ha: add Frigate NVR as a Podman Quadlet, wire into deploy.sh

Same sibling-container pattern as HA/ESPHome. The hand-written unit used
Privileged=true, which isn't a real Quadlet key — the generator silently
drops the whole file on an unsupported key, so frigate.service was never
generated (hence `systemctl enable frigate` saying the unit doesn't exist).
Fixed with PodmanArgs=--privileged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy.sh

@@ -214,6 +214,9 @@ install -d -m0755 /srv/homeassistant
 # Supervisor/add-on store here).
 install -D -m0644 ha/esphome.container /etc/containers/systemd/esphome.container
 install -d -m0755 /srv/esphome
+# Frigate NVR (sibling container, same rationale as HA/ESPHome above).
+install -D -m0644 ha/frigate.container /etc/containers/systemd/frigate.container
+install -d -m0755 /srv/frigate/config /srv/frigate/storage
 
 echo "== hardware watchdog =="
 install -D -m0644 power/10-vanlink-watchdog.conf /etc/systemd/system.conf.d/10-vanlink-watchdog.conf
@@ -238,6 +241,7 @@ systemctl enable regdomain.service hostapd hostapd-2g van-ap-dnsmasq nftables sy
 systemctl enable --now bluetooth >/dev/null 2>&1 || true
 systemctl start homeassistant || warn "homeassistant failed to start (podman/quadlet — check journalctl -u homeassistant)"
 systemctl start esphome || warn "esphome failed to start (podman/quadlet — check journalctl -u esphome)"
+systemctl start frigate || warn "frigate failed to start (podman/quadlet — check journalctl -u frigate)"
 systemctl restart van-thermal
 systemctl restart van-nvme-watch
 systemctl restart van-gps-owntracks

ha/frigate.container

@@ -0,0 +1,43 @@
+# Frigate NVR as a Podman Quadlet, same pattern as homeassistant.container /
+# esphome.container. Installed by deploy.sh to /etc/containers/systemd/;
+# systemd generates frigate.service from it. Note: "Privileged=true" is NOT a
+# real Quadlet key — the generator silently skips the whole file if you use
+# it (no frigate.service is generated at all, so `systemctl enable frigate`
+# fails with "Unit frigate.service does not exist"). Use PodmanArgs=--privileged.
+#
+# Host networking: dashboard/API bind :5000, go2rtc webrtc on :8971.
+# Config (/srv/frigate/config/config.yml) and recordings (/srv/frigate/storage)
+# are host state, not shipped by deploy.sh — same as /srv/homeassistant.
+[Unit]
+Description=Frigate NVR (Podman container)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image=ghcr.io/blakeblackshear/frigate:stable
+ContainerName=frigate
+Network=host
+Volume=/srv/frigate/config:/config
+Volume=/srv/frigate/storage:/media/frigate
+Volume=/etc/localtime:/etc/localtime:ro
+Environment=TZ=America/Toronto
+
+PublishPort=5000:5000
+PublishPort=8971:8971
+
+# FFmpeg video buffers need more than the 64m Podman default.
+ShmSize=64m
+
+# Privileged (not just AddCapability) for full /dev access to camera/GPU
+# devices without hand-enumerating every /dev/videoN node.
+PodmanArgs=--privileged
+GroupAdd=keep-groups
+AddCapability=CAP_PERFMON
+
+[Service]
+Restart=always
+# First start pulls the image; allow for a slow uplink.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target