never Touches the Cloud

Coverage without a subscription — and without a vendor watching your driveway. Cameras sit on a VLAN with no route to the internet, Frigate detects locally on hardware you already own (Coral TPU, iGPU/NPU via OpenVINO, or an NV card), and every alert comes out of your Home Assistant instance. Verified against current official docs as published 2026-09-08; the running image is ghcr.io/blakeblackshear/frigate:stable, which tracks release line v0.17.2 (latest GitHub release, published 2026-06-28 — pin that tag if you want reproducibility).

Before you start//

• Cameras: 1–4 RTSP-capable cameras (Reolink-class works fine).
• One detection box with a backend: Google Coral USB/PCIe, an Intel iGPU/NPU, or an NV card — plus Docker. Per the installation docs, Frigate wants low-overhead access to that hardware; bare-metal Debian is the recommended host (Proxmox works for some users but isn't the first recommendation).
• Home Assistant running, with HACS if you don't have it.
• ~2–3 hours including the VLAN and firewall work. Skill floor: comfortable with docker compose and basic firewall rules.
• Blast radius: a new Docker container, one new VLAN + a handful of firewall rules, and an HA integration install (one restart). Nothing here modifies existing camera firmware or your LAN's core routing — but the VLAN step does touch your router/switch config, so snapshot it first if you can.

Step 1: Put the cameras on their own VLAN//

Create a dedicated VLAN/subnet for the cameras and lock down its traffic with firewall rules:

Per the installation docs, Frigate's port map is: 8971 authenticated UI/API ("reverse proxies should use this port"), 5000 internal unauthenticated access (keep it to the Docker network only), 8554 RTSP restreaming (unauthenticated by default — another reason HA is its only allowed client), and 8555 WebRTC for two-way talk.

Why: this is the "no phoning home" half of the payoff. A compromised camera on a flat LAN can reach your NAS; one on an isolated VLAN with exactly one allowed neighbor can't. The router hygiene drill covers the same IoT-VLAN logic for dumber devices — cameras just get their own dedicated ruleset because Frigate has to talk to them.

Step 2: Run Frigate in Docker//

From the official Docker installation guide:

services:
  frigate:
    container_name: frigate
    image: ghcr.io/blakeblackshear/frigate:0.17.2   # pin it; :stable tracks the same line (image tag has no "v")
    restart: unless-stopped
    shm_size: "512mb"        # see the docs' formula below if you run more/higher-res cameras
    volumes:
      - /path/to/your/config:/config
      - /path/to/your/storage:/media/frigate
      - type: tmpfs           # 1GB in-memory filesystem for recording segment storage
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "8971:8971"
      - "8554:8554"
    environment:
      - FRIGATE_RTSP_PASSWORD: "password"   # your cameras' RTSP password, if they use one

The docs give a formula for shm_size (Docker's default is 64MB; ~128MB covers two 720p cameras): python -c 'print("{:.2f}MB".format((<width> * <height> * 1.5 * 20 + 270480) / 1048576))' per camera, plus ~40MB for logs. Exceed it and Frigate dies with "Bus error."

Why pin the tag: :stable is what the docs' examples use, but a tutorial that says "current" without a number is a moving target — v0.17.2 is the release line as of this writing (GitHub release published 2026-06-28), and both tags were verified live on ghcr.io when this was written.

Step 3: Enable MQTT in Frigate before installing anything in HA//

This order matters — it's the #1 reason "the integration installed but nothing shows up." In Frigate's config.yml:

mqtt:
  enabled: True
  host: <your-ha-host>      # the address of your HA server that's running the MQTT integration
  user: your_mqtt_broker_username
  password: your_mqtt_broker_password

On the HA side, add the MQTT integration first. The easiest path per HA's docs is the official Mosquitto broker app — it auto-generates a safe username/password and "no further attention is required"; your broker must support MQTT protocol v5 (the Mosquitto app does). Put that generated username/password into Frigate's mqtt: block above, restart Frigate, and confirm in its UI/logs that the MQTT connection is up.

