Hello, I’m wondering what the consensus is (if there is one) on the best hardware and software (open source very much preferred, runs in Docker is a must) to use for privacy-respecting, self-hosted security cameras. I have always wanted to avoid feeding the surveillance state and have never had a security camera but unfortunately I recently saw evidence of someone trying to break into my home. I searched Lemmy for posts on this topic and only found one from two years ago: https://lemmy.world/post/12726787. I assume things are a bit different now so I’m basically making the same post again as OP. Thanks in advance for any tips anyone may have for me.
PS. My experience level is that I currently run several self-hosted solutions via Docker and have been doing so for a few years. I am not a networking guru but I do understand the basics, and I’ve setup pihole in the past (but deactivated it due to some false-positive issues). If there’s a reason to stand that back up in order to prevent otherwise private cameras from “phoning home”, I can do that.
A while back, I needed a camera on short notice, but I didn’t have a server or any real hard drive space to speak of, so I just used “motion” on a 20 year old laptop, using the built-in webcam. It only saves video when motion is detected. I set it up to send me a Signal message with the video any time motion was detected, using signal-cli from the AUR. I know nothing about docker, but I thought it was super easy for my purposes.
YOU SHOULD NOT RUN YOUR CAMERA SERVER ON YOUR DOCKERPILE HOMELAB BOX THATS HOSTING 69 DIFFERENT THINGS!
If you have the time to set it up, learn the different use cases of cameras and monitor it for failure somehow then frigate is good.
If you’re using ip cameras you 100% no foolin without question have to put them on a vlan at the very least. They are an insane liability when it comes to network security.
If I had it all to do over again I’d have done power over ethernet, put them all on their own switch that does poe injection and done vlan by the one phy going from the poe switch to the router.
People will fight me about this, but ip cameras are all pretty much the same. They make available some video stream at a preset bitrate and resolution, use built in infrared or visible lighting and offer pan, tilt and zoom (ptz) controls to authorized users. Some have motion detection and object recognition on device which may or may not be surfaced to the camera server.
I always offload object detection and classification to the server even if the camera has it on board because even on cpu image inference is “okay” and with an old gt750 nvidia card you can do much faster object detection and classification. The reason for doing it all on server is in order to get consistent results.
If you are a computer savvy person: congratulations, you picked a project that uses memory, gpu and disk space at a time when they’re all at a premium! Hell yeah!
YOU SHOULD NOT RUN YOUR CAMERA SERVER ON YOUR DOCKERPILE HOMELAB BOX THATS HOSTING 69 DIFFERENT THINGS!
Fortunately you don’t need ddr5 for this so any old server is fine. Scale your ram needs up or down depending on the cameras you’re looking for.
Consider buying one of those ten year old servers with redundant power supplies. Even if they’re both connected to the same ups (and you need the camera server on it’s own ups) you can keep going when one dies.
There are two minds regarding disks in surveillance servers. The first is “fuck it, kill the disks, who cares, they’re a wear part!” The second is “no, careful management of our disks will ensure trouble free use for years to come.” I’m of the second variety and run a zpool of small (<2tb) disks with an optane cache. The cache saves the disks from some of the drive killing random writes and reads and lets me keep running at speed when reviewing things.
When you go to put in an old gpu, make sure the plastic cowling shaped like an anime titty isn’t too big otherwise the pcie standard sized spaces in most servers won’t be able to take it.
YOU SHOULD NOT RUN YOUR CAMERA SERVER ON YOUR DOCKERPILE HOMELAB BOX THATS HOSTING 69 DIFFERENT THINGS!
I have been robbed and had to hand camera data over to the cops and can offer you some more practical advice if you’re open to it.
It’a not just GPU, memory and disk. It will clobber your network if they share any cables.
Cameras are extremely chatty and will bring your LAN speeds to a crawl by constantly chirping small packets across the wire.
Absolutely do not ever put a 24x7 camera stream on WiFi. It’s a straight up DoS attack on yourself.
My main cameras are PoE but I have a couple WiFi cameras that are 24/7 and I’ve never had issues with my network slowing to a crawl.
plastic cowling shaped like an anime titty
Lmao
Also thanks for the detailed write up. I’m interested in your mention of Optane, is that usable in Linux? I was under the impression all those optane drives on eBay would have limited functionality
Yes. It all works by default. The ones you want to use for a cache device are m10, they come in 16, 32 and 64gb sizes.
Ah okay so those are basically in between storage and RAM. I was thinking of the models which combine SSD plus the extra Optane cache, those I’ve read require at least 8th gen Intel chips and probably more I don’t know of
Firstly, thank you for all this advice.
I think you are a couple paygrades above me when it comes to networking knowledge though. Can you say more about why cameras in particular are specifically such a liability? Is it because they are a hackable thing which is observable from public space?
