winget install --id=martona.gig -e gig is a small, native Windows client for Frigate NVR. It discovers every camera from the Frigate API and renders them all in a live Direct3D 11 grid with click-to-zoom. It terminates TLS itself and feeds FFmpeg the decrypted stream, hardware-decoding via D3D11VA when available and falling back to software decode otherwise. Live view only.
gig /ɡɪɡ/ noun
Native C++ streaming client for Frigate: it discovers every camera from the Frigate API and renders them all in a live Direct3D 11 grid, with click-to-zoom. Live view only.
The native pipeline:
/api/config (Boost.Beast over the app's own TLS stack) and maps each camera to its go2rtc stream.ts URL. A shared TLS session cache resumes handshakes across all connections, and a shared cookie jar carries the Frigate auth token everywhere once login succeeds.The Windows build script uses vcpkg manifest mode, CMake, Ninja, and the static triplet by default. It creates an isolated private vcpkg checkout under build\vcpkg, installs packages under build\vcpkg-installed, and keeps the vcpkg binary cache/downloads under build. FFmpeg is built from a trimmed overlay port (vcpkg-ports/ffmpeg) that compiles only the surface gig uses — h264/hevc decoders + parsers, the mpegts demuxer, and the D3D11VA hwaccels — which roughly halves the exe.
.\scripts\build_windows.ps1
To configure without compiling:
.\scripts\build_windows.ps1 -ConfigureOnly
Useful overrides:
.\scripts\build_windows.ps1 -BuildType RelWithDebInfo
The app is GUI-only — there are no command-line options or subcommands. (it also opens on F2); fill in your Frigate URL and credentials and the grid comes up. Settings are stored in the Windows registry under (the password is DPAPI-encrypted); you can also seed them by script — a minimal config for a Frigate with authentication enabled:
HKCU\Software\gigNew-Item -Path 'HKCU:\Software\gig' -Force | Out-Null
Set-ItemProperty 'HKCU:\Software\gig' -Name base -Value 'https://frigate.example:8971/'
Set-ItemProperty 'HKCU:\Software\gig' -Name user -Value 'viewer'
# password is DPAPI-wrapped (CurrentUser) and stored as REG_BINARY:
Add-Type -AssemblyName System.Security
$blob = [Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes('secret'), $null, 'CurrentUser')
Set-ItemProperty 'HKCU:\Software\gig' -Name password -Value $blob -Type Binary
Launch gig.exe. A slim toolbar across the top shows the app name and live status (cameras up, frame rate, bandwidth, CPU) with gear / refresh / list icon buttons for Settings, Reconnect, and Log (hover for tooltips). The toolbar sits above the grid — cameras render in the area below it, undisturbed — and in single-camera zoom view it auto-hides so the image goes full-screen until you move the mouse. Each camera tile is labeled — click one to zoom it to fill the window, click again (or press Esc) to return to the grid. Settings (or F2) opens a settings dialog; Reconnect (or F5) re-logs-in, re-discovers, and rebuilds without restarting; Log toggles a full-window log view (Esc or the ✕ closes it). Esc in the grid quits. On first run (or unusable config) the settings dialog opens automatically.
Two independent layers; mix them as your setup requires:
user / password) — POSTs {base}/api/login at startup, then carries the returned frigate_token cookie on every API and video request, re-logging-in every login-refresh seconds (default 600) to keep the token fresh. This is the normal way to talk to Frigate's authenticated port directly.ca/cert/key set, server certificates are verified against the Windows certificate store, and a client certificate (from CurrentUser\MY, signed via CNG so the private key never leaves the store) is offered only if a server's TLS handshake actually requests one — the cert picker and consent prompt appear just then, once per run. Set ca (and cert/key for client auth) to use PEM files instead, e.g. behind a client-cert-checking reverse proxy.Server certificates are also checked against the requested hostname, and a certificate pin (trust-on-first-use) is offered if a server's cert can't be verified the normal way: a dialog shows the certificate details and its SPKI-SHA256 fingerprint, and pinning it (stored per host under pins/ in the registry) trusts that exact certificate thereafter. If a pinned certificate later changes, a louder warning distinguishes a normal renewal from possible interception. insecure disables verification and pinning entirely.
base, user, password (encrypted), login-refresh (REG_QWORD); ca, cert, key, url (single-stream mode without discovery), stream-url (override the discovered stream URL template) — all REG_SZ; software (force software decode; decode already auto-falls-back when no hardware path is usable), overlay (diagnostics tile on/off), insecure (skip server-cert verification, testing only) — REG_DWORD 0/1; poll-interval (health poll seconds), rw-timeout-us (per-connection I/O timeout) — REG_QWORD.
Set up Guided Access if the device is meant to display a permanent video wall:
The result: The device is now locked into Gig. Swiping up doesn't work, the control center is disabled, and notifications are hidden. The only way to exit back to the home screen (or access any other data) is to triple-click the hardware button and enter the Guided Access PIN.
Issues and PRs welcome.
This is a personal, non-commercial project. Copyright (C) 2026 Marton Anka