SpongederpSquarefap

joined 1 year ago
[–] SpongederpSquarefap@alien.top 1 points 11 months ago

This is exactly it - storage is the best example

Could I run all of my stuff using a cloud service? Of course, but it would be very expensive and only available if my internet works (and there's a lot of hops between me and my data in the cloud)

I can buy a 2TB HDD for £64 - most cloud providers charge that much per year for 1TB

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

Proxmox because it's just Debian with a pretty UI for QEMU

I'm liking it a lot more than ESXi - it's just better honestly

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

Yep, monitoring in multiple places with Zabbix

I have pfSense as well (soon to be OPNsense) and that shows traffic per network it's connected to, so that's great for live traffic

Zabbix monitors the networks and collects traffic data

Zabbix also monitors all containers and their network traffic

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

Don't try to be clever and change the port from 3389 to something else either

Scanners can fingerprint traffic and just blast the other ports instead

I (foolishly) did this a few years ago and luckily I had account lockout enabled

Constant attempts all day long - they were even able to enumerate local users and try to log in as them (fortunately they never could cause the passwords were random keepass ones)

Don't do it, seriously

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

I've recently just been through the Google Keep "divorce"

Why? Because they fucked up the Android app and it didn't show any of my reminders for 3 weeks

I've since moved all my reminders to Google Calendar (which is where they should have been from the start to be honest)

All my notes were exported from Google Takeout and I moved the ones I actually needed to Obsidian

I've been using that with Syncthing for the past few weeks and it's just so much better

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

Oh wow that's a hell of an improvement

It's been about 4 years since I last used it so I'm happy to see they're still actively improving it

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

Log tail with Zabbix trigger could work

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

Sure thing

Also I thought that frigate is only usable through home assistant, but that only means android app I guess.

Nope, Home Assistant is just a nice integration with it

The web UI is fast and responsive - even on mobile in Chrome

You can easily view object detections and recordings by day and hour through the web UI too

It's extremely well done

Anyway, I am actually in process of picking few cameras, likely going with tplink vigi, like C340 and see if it will play nicely.

Frigate have docs on recommended cameras

https://docs.frigate.video/frigate/hardware

Regardless of what cameras you choose, please ensure you VLAN and firewall them off - these cameras effectively run a Linux distro and should not be trusted or accessible

For example, my Reolink cameras can access NTP and DNS just so their clocks are correct

They can't access anything else on the network

The CCTV VM sits on the same network as the cameras and has host firewall rules to deny access from the cameras

Frigate just connects to each camera's stream and does its magic from there


version: "3.9"
services:
  frigate:
    container_name: frigate
    privileged: true # this may not be necessary for all setups
    restart: unless-stopped
    image: ghcr.io/blakeblackshear/frigate:stable
    shm_size: "512mb" # update for your cameras based on calculation above
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /opt/dockervolumes/frigate/config/config.yml:/config/config.yml
      - /mnt/cctv/frigate:/media/frigate
      - type: tmpfs # Optional: 1GB of memory, reduces SSD/SD Card wear
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "8554:8554"     # RTSP feeds
      - "8555:8555/tcp" # WebRTC over tcp
      - "8555:8555/udp" # WebRTC over udp
    environment:
      FRIGATE_C1_PASS: ${FRIGATE_C1_PASS}
      FRIGATE_C2_PASS: ${FRIGATE_C2_PASS}
      FRIGATE_C3_PASS: ${FRIGATE_C3_PASS}
      FRIGATE_C4_PASS: ${FRIGATE_C4_PASS}
    labels:
      - traefik.enable=true
      - traefik.http.routers.cctv.rule=Host(`cctv.${DOMAIN}`)
      - traefik.http.routers.cctv.entrypoints=websecure
      - traefik.http.routers.cctv.tls.certresolver=cloudflare
      - traefik.http.services.cctv.loadbalancer.server.port=5000
    networks:
      - proxy
networks:
  proxy:
    external: true
 

So I've been self-hosting my CCTV for about 3 years now and it's always been... not great

First I gave Blue Iris a try which meant I needed a full Windows VM to run it

And it worked - it did the job and recorded stuff and it was fairly OK at motion detection, but damn did it eat the CPU and draw a lot of electricity for no real reason

A few months later I gave Shinobi CCTV a try in Docker and that's what I've been running since

Again, it's mostly fine but the UI is a little clunky and my use case of "24/7 recording that I can easily watch back" was mostly being met, although I had 1 problem

By default Shinobi segments video into 15 minute chunks

So if someone smashes into my car at 14:45:01 then I can't watch that footage until 15:00

Obviously this is a big flaw, so to get around this I changed the segment size to 1 minute

But I have 4 cameras, so this means that over a day I'll now have 5760 clips per day

Sifting through those to find some footage is not fun

Enter Frigate - I'd tried it before but never really gave it a full chance

It's a bit to wrap your head around at first, but once it's up and running it's just a docker-compose.yml for the container and a simple frigate.yml config file

The docs are EXTENSIVE and answered almost every question I had

But there's 1 extra awesome feature I wasn't originally aware of: OpenVINO

OpenVINO is a deep learning model from Intel that apparently runs on my old Broadwell gen Xeon E5-2650v4 CPUs without issue

I've turned it on and enabled object detection and I gotta say, WOW, it's very good

I can go outside with the dog, walk around for a moment and come back in and it'll pick both of us up no problem