They use networking software that’s optimized for speed and low resource use (you’d rather be spending those arm/esp cycles handling video, right?) with a slow patch cycle and little chance the user (you!) will actually get up on a ladder and install the damn patches.
Some of them will dial out and try to get their patches, but did it work? Are they still running right after the patch? You don’t know that because you don’t even know they got a patch notification, dialed out, downloaded and installed it, silently changed a default or removed a resolution you relied on and aren’t sending video anymore! Do you even want them doing that?
Even if they weren’t doing all that, there are hundreds of vulnerabilities that allow a user on the local network to silently bypass auth and view them, change settings etc.
The above isn’t because they’re crappy (they are crappy.) but because they’re using some weird .005$ cheaper esp32 variant that needs a modified binary which isnt on anyone’s radar and had support dropped 2 years ago.
I have even run into modern ip cameras that would try to proxy their feed on a public facing ip that used to be owned by the (now defunct) manufacturer but is now some weirdo just slurping up what gets sent to them.
The simple solution is to put them on a derek zoolander vlan for network devices that can’t network good, cut em off from the outside world and check for updates manually.
Peanut gallery here but I have a couple questions about IP cameras and what the recommended setup exactly looks like. If you or someone else could answer them it would be greatly appreciated.
-
You were saying in your first comment that you would recommend getting one of the infamous 10 year old servers with redundant power supplies specifically for this. On said server:
a. How much RAM would you recommend to start? Most of those servers still use DDR3/4 so it shouldn’t be too god awfully expensive.
b. What OS setup would you recommend? Ubuntu Server/CLI Debian, or something like adding the server to a Proxmox cluster and running a resource-heavy VM with GPU and HDD pass through?
-
As far as the client end of the monitoring stack, would you recommend a Raspberry Pi with a cheap-ish monitor that acts as a dedicated client for this, or an open port or firewall rule which allows a web client to be accessible via the rest of your LAN?
the reason I didnt address anything you asked earlier is because I don’t think people generally need this crap and it’s probably a mistake for me to have explained how a person can make semi decent decisions about rolling their own.
Ram doesn’t matter. You can buy more, yes even when it’s expensive. The reason it doesn’t matter if that your needs will vary wildly based on your workload. I don’t know your workload so I can’t recommend an amount of ram. Maybe start with 16gb for a few cameras and a zpool based storage.
You want an old server because consumer hardware has no pcie lanes and is in general designed around a short duty cycle which is how you get such great “efficiency” numbers out of consumer equipment compared to a computer designed to reliably run 24/7. Of course your computer isn’t using any electricity, it’s not fucking doing anything.
The os doesn’t actually matter. Just use whatever you can keep running reliably. If you need to ask what you can keep running reliably then buy an off the shelf solution.
Don’t use proxmox or some hypervisor. The whole point isn’t to have a cool hackerman surveillance room with a bunch of screens like in the movies, it’s to have a reliable record of what your cameras captured. Fewer things to fail is better.
If you need to ask if a raspberry pi is appropriate then a raspberry pi is not appropriate. That’s true in all situations but here’s why it’s true here: you would only use a sbc for this application because you either don’t have anything else or you’re worried about energy consumption. If you don’t have anything else then it doesn’t matter if it’s a smart choice and if you’re worried about energy consumption then you’re not factoring in the energy cost of maintaining a place for a human being to exist and look at the screens attached to the pi or you havent considered simply turning off the terminal when it’s not in use.
Don’t do an ip camera based security system as a learning experience. What you will learn is that it was a big waste of time and isn’t practical.
I would recommend you think critically about what you’re trying to accomplish first and foremost then implement the simplest system that has the fewest points of failure.
-
I see, I think. When it comes to the updates you’re mentioning, is that primarily the firmware on the devices that is of concern? Whatever software solution I’d go with, I’d stay pretty on top of updating it because that’s something I’ve learned is pretty important.
Apologies for the account change, credential rolling schedule waits for no man.
Yes, it’s device firmware.
Again, if you would like a more practical approach based on the experience of being robbed I will gladly volunteer it.
To add to what others have said, I run Frigate on docker container inside an LXC on a separate Proxmox server. The cameras and server are isolated from the rest of the network through a VLAN that has internet access blocked.
Frigate might be right for you. They have recommended cameras in their documentation.
Just remember to block internet access to any camera you get.
Can be integrated with Home Assistant. Local object detection. Many other features. They have a supported hardware list too in their docs.
I also believe Frigate actually has a home assistant “app” version so it can be installed right on the same device.
Thingino firmware on a cheap camera alleviated any concerns I had about the camera bypassing my DNS and phoning home. There are a list of compatible cameras on the Thingino website, and I got some help with installing the firmware on the Thingino discord. Integrates well with Frigate, and others such as TinyNVR.
Super simple to setup with docker. Works with any camera that broadcasts rtsp streams.
I have it running with 3 Sonoff cams and it works great, and sends alerts through NTFY for self-hosted notifications.
