this post was submitted on 29 Jul 2026
42 points (100.0% liked)

Privacy

50232 readers
137 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
42
Self-hosted security cameras (lemmy.world)
submitted 1 week ago* (last edited 1 week ago) by TrickDacy@lemmy.world to c/privacy@lemmy.ml
34 comments fedilink hide all child comments
 

Hello, I'm wondering what the consensus is (if there is one) on the best hardware and software (open source very much preferred, runs in Docker is a must) to use for privacy-respecting, self-hosted security cameras. I have always wanted to avoid feeding the surveillance state and have never had a security camera but unfortunately I recently saw evidence of someone trying to break into my home. I searched Lemmy for posts on this topic and only found one from two years ago: https://lemmy.world/post/12726787. I assume things are a bit different now so I'm basically making the same post again as OP. Thanks in advance for any tips anyone may have for me.

PS. My experience level is that I currently run several self-hosted solutions via Docker and have been doing so for a few years. I am not a networking guru but I do understand the basics, and I've setup pihole in the past (but deactivated it due to some false-positive issues). If there's a reason to stand that back up in order to prevent otherwise private cameras from "phoning home", I can do that.

top 34 comments
sorted by: hot top controversial new old
[–] whatiswrongwithyou@lemmy.ml 20 points 1 week ago (4 children)

YOU SHOULD NOT RUN YOUR CAMERA SERVER ON YOUR DOCKERPILE HOMELAB BOX THATS HOSTING 69 DIFFERENT THINGS!

If you have the time to set it up, learn the different use cases of cameras and monitor it for failure somehow then frigate is good.

If you’re using ip cameras you 100% no foolin without question have to put them on a vlan at the very least. They are an insane liability when it comes to network security.

If I had it all to do over again I’d have done power over ethernet, put them all on their own switch that does poe injection and done vlan by the one phy going from the poe switch to the router.

People will fight me about this, but ip cameras are all pretty much the same. They make available some video stream at a preset bitrate and resolution, use built in infrared or visible lighting and offer pan, tilt and zoom (ptz) controls to authorized users. Some have motion detection and object recognition on device which may or may not be surfaced to the camera server.

I always offload object detection and classification to the server even if the camera has it on board because even on cpu image inference is “okay” and with an old gt750 nvidia card you can do much faster object detection and classification. The reason for doing it all on server is in order to get consistent results.

If you are a computer savvy person: congratulations, you picked a project that uses memory, gpu and disk space at a time when they’re all at a premium! Hell yeah!

YOU SHOULD NOT RUN YOUR CAMERA SERVER ON YOUR DOCKERPILE HOMELAB BOX THATS HOSTING 69 DIFFERENT THINGS!

Fortunately you don’t need ddr5 for this so any old server is fine. Scale your ram needs up or down depending on the cameras you’re looking for.

Consider buying one of those ten year old servers with redundant power supplies. Even if they’re both connected to the same ups (and you need the camera server on it’s own ups) you can keep going when one dies.

There are two minds regarding disks in surveillance servers. The first is “fuck it, kill the disks, who cares, they’re a wear part!” The second is “no, careful management of our disks will ensure trouble free use for years to come.” I’m of the second variety and run a zpool of small (<2tb) disks with an optane cache. The cache saves the disks from some of the drive killing random writes and reads and lets me keep running at speed when reviewing things.

When you go to put in an old gpu, make sure the plastic cowling shaped like an anime titty isn’t too big otherwise the pcie standard sized spaces in most servers won’t be able to take it.

YOU SHOULD NOT RUN YOUR CAMERA SERVER ON YOUR DOCKERPILE HOMELAB BOX THATS HOSTING 69 DIFFERENT THINGS!

I have been robbed and had to hand camera data over to the cops and can offer you some more practical advice if you’re open to it.

[–] pHr34kY@lemmy.world 7 points 1 week ago* (last edited 1 week ago) (2 children)

It'a not just GPU, memory and disk. It will clobber your network if they share any cables.

Cameras are extremely chatty and will bring your LAN speeds to a crawl by constantly chirping small packets across the wire.

Absolutely do not ever put a 24x7 camera stream on WiFi. It's a straight up DoS attack on yourself.