So this saved me about £100 seeing as I don't need a Coral compute module (OK I could still get one, but I'm happy for now)

And just to top all of this off, Frigate and Reolink cameras generally don't play too nicely together, yet with support from the docs, mine are working great

Looking at Zabbix, my CPU utilisation for my CCTV server was averaging 10% whilst using Shinobi

Now it's up to 50% but my UPS runtime hasn't really changed so I'm calling that a win

My config is below if it helps anyone trying to get this set up with Reolink cameras


# Disable MQTT because I'm not connecting this to Home Assistant
mqtt:
  enabled: false

# Enable 24/7 recording (mode: all means all clips, not just clips with objects in)
# Keep 30 days worth of footage (Frigate automatically deletes the oldest footage once space gets extremely low)
record:
  enabled: true
  retain:
    days: 30
    mode: all

# Set the birdseye view to always show a live stream of the cameras
birdseye:
  mode: continuous

# Detection area for cameras (all 4 of my Reolink RLC-410 cameras are 2560x1920)
detect:
  width: 2560
  height: 1920

# Objects to track from /labelmap.txt
objects:
  track:
    - person
    - bicycle
    - car
    - motorcycle
    - bird
    - cat
    - dog

# Copy and paste from docs to use default OpenVINO
# https://docs.frigate.video/configuration/detectors/#openvino-detector
detectors:
  ov:
    type: openvino
    device: AUTO
    model:
      path: /openvino-model/ssdlite_mobilenet_v2.xml

model:
  width: 300
  height: 300
  input_tensor: nhwc
  input_pixel_format: bgr
  labelmap_path: /openvino-model/coco_91cl_bkgr.txt

# Config for each camera
cameras:
  c1-side:
    ffmpeg:
      inputs:
        # Record HD stream
        - path: http://10.10.8.11/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin&password={FRIGATE_C1_PASS}
          input_args: preset-http-reolink
          roles:
            - record
        # Use low quality and low FPS stream for object detection
        - path: http://10.10.8.11/flv?port=1935&app=bcs&stream=channel0_sub.bcs&user=admin&password={FRIGATE_C1_PASS}
          input_args: preset-http-reolink
          roles:
            - detect
      # Record audio
      output_args:
        record: preset-record-generic-audio-copy

  c2-garden:
    ffmpeg:
      inputs:
        - path: http://10.10.8.12/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin&password={FRIGATE_C2_PASS}
          input_args: preset-http-reolink
          roles:
            - record
        - path: http://10.10.8.12/flv?port=1935&app=bcs&stream=channel0_sub.bcs&user=admin&password={FRIGATE_C2_PASS}
          input_args: preset-http-reolink
          roles:
            - detect
      output_args:
        record: preset-record-generic-audio-copy

  c3-garage:
    ffmpeg:
      inputs:
        - path: http://10.10.8.13/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin&password={FRIGATE_C3_PASS}
          input_args: preset-http-reolink
          roles:
            - record
        - path: http://10.10.8.13/flv?port=1935&app=bcs&stream=channel0_sub.bcs&user=admin&password={FRIGATE_C3_PASS}
          input_args: preset-http-reolink
          roles:
            - detect
      output_args:
        record: preset-record-generic-audio-copy

  c4-front:
    ffmpeg:
      inputs:
        - path: http://10.10.8.14/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin&password={FRIGATE_C4_PASS}
          input_args: preset-http-reolink
          roles:
            - record
        - path: http://10.10.8.14/flv?port=1935&app=bcs&stream=channel0_sub.bcs&user=admin&password={FRIGATE_C4_PASS}
          input_args: preset-http-reolink
          roles:
            - detect
      output_args:
        record: preset-record-generic-audio-copy
[–] SpongederpSquarefap@alien.top 1 points 11 months ago

For just yourself? Get a domain that you can actually remember and use and then set up a WireGuard server (I recommend the Linuxserver.io WireGuard image)

Use that to access your stuff

Do you have 1 thing you desparately need to be publicly accessible? VLAN the VM off so it's on its own and put a reverse proxy in front of it with HTTPS (and ideally MFA if you need auth)

[–] SpongederpSquarefap@alien.top 1 points 11 months ago (1 children)

Oh man where were you 6 hours ago hahaha

I was having a mare with the recording - I had it set to 0 days which I assumed meant "just fill the storage" but that's completely wrong

Seems to be working great so far, gonna trial it for a week then decom my Shinobi

[–] SpongederpSquarefap@alien.top 1 points 11 months ago

I've just set it up and it seems excellent so far

Just having trouble with the env vars - it's not accepting my custom vars for {C1_PASSWORD} for example

 

I'm currently using Shinobi CCTV for my 4 cameras, but the UI is just a bit clunky and the Docker image isn't actively updated

Frigate looks like a good potential replacement, but I don't currently have a Coral TPU so I won't be able to use object detection (too much of a CPU hit spikes the electricity bill)

Is anyone using it for just normal 24/7 recording without object detection?

If so, what's it like? Docs say it records 1 minute segments which is fine for me

[–] SpongederpSquarefap@alien.top 2 points 1 year ago (2 children)

Yep OP is right, but OP didn't mention the fucking disasterous WireGuard implementation they tried to pull off

God that was a mess

This is yet another reminder to tick off "switch to OPNsense" on my to do list

view more: next ›