frigate: Enable Frigate+ integration

To keep the API key a secret, we're encrypting the environment file in
the repository with GnuPG.  The decrypted copy only lives in the work
tree and is never committed. Changes have to be re-encrypted and
committed.

.gitattributes

@@ -0,0 +1 @@
+*.gpg diff=gpg

.gitignore

@@ -1 +1,2 @@
 *.ign
+frigate.env

Makefile

@@ -17,6 +17,9 @@ endef
 
 $(foreach t,$(wildcard *.yaml),$(eval $(call genrules,$(t))))
 
+%.env: %.env.gpg
+	gpg2 --decrypt $< > $@
+
 publish: \
 		nvr1.ign
 	rsync -rti $^ files.pyrocufflink.blue:public_html/

frigate.container

@@ -12,6 +12,7 @@ PodmanArgs=--gidmap 0:209:1
 PodmanArgs=--uidmap 1:6000001:65536
 PodmanArgs=--gidmap 1:6000001:65536
 PodmanArgs=--shm-size 256m
+EnvironmentFile=/etc/sysconfig/frigate
 Volume=/var/lib/frigate/media:/media/frigate:rw,z
 Volume=/var/lib/frigate/tmp:/tmp:rw,z
 Volume=/var/lib/frigate/config:/config:rw,z

frigate.yaml

@@ -15,6 +15,14 @@ storage:
     mode: 0644
     contents:
       local: frigate.tmpfiles
+  - path: /etc/sysconfig/frigate
+    mode: 0640
+    user:
+      id: 0
+    group:
+      id: 209
+    contents:
+      local: frigate.env
 
 systemd:
   units: