Readiness report
Frigate Network Video Recorder · 2026-09-03 16:03 · complete · 22 searches, 24 pages fetched
Cybersecurity — software & network: Review before networking · 28 findings
Details in the Cybersecurity section of the report below.
Readiness: Frigate Network Video Recorder
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $450–$900 for a one-camera system Cybersecurity — software & network: Review before networking
This is the cold check for this lab — there is no previous report, so every price and stock level below is the baseline the next check will measure drift against. The bill of materials is a menu of alternatives rather than a shopping list: Frigate needs one host, at most one AI accelerator, and one or more cameras, so a troubled line only matters if its whole section is troubled. No section is. A Raspberry Pi 5 8 GB is in stock at an authorized distributor for $175.00, the Raspberry Pi AI HAT+ accelerator is in stock at $70.00 (13 TOPS) or $110.00 (26 TOPS), an Intel Arc A310 starts at $144.99, and the lab's primary recommended camera is an exact-model match at $199.99. What keeps this off a clean "Ready" is that the Google Coral accelerators most older Frigate guides lead with have no authorized-distributor stock at all, the Raspberry Pi AI Kit named in the BOM has been replaced in the reseller channel by the AI HAT+, the Hikvision panoramic camera could not be found for sale anywhere checked, and four BOM lines were not priced at all this run.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| Google Coral USB Accelerator (G950-06809-01) | No authorized-distributor stock: Arrow shows 0 on hand, a 22-week factory lead time and only a 1,584-piece price break. Retail resellers want $107–$120 for a part the snapshot already calls deprecated. | Do not buy Coral for new builds. Use the Raspberry Pi AI HAT+ on a Pi 5 host, or the host's own Intel iGPU/NPU under OpenVINO, or an Intel Arc / Nvidia card on an x86 host — all sanctioned by the snapshot. |
| Google Coral M.2 Accelerator A+E key (G650-04527-01) | Same broken channel: Arrow is the only authorized distributor and shows "Out of stock" at $29.63. | Same as above. Do not read the $55.24 "Dual Edge TPU" M.2 listing as this part — it is a different board. |
| Raspberry Pi AI Kit (Hailo-8L) | The reseller product URL for the AI Kit now serves the Raspberry Pi AI HAT+ 13 TOPS page instead; no price or stock for the AI Kit itself was found anywhere this run. | Order the AI HAT+ 13 TOPS (SC1785, $70.00, in stock). Note the AI HAT+ integrates the accelerator, so an existing AI Kit's M.2 2242 module cannot be moved over. |
| Hailo-8 M.2 Module (HM218B1C2GA) | Not stocked by DigiKey and listed by no ECIA-authorized distributor. The Hailo-8 silicon is current, but that order code is unobtainable through the channels checked. | On a Raspberry Pi 5 host, buy the AI HAT+ 26 TOPS (SC1791, $110.00, in stock). For an x86 host, no priced bare M.2 card was found — use the host iGPU/NPU or a PCIe GPU instead. |
| Hikvision DS-2CD2387G2P-LSU/SL | No purchasable route found: 0 products at DigiKey, no ECIA-authorized distributor, and an empty Google Shopping result set for the exact model. | Verify availability with a security-channel dealer directly. If it is gone, drop the panoramic option and cover the same field of view with two fixed cameras. |
| Beelink EQ13 Mini PC (N100, dual GbE) | The exact EQ13 N100 did not appear in this run's retail results. | Substitute any dual-NIC x86-64 Intel host with AVX2 — but not the EQ14, which appears at $375.00 and which Frigate's own documentation blacklists. |
| Loryta / Dahua IPC-T54IR-AS | The bare -AS SKU is not listed; the current -S3 revision appears only in a 10-camera bulk kit at $1,879.91. | Buy the IPC-T549M-ALED-S3 instead ($199.99, exact model match, single unit) unless IR night vision specifically is required. |
Cybersecurity — software & network
Review before networking — The recorder ships a deliberately unauthenticated admin API on port 5000 and prints its generated admin password to the log, and this run confirmed published vulnerabilities in the web UI's HTTP client and in the backend's upload parser, which the project pins to a version with no available fix.
| Component | Version | How known | Support status |
|---|---|---|---|
| Frigate NVR (application) | not determined | not determined (The lab materials name no Frigate release; dependency files were read from the project's dev branch this run) | — |
| Debian (container base OS) | 12 | read from project (docker/main/Dockerfile: ARG BASE_IMAGE=debian:12 / SLIM_BASE=debian:12-slim) | extended/LTS support only until 2028-06-30 |
| Python (backend runtime) | 3.11 | inferred (cp311 wheel tags in docker/main/requirements-wheels.txt; no interpreter version is stated directly) | supported until 2027-10-31 |
| Frigate backend Python dependencies | not determined | unpinned (docker/main/requirements-wheels.txt: 64 of 67 rows are ==X.Y.* series constraints, not exact versions) | — |
| NVIDIA Linux display driver | 545 | inferred (snapshot: hardware.md states a minimum driver version of 545 for CUDA 12.x) | — |
| NVIDIA JetPack (Jetson hosts) | 6 | inferred (snapshot: hardware.md requires JetPack 6 for the TensorRT and ONNX detectors) | — |
| tflite_runtime | 2.17.1 | inferred (read from the wheel release URLs in docker/main/requirements-wheels.txt (v2.17.1 tags), not from an exact == pin) | — |
| py3nvml | not determined | unpinned (docker/main/requirements-wheels.txt installs git+https://github.com/fbcotter/py3nvml with no tag or commit) | — |
| python-multipart | 0.0.26 | read from project (exact pin in docker/main/requirements-wheels.txt) | — |
| axios | 1.13.6 | read from project (pinned in web/package-lock.json) | — |
| js-yaml | 4.1.1 | read from project (pinned in web/package-lock.json) | — |
| react-router | 6.30.3 | read from project (pinned in web/package-lock.json) | — |
| react-router-dom | 6.30.3 | read from project (pinned in web/package-lock.json) | — |
| @remix-run/router | 1.23.2 | read from project (pinned in web/package-lock.json) | — |
| follow-redirects | 1.15.11 | read from project (pinned in web/package-lock.json) | — |
| fast-uri | 3.1.2 | read from project (pinned in web/package-lock.json) | — |
| form-data | 4.0.5 | read from project (pinned in web/package-lock.json) | — |
| i18next-http-backend | 3.0.1 | read from project (pinned in web/package-lock.json) | — |
| nanoid | 3.3.11 | read from project (pinned in web/package-lock.json) | — |
| object-path | 0.6.0 | read from project (pinned in web/package-lock.json) | — |
| uuid | 13.0.0 | read from project (pinned in web/package-lock.json) | — |
| postcss | 8.5.8 | read from project (pinned in web/package-lock.json) | — |
| brace-expansion | 1.1.11 | read from project (pinned in web/package-lock.json) | — |
| braces | 3.0.2 | read from project (pinned in web/package-lock.json) | — |
| micromatch | 4.0.5 | read from project (pinned in web/package-lock.json) | — |
| picomatch | 2.3.1 | read from project (pinned in web/package-lock.json) | — |
| vite | 6.4.2 | read from project (pinned in web/package-lock.json) | — |
| vitest | 3.0.7 | read from project (pinned in web/package-lock.json) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| vitest | With the Vitest UI server listening, any file on the machine can be read and executed; this is the test runner, so it only matters if someone runs the UI test server on the lab machine. — GHSA-5xrq-8626-4rwp | critical | Yes - update to 3.2.6 |
| axios | The HTTP client the Frigate web UI uses carries 28 advisories at this version, the most serious being a full man-in-the-middle via prototype pollution in the proxy config plus several header-leak and denial-of-service issues. — GHSA-35jp-ww65-95wh, GHSA-777c-7fjr-54vf, GHSA-hfxv-24rg-xrqf, GHSA-j5f8-grm9-p9fc (+2 more) | high | Yes - update to 1.16.0 (web/package.json already allows it with ^1.13.6; refresh web/package-lock.json) |
| brace-expansion | Denial-of-service flaws in a glob helper used by the frontend build chain; not reachable from a running Frigate container. — GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg, GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v (+1 more) | high | Yes - update to 1.1.18 |
| braces | Uncontrolled resource consumption in another build-chain glob helper; build tooling only. — GHSA-grv7-fg5c-xmjg | high | Yes - update to 3.0.3 |
| fast-uri | The URI parser used by the UI's schema validation mis-normalises hostnames in six different ways, which can be used for server-side request forgery or host confusion wherever a URL from the config is trusted. — GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp, GHSA-7p8r-x3mc-p8w7 (+2 more) | high | Yes - update to 3.1.6 |
| form-data | CRLF injection through unescaped multipart field names lets a crafted upload forge extra headers. — GHSA-hmw2-7cc7-3qxx | high | Yes - update to 4.0.6 |
| js-yaml | The YAML parser behind Frigate's in-browser configuration editor can be pushed into quadratic CPU consumption by a crafted config, hanging the editor for the person who opens it. — GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68 | high | Yes - update to 4.3.1 |
| nanoid | The ID generator can loop indefinitely or wrap around on hostile input, which would hang whichever UI component asked for an ID. — GHSA-xwg4-73v4-xw9w, GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8 | high | Yes - update to 3.3.18 |
| object-path | Three prototype-pollution flaws in a long-outdated helper that the UI's JSON-schema form stack pulls in; prototype pollution is the usual first step towards script injection in a browser app. — GHSA-cwx2-736x-mf6w, GHSA-8v63-cqqc-6r2c, GHSA-v39p-96qg-c8rf | high | Yes - update to 0.11.8 |
| picomatch | Regular-expression denial of service and incorrect glob matching in the build chain; build tooling only. — GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p | high | Yes - update to 2.3.2 |
| postcss | Arbitrary local file disclosure through an attacker-controlled source-map comment; this is frontend build tooling, so it bites whoever builds the UI from source, not a running Frigate container. — GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q, GHSA-qx2v-qp2m-jg93, GHSA-fxqj-rqcc-2cmp | high | Yes - update to 8.5.23 |
| python-multipart | Frigate's FastAPI backend parses uploaded form data with this library, and this version can be driven into a CPU denial of service or made to buffer a whole request body in memory by a crafted upload - reachable by anyone who can reach the API. — GHSA-5rvq-cxj2-64vf, GHSA-pp6c-gr5w-3c5g, GHSA-6jv3-5f52-599m, GHSA-v9pg-7xvm-68hf (+1 more) | high | No - project pins ==0.0.26 in docker/main/requirements-wheels.txt (fixed in 0.0.30); needs an upstream Frigate bump |
| vite | A file-serving restriction bypass in the development server; it only applies while someone is running the Vite dev server on Windows, not to a built Frigate image. — GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3 | high | Yes - update to 6.4.3 |
| @remix-run/router | The routing core underneath React Router carries the same protocol-relative open-redirect issue. — GHSA-2j2x-hqr9-3h42 | moderate | Yes - update to 1.23.3 |
| follow-redirects | Custom authentication headers are leaked to a cross-domain redirect target, which matters for the outbound calls Frigate makes to cloud AI and push-notification endpoints. — GHSA-r4q5-vmmm-2653 | moderate | Yes - update to 1.16.0 |
| i18next-http-backend | The UI's translation loader accepts unsanitised language and namespace values, allowing path traversal or URL injection when fetching translation files. — GHSA-q89c-q3h5-w34g | moderate | Yes - update to 3.0.5 |
| micromatch | Regular-expression denial of service in the build chain's glob matcher; build tooling only. — GHSA-952p-6rrq-rcjv | moderate | Yes - update to 4.0.8 |
| react-router | The web UI's router can be tricked into redirecting a logged-in user to an attacker's site through a protocol-relative or backslash-prefixed link. — GHSA-337j-9hxr-rhxg, GHSA-wrjc-x8rr-h8h6, GHSA-2j2x-hqr9-3h42 | moderate | Yes - update to 6.30.4 |
| react-router-dom | An open redirect in the same router family that can be escalated to cross-site scripting, and this one has no fixed release. — GHSA-jjmj-jmhj-qwj2 | moderate | Mitigation only - no fixed version exists; keep the UI off untrusted networks and do not follow UI links from outside sources |
| uuid | A missing buffer bounds check in the v3/v5/v6 generators when a caller supplies its own buffer. — GHSA-w5hq-g745-h8pq | moderate | Yes - update to 13.0.1 |
| Debian (container base OS) | The container base image is Debian 12, which left standard support on 2026-07-11 and now receives only extended/LTS security updates (until 2028-06-30). | posture | Mitigation only - stay current with the LTS security updates and plan for the upstream image to rebase before June 2028 |
| Frigate backend Python dependencies | dependencies unpinned: 64 of 67 in docker/main/requirements-wheels.txt - the backend installs whatever patch release of each ==X.Y.* series is current at image build time, so two builds of the same lab can ship different code and neither has a checkable security state. | posture | Mitigation only - pin versions / use a lockfile, and record the image digest the class actually ran |
| Frigate NVR (admin account) | The admin user and password are generated at first startup and printed into the container log, so anyone who can read the logs can log in until the password is changed. | posture | Mitigation only - change the admin password under Settings > Users immediately after the first login and restrict access to the container logs |
| Frigate NVR (HTTP API) | Frigate serves an unauthenticated UI and API on port 5000 whose role is overridden to admin-level access, so anyone who can reach that port controls the recorder without logging in; only port 8971 requires authentication. | posture | Mitigation only - publish only port 8971, keep 5000 on the internal Docker network, and block it at the campus firewall |
| Frigate web UI (development server) | The web UI's development script is "dev": "vite --host", which binds the unauthenticated dev server to every network interface; it is a development convenience, not something to run on a shared campus network. | posture | Mitigation only - never run the dev server on a shared network; serve the built bundle through Frigate's own port 8971 |
| NVIDIA Linux display driver | The documentation's minimum driver version 545 corresponds to a driver branch that reached end of life on 2024-10-01 (endoflife.date cycle r545-linux, checked this run), so a host installed to that floor receives no further driver security updates. | posture | Mitigation only - treat '>= 545' as a floor and install a currently supported NVIDIA driver branch instead of 545 itself |
| py3nvml | py3nvml is installed straight from a GitHub master branch with no tag or commit hash, so the code pulled into the image is whatever that repository held on build day. | posture | Mitigation only - pin the dependency to a commit or tag before building |
| tflite_runtime | The TFLite runtime wheels are downloaded as prebuilt binaries from third-party GitHub release URLs (one from a personal fork, feranick/TFlite-builds) with no checksum in the manifest, so the image trusts a binary nobody in the toolchain verifies. | posture | Mitigation only - verify the wheel checksum against the release, or build the runtime from source |
What this means for your lab
Frigate is a video recorder that is meant to sit on its own network segment, and this check found two things an instructor should act on before plugging it into a campus LAN. First, Frigate deliberately offers two web ports: 8971 asks for a login, and 5000 does not - and on port 5000 every request is treated as an administrator. Anyone who can reach port 5000 can watch the live cameras, browse and delete recordings, and change the configuration without any password at all, so that port must stay on the machine's internal Docker network or be blocked at the firewall. Second, the administrator password is generated when Frigate first starts and printed into the container log, so change it in Settings > Users on day one and treat those logs as sensitive. Beyond that, the software check found known vulnerabilities in a number of libraries the project ships. The ones that matter for a machine on a network are in the web interface and the API: the UI's HTTP client (axios) and its file-upload parser (python-multipart) both have serious published issues, and about half of the remaining findings are in frontend build tools that never run inside a deployed Frigate container. Most of the web UI's libraries can be brought up to date by refreshing the frontend lockfile; the backend upload parser cannot, because Frigate pins it to an old version, so that one has to wait for upstream. What this check cannot tell you is how the cameras themselves are configured - their passwords, their firmware and whether they reach the internet were not examined, and Frigate's own backend library versions are declared as ranges rather than fixed versions, so 64 of 67 of them have no checkable security state at all. The practical advice: put the recorder and its cameras on an isolated VLAN with no route to the internet, expose only port 8971 and only to the classroom, change the admin password immediately, and talk to campus IT before connecting any of it to the main network.
Not checked
- Frigate backend Python dependencies (64 of 67 rows): Range constraints (==X.Y.*) name no exact version, so OSV has nothing to match; includes aiohttp, cryptography, fastapi, starlette, uvicorn, requests, numpy, tensorflow and openvino.
- py3nvml: Installed from an unpinned git master clone with no commit or tag - no version exists to look up.
- tflite_runtime 2.17.1: Distributed as prebuilt wheels from third-party GitHub releases rather than a registry release, so no OSV package matches.
- Coral PCIe gasket driver (jnicolson/gasket-builder): Out-of-tree Linux kernel driver build script - no version and no advisory database for it.
- Apple Silicon detector ZMQ proxy (frigate-nvr/apple-silicon-detector): Unversioned external proxy repository - nothing to look up.
- NVIDIA JetPack 6 and nvidia-container-runtime: No endoflife.date product matches either, and neither has a vulnerability database.
- NVIDIA Linux display driver 545: Support status could not be bound automatically: endoflife.date names the branch 'r545-linux' rather than '545'. The branch itself was looked up separately and is end of life (see findings).
- Frigate application code itself: No release version is recorded in the lab materials, so the application's own advisories could not be checked.
- 380 further dependencies in package-lock.json: beyond the 500-dependency automatic check cap (e.g. @inquirer/number, @inquirer/password, @inquirer/prompts, @inquirer/rawlist, @inquirer/search)
- nvidia-driver 545: support status: version matches no release cycle on endoflife.date
Parts
Host Compute Platforms
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Beelink EQ13 Mini PC | Intel N100, dual GbE, mini-PC, 12 V DC | hard to obtain (exact model not listed) | — | — | Google Shopping returned no EQ13 N100; nearest Beelink hits were EQi13 $499.00, EQ14 $375.00 (blacklisted upstream), Mini S13 $459.00 |
| Beelink i3-1220P Mini PC | Core i3-1220P, 19 V DC, QuickSync | not checked | — | — | — |
| MINISFORUM Pro 125H Barebone | Core Ultra 5 125H + Intel AI Boost NPU, dual 2.5 GbE, 19 V DC | readily available (family) | — | $863.00 barebone-family listing; $367.00 as 32 GB/1 TB | minisforum.com; Newegg — Minisforum Official |
| Raspberry Pi 5 8 GB (SC1112) | BCM2712, 85 × 56 mm, 5.1 V / 5 A USB-C PD | readily available | 17,324 | $175.00 | DigiKey (order code SC1432, "SBC 2.4GHZ 4 CORE 8GB PI 5", Active) |
| Nvidia Jetson Developer Kit | Orin Nano / Orin NX / Xavier NX / AGX Orin, 9–20 V DC | not checked | — | — | — |
| Rockchip RK3588 SBC (Radxa ROCK 5B) | 4× A76 + 4× A55, 6 TOPS NPU, 2.5 GbE, 5–12 V USB-C PD | available through approved partners; price not checked | — | — | radxa.com product page — live, NPU "up to 6 TOPS", partners only |
| Synaptics SL1680 Astra Machina | Proprietary dev board, 12 V DC | actively distributed; price not checked | — | — | synaptics.com Astra Machina Foundation Series — current kit with a distributor path; SL1680 SKU/price not confirmed |
| AXERA AX650N / AX8850N | PCIe add-in accelerator or SoM, 12 V DC | not checked | — | — | — |
Dedicated Hardware AI Accelerators
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Hailo-8 M.2 Module (HM218B1C2GA) | M.2 2280/2242, M or A+E key, 26 TOPS, 3.3 V | hard to obtain (order code unstocked) | 0 | — | DigiKey: 0 products. ECIA: "No ECIA-authorized distributor lists this exact part number." Product itself current per hailo.ai |
| Hailo-8L / Raspberry Pi AI Kit | Hailo-8L 13 TOPS on M.2 HAT+, Pi 5 | superseded in the reseller channel | — | — | PiShop AI Kit URL now serves the "Raspberry Pi AI HAT+ 13 TOPS" page (SC1785 / SC1430) |
| Google Coral USB Accelerator (G950-06809-01) | USB 3.0 Type-C dongle, 65 × 30 × 8 mm, 5 V / 900 mA | available but overpriced; no authorized stock | 0 authorized | $111.00 retail (band $107–$120) | Seeed Studio via Google Shopping. Authorized: Arrow only — stock 0, "Factory Lead Time: 22 Weeks", $80.45 at a 1,584-piece break |
| Google Coral M.2 Accelerator A+E key (G650-04527-01) | M.2 2230 A+E key, 3.3 V, gasket driver required | hard to obtain | 0 | $29.63 (Arrow, out of stock) | ECIA/TrustedParts: Arrow only, "Out of stock", 0 distributors with stock |
| MemryX MX3 M.2 Module | M.2 2280 M-key, 4× MX3, up to 24 TFLOPS, PCIe Gen 3 ×2/×4 | product live; price and stock not checked | — | — | memryx.com/products — 2280 M-key and PCIe Gen 3 match the requirement; "Engineering Samples now available" |
| Intel Arc Discrete GPU (A310 representative) | PCIe 4.0 low-profile, 4 GB GDDR6, 12 V slot power | readily available | — | $144.99 (band $144.99–$307.99) | ASRock Arc A310 Low Profile 4 GB, Techinn.com via Google Shopping |
| Nvidia GPU, CUDA CC ≥ 5.0 (RTX 3050 8 GB representative) | PCIe add-in board, 12 V slot + aux power | readily available | — | $189.99 (8 GB band $189.99–$364.99) | PNY RTX 3050 8 GB XLR8, eBay via Google Shopping. The MSI "Gaming X 6G" at $279.99 is a 6 GB card — not this part |
| AMD Radeon Discrete GPU (RX 9060 XT 16G / 780M / 8700G) | PCIe add-in card or AM5 APU, 12 V | not checked | — | — | — |
IP Surveillance Cameras
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Loryta / Dahua IPC-T549M-ALED-S3 | 4 MP 1/1.8" full-colour warm-LED turret, 802.3af PoE or 12 V, < 8.5 W | readily available | — | $199.99 | EmpireTech via Google Shopping — exact model match including the -S3 suffix |
| Loryta / Dahua IPC-T54IR-AS | 4 MP 1/1.8" Starlight+ IR fixed-focal turret, PoE 36–57 V or 12 V, < 7.5 W | hard to obtain (exact SKU); -S3 revision available | — | $1,879.91 per 10-camera kit (about $188.00 each) | EmpireTech IPC-T54IR-AS-S3 bulk kit via Google Shopping; no single-unit listing found |
| Amcrest IP5M-T1179EW-AI-V3 | 5 MP weatherproof turret, 802.3af PoE or 12 V, ≤ 6 W, microSD | model family readily available; exact V3 SKU not confirmed | — | $119.83 (family band $79.99–$150.00) | Newegg — ElectroVille via Google Shopping. No listing title carried the IP5M-T1179EW-AI-V3 order code |
| Hikvision DS-2CD2387G2P-LSU/SL | 8 MP dual-lens 180° panoramic ColorVu turret, PoE 802.3at/af or 12 V, ≤ 10.5 W | hard to obtain — no route found | 0 | — | DigiKey 0 products; ECIA: no authorized distributor lists it; Google Shopping returned zero results for the exact model |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| Raspberry Pi AI Kit (Hailo-8L) | Raspberry Pi AI HAT+ 13 TOPS, SC1785 — $70.00, 699 in stock | Same Hailo-8L accelerator at the same 13 TOPS; same Raspberry Pi 5 host requirement; host link is PCIe Gen 3 versus the AI Kit's PCIe 2.0 — exceeds the original, acceptable. Same 3.3 V / 5 V HAT power envelope, no new supply rail. The accelerator is integrated onto the HAT, so an existing M.2 2242 module cannot be reused. | Verified: same Hailo-8L accelerator and same Pi 5 PCIe-HAT attachment (fetched Pi Hut product pages); lifecycle Active, stock 699 and price $70.00 (DigiKey exact match on SC1785). Not verified: mechanical drop-in equivalence with an installed AI Kit — board dimensions and standoff positions were not retrieved; not verified: whether Frigate's Hailo detector configuration is unchanged between the two boards. | Acceptable, and the preferred buy |
| Hailo-8 M.2 Module (HM218B1C2GA) | Raspberry Pi AI HAT+ 26 TOPS, SC1791 — $110.00, 700 in stock | Same Hailo-8 silicon at the same 26 TOPS. Hard stop on form factor: the BOM line needs an M.2 2280/2242 M-key or A+E-key card in a host M.2 slot at 3.3 V; the AI HAT+ is a Raspberry Pi 5 HAT and fits no M.2 slot. | Verified: Hailo-8 silicon and 26 TOPS rating (fetched Pi Hut AI HAT+ page); SKU identity SC1791 (fetched PiShop page); lifecycle Active, stock 700, price $110.00 (DigiKey exact match). Not verified: nothing about M.2 mechanical or electrical compatibility — the form factors differ by design. | Acceptable on a Raspberry Pi 5 host only; not acceptable as an M.2 card substitute |
| Google Coral USB Accelerator | Raspberry Pi AI HAT+ 13 TOPS — $70.00, the host's own Intel iGPU/NPU under OpenVINO, Intel Arc A310 — $144.99, or an RTX 3050 8 GB — $189.99 | The Coral is a 5.0 V / 900 mA USB 3.0 dongle; every alternative is a PCIe device (Pi 5 HAT or 12 V add-in card). Interface and supply rail both differ, and no adapter bridges that. What makes the swap sound is that the snapshot treats the accelerator as a per-host design choice, states that Hailo-8 "replaces Google Coral TPU", and calls Coral deprecated for new deployments. | Verified: lifecycle, stock and price of SC1785 (DigiKey exact match); retail availability and price bands of the Arc A310 and 8 GB RTX 3050 (Google Shopping, this run); the snapshot's own statement that Hailo-8 replaces Coral. Not verified: that detection accuracy or frame rate is preserved across detectors — nothing in this run measures that; not verified as any footprint or interface match, which it explicitly is not. | Acceptable as a design-level substitution, per the snapshot's own guidance |
| Beelink EQ13 Mini PC | Any dual-NIC x86-64 Intel N100/N150 mini PC except the EQ14 — candidates seen this run: Beelink Mini S13 (N150, dual 2.5 GbE) $459.00, Beelink Mini S12 Pro (N100) $773.99, MINISFORUM M1 Pro 125H 32 GB/1 TB $367.00 | The snapshot grants high latitude: any x86-64 Intel host with AVX and AVX2, at least dual GbE for camera-LAN isolation, and Debian compatibility. The EQ14 is excluded because the snapshot records it as blacklisted in Frigate's documentation. | Verified: nothing beyond listed price and seller from the shopping results, plus the dual-2.5 GbE claim in the Mini S13's own listing title. Not verified: AVX/AVX2 support, NIC count and Debian compatibility for every candidate — no product page was fetched. | Plausible, unverified — check the CPU's AVX2 support and the port count on the vendor's spec page before ordering |
| Loryta / Dahua IPC-T54IR-AS | Loryta / EmpireTech IPC-T54IR-AS-S3 — $1,879.91 per 10-camera kit, about $188.00 each | Same model line and the same fixed-focal 4 MP IR turret role; -S3 is a later hardware revision. Only available as a 10-unit order, which is impractical at classroom scale. | Verified: model-line and revision naming from the listing title; price and seller from the shopping result. Not verified: what the -S3 suffix encodes, and none of the line's requirements (H.264, AAC audio, multiple RTSP substreams, 1/1.8" sensor, 802.3af PoE, under 7.5 W) were confirmed against a datasheet or product page for the -S3 revision. | Plausible, unverified — the lower-risk path is the IPC-T549M-ALED-S3 at $199.99, an exact model match sold singly |
Verify any substitute against its datasheet and the lab's own constraints before ordering.
Other dependencies
- Fabrication: none required. The snapshot records no PCB CAD, Gerber, schematic or drill files — the build is plug-and-play COTS assembly. Mounting hardware is standard M.2 standoffs, M2 × 3 mm screws and Cat5e/Cat6 RJ45 patch cabling: commodity, not checked individually.
- PoE network switch — implied by the snapshot's 802.3af/at camera powering and its dual-NIC isolated-camera-LAN recommendation, but it is not a BOM line and carries no sourcing plan. Not checked.
- docs.frigate.video (project documentation portal) — not checked as a live site this run.
- hosted.weblate.org/projects/frigate-nvr (localization portal) — not checked.
- GitHub download URLs the lab depends on (the TFLite wheel releases at frigate-nvr/TFlite-builds and feranick/TFlite-builds, the py3nvml repository, jnicolson/gasket-builder, frigate-nvr/apple-silicon-detector, blakeblackshear/frigate-hass-integration) — reachable: the project's own manifests and documentation were fetched successfully from GitHub this run. What those URLs serve is software and is judged in the Cybersecurity section above.
Watch list
- Google Coral USB and M.2 — the authorized channel is already empty (Arrow: 0 stock, 22-week lead time). If the reseller band climbs above about $150 or the lead time grows, these lines should be reported as not implementable as specified and Coral should stop being presented as an option.
- Raspberry Pi AI HAT+ (SC1785 / SC1791) — currently the entire accelerator story for Raspberry Pi 5 hosts and single-sourced through Raspberry Pi. Watch stock, which stands at 699 and 700 today, and lifecycle status.
- Hikvision DS-2CD2387G2P-LSU/SL — an empty Google Shopping result set for a named camera model usually means the channel has withdrawn it. Re-check; if it is still empty next time, propose a specific non-Hikvision panoramic substitute rather than leaving the line open.
- Raspberry Pi 5 8 GB at $175.00 — two independent sources agree today, but one ECIA line (RS, $422.62, 0 stock) shows the channel is not uniform. Worth tracking as a price series.
- Beelink EQ13 / EQ14 — if the EQ13 disappears from retail entirely, the snapshot's primary-host recommendation needs rewriting, because its successor model is the one Frigate blacklists.
- Bare Hailo-8 M.2 modules — if any authorized distributor picks up HM218B1C2GA or an equivalent M-key card, that closes the only real accelerator gap for x86 hosts.
- The four unpriced lines (Nvidia Jetson kit, AMD Radeon, Beelink i3-1220P, RK3588 board) — the next check should spend its shopping budget here so the baseline is complete.