Why: per the HA integration docs, "MQTT must be enabled in your Frigate configuration file and Frigate must be connected to the same MQTT server as Home Assistant for many of the entities created by the integration to function." The integration is essentially a translator between Frigate's MQTT topics and HA entities — no shared broker, no translation.

Step 4: Install the official integration via HACS//

Per the installation section of the integration docs, when HA and Frigate are in separate compose networks, "it is recommended to connect to the authenticated port" (http://frigate:8971) — no port mapping needed for that path. The unauthenticated 5000 port exists for same-network Docker setups; point at it only if you're on the docs' host-networking example.

Why 8971 over 5000: port 5000 has no auth by design — it's meant to stay inside the Docker network. If HA can reach Frigate across networks, make it pay with credentials. (One gotcha from the docs' "separate machine" section: TLS is on by default on 8971 with a self-signed cert, and HA will fail HTTPS verification against it — disable TLS for pure-LAN use with tls:\n enabled: False in Frigate's config per the TLS docs, or mount real certs at /etc/letsencrypt/live/frigate if you want to do this properly.)

Step 5: Zones, thresholds, and notifications that carry local media//

1. Draw zones in Frigate's Web UI (the same drawing flow as motion masks — use the zone section), and enable "Zones" in a camera's Debug view (Settings → Debug) so you can watch them tune live; per the zones docs, zone membership is judged by the bounding box's bottom center point, not overlap.
2. Restrict alerts to what matters with required_zones and per-zone object filters — from the zones docs:

cameras:
  front_door:
    review:
      alerts:
        required_zones:
          - doorway
    zones:
      doorway:
        friendly_name: Doorway
        coordinates: [...]   # drawn in the Web UI
        objects:
          - person

3. Wire notifications to your own channel. The integration creates public API endpoints on HA's URL (Notification API section) — these exist precisely so "many people do not want to expose Frigate to the web":

An automation that triggers on the integration's per-camera/zone/object binary_sensor entities and pushes a notification with the thumbnail URL is all you need — your phone fetches media from HA, not from Frigate. One documented caveat: those occupancy/motion sensors are deliberately low-latency and false-positive-prone (the docs' FAQ says so explicitly) — for automation-critical triggers, use an MQTT sensor on the frigate/events or frigate/reviews topics instead.

Step 6 (optional): Lovelace card + Media Browser//

• The companion Lovelace card is a separate repo with its own install instructions — it's not part of the integration.
• For browsing recorded clips, enable media_source in your HA config (per the integration docs: "You will also need media_source enabled... for the Media Browser to appear") and use HA's Media Browser panel.

Verify it worked (non-negotiable)//

1. Walk in front of a camera. Confirm all three, in order: the event appears in Frigate's UI; the corresponding HA binary_sensor flips on; your notification arrives with a thumbnail that loads from /api/frigate/notifications/<event-id>/thumbnail.jpg.
2. Prove the no-cloud half. From a camera (or any device on its VLAN), ping 8.8.8.8 — it should fail while Frigate still sees the stream and detects you. That one failing ping is the whole point of Step 1.

When it breaks//

1. Integration installed, entities never appear. MQTT wasn't enabled in Frigate first (Step 3) or the broker credentials don't match what HA's Mosquitto app generated. Check Frigate's UI for its MQTT connection state before touching anything else — this is the docs' own prerequisite, not an edge case.
2. HA can't reach 8971 / live streams won't load. Two distinct failures: TLS self-signed cert rejection (fix per Step 4's note), or your camera-VLAN firewall rules locked too tight on 8554 — detection works because Frigate pulls from the cameras, but viewing in HA needs HA → Frigate:8554. Detection-up/viewing-down is that exact rule missing, not a Frigate bug.
3. Rollback. It's all additive: remove the integration (one restart), docker compose down the container, delete the VLAN rules. Cameras keep working exactly as before — they never needed anything but RTSP to begin with.