[–] ScoobyDoo27@lemmy.world 7 points 1 week ago

My main cameras are PoE but I have a couple WiFi cameras that are 24/7 and I’ve never had issues with my network slowing to a crawl.

[–] Couldbealeotard@lemmy.world 4 points 1 week ago

Honestly it sounds like you've got a network fault. What you're describing is not normal.

[–] TrickDacy@lemmy.world 6 points 1 week ago (1 children)

Firstly, thank you for all this advice.

I think you are a couple paygrades above me when it comes to networking knowledge though. Can you say more about why cameras in particular are specifically such a liability? Is it because they are a hackable thing which is observable from public space?

[–] whatiswrongwithyou@lemmy.ml 10 points 1 week ago (2 children)

They use networking software that’s optimized for speed and low resource use (you’d rather be spending those arm/esp cycles handling video, right?) with a slow patch cycle and little chance the user (you!) will actually get up on a ladder and install the damn patches.

Some of them will dial out and try to get their patches, but did it work? Are they still running right after the patch? You don’t know that because you don’t even know they got a patch notification, dialed out, downloaded and installed it, silently changed a default or removed a resolution you relied on and aren’t sending video anymore! Do you even want them doing that?

Even if they weren’t doing all that, there are hundreds of vulnerabilities that allow a user on the local network to silently bypass auth and view them, change settings etc.

The above isn’t because they’re crappy (they are crappy.) but because they’re using some weird .005$ cheaper esp32 variant that needs a modified binary which isnt on anyone’s radar and had support dropped 2 years ago.

I have even run into modern ip cameras that would try to proxy their feed on a public facing ip that used to be owned by the (now defunct) manufacturer but is now some weirdo just slurping up what gets sent to them.

The simple solution is to put them on a derek zoolander vlan for network devices that can’t network good, cut em off from the outside world and check for updates manually.

[–] TrickDacy@lemmy.world 1 points 1 week ago (1 children)

I see, I think. When it comes to the updates you're mentioning, is that primarily the firmware on the devices that is of concern? Whatever software solution I'd go with, I'd stay pretty on top of updating it because that's something I've learned is pretty important.

[–] whoiswrongwithyou@lemmy.ml 1 points 1 week ago

Apologies for the account change, credential rolling schedule waits for no man.

Yes, it’s device firmware.

Again, if you would like a more practical approach based on the experience of being robbed I will gladly volunteer it.

[–] leftOverLife@lemmy.ml 1 points 1 week ago* (last edited 1 week ago) (2 children)

Peanut gallery here but I have a couple questions about IP cameras and what the recommended setup exactly looks like. If you or someone else could answer them it would be greatly appreciated.

  1. You were saying in your first comment that you would recommend getting one of the infamous 10 year old servers with redundant power supplies specifically for this. On said server:

    a. How much RAM would you recommend to start? Most of those servers still use DDR3/4 so it shouldn't be too god awfully expensive.

    b. What OS setup would you recommend? Ubuntu Server/CLI Debian, or something like adding the server to a Proxmox cluster and running a resource-heavy VM with GPU and HDD pass through?

  2. As far as the client end of the monitoring stack, would you recommend a Raspberry Pi with a cheap-ish monitor that acts as a dedicated client for this, or an open port or firewall rule which allows a web client to be accessible via the rest of your LAN?

[–] whoiswrongwithyou@lemmy.ml 3 points 1 week ago

I would recommend you think critically about what you’re trying to accomplish first and foremost then implement the simplest system that has the fewest points of failure.

[–] whoiswrongwithyou@lemmy.ml 1 points 1 week ago (1 children)

the reason I didnt address anything you asked earlier is because I don’t think people generally need this crap and it’s probably a mistake for me to have explained how a person can make semi decent decisions about rolling their own.

Ram doesn’t matter. You can buy more, yes even when it’s expensive. The reason it doesn’t matter if that your needs will vary wildly based on your workload. I don’t know your workload so I can’t recommend an amount of ram. Maybe start with 16gb for a few cameras and a zpool based storage.

You want an old server because consumer hardware has no pcie lanes and is in general designed around a short duty cycle which is how you get such great “efficiency” numbers out of consumer equipment compared to a computer designed to reliably run 24/7. Of course your computer isn’t using any electricity, it’s not fucking doing anything.

The os doesn’t actually matter. Just use whatever you can keep running reliably. If you need to ask what you can keep running reliably then buy an off the shelf solution.

Don’t use proxmox or some hypervisor. The whole point isn’t to have a cool hackerman surveillance room with a bunch of screens like in the movies, it’s to have a reliable record of what your cameras captured. Fewer things to fail is better.

If you need to ask if a raspberry pi is appropriate then a raspberry pi is not appropriate. That’s true in all situations but here’s why it’s true here: you would only use a sbc for this application because you either don’t have anything else or you’re worried about energy consumption. If you don’t have anything else then it doesn’t matter if it’s a smart choice and if you’re worried about energy consumption then you’re not factoring in the energy cost of maintaining a place for a human being to exist and look at the screens attached to the pi or you havent considered simply turning off the terminal when it’s not in use.

Don’t do an ip camera based security system as a learning experience. What you will learn is that it was a big waste of time and isn’t practical.

[–] leftOverLife@lemmy.ml 1 points 1 week ago (1 children)

Thank you for your response, I appreciate you being real about this.

[–] whoiswrongwithyou@lemmy.ml 2 points 1 week ago (1 children)

If you’re doing surveillance of people for extrajudicial reasons, constantly need to report crime or are just slurping up all the images of what goes on around your location for some project then it might be useful.

For responding practically to sudden and unexpected crime, dumb game cameras are the goat. They’re cheap, completely self contained, simple, relatively camouflaged (at the very least they’re not a black dome or a hooded ptz up in the corner) and when you need to turn footage over to the cops you can give them the “originals” (the sd card) and keep a copy if they require the originals.

[–] leftOverLife@lemmy.ml 1 points 1 week ago

Thanks!

[–] mierdabird@lemmy.dbzer0.com 6 points 1 week ago* (last edited 1 week ago) (1 children)

plastic cowling shaped like an anime titty

Lmao

Also thanks for the detailed write up. I'm interested in your mention of Optane, is that usable in Linux? I was under the impression all those optane drives on eBay would have limited functionality

[–] whoiswrongwithyou@lemmy.ml 2 points 1 week ago (1 children)

Yes. It all works by default. The ones you want to use for a cache device are m10, they come in 16, 32 and 64gb sizes.

[–] mierdabird@lemmy.dbzer0.com 1 points 1 week ago

Ah okay so those are basically in between storage and RAM. I was thinking of the models which combine SSD plus the extra Optane cache, those I've read require at least 8th gen Intel chips and probably more I don't know of

[–] sunstoned@lemmus.org 1 points 1 week ago

Username checks out

[–] Provolone@lemmy.zip 11 points 1 week ago* (last edited 1 week ago)

Frigate might be right for you. They have recommended cameras in their documentation.

Just remember to block internet access to any camera you get.

[–] nutbutter@discuss.tchncs.de 8 points 1 week ago (1 children)

Frigate.

Can be integrated with Home Assistant. Local object detection. Many other features. They have a supported hardware list too in their docs.

[–] Kirk@startrek.website 3 points 1 week ago

I also believe Frigate actually has a home assistant "app" version so it can be installed right on the same device.

[–] prunerye@slrpnk.net 7 points 1 week ago

A while back, I needed a camera on short notice, but I didn't have a server or any real hard drive space to speak of, so I just used "motion" on a 20 year old laptop, using the built-in webcam. It only saves video when motion is detected. I set it up to send me a Signal message with the video any time motion was detected, using signal-cli from the AUR. I know nothing about docker, but I thought it was super easy for my purposes.

[–] warmaster@lemmy.world 6 points 1 week ago

To add to what others have said, I run Frigate on docker container inside an LXC on a separate Proxmox server. The cameras and server are isolated from the rest of the network through a VLAN that has internet access blocked.

[–] rmerc@lemmy.ml 5 points 1 week ago

Thingino firmware on a cheap camera alleviated any concerns I had about the camera bypassing my DNS and phoning home. There are a list of compatible cameras on the Thingino website, and I got some help with installing the firmware on the Thingino discord. Integrates well with Frigate, and others such as TinyNVR.

[–] thagoat@lemmy.dbzer0.com 5 points 1 week ago (1 children)

LightNVR

Super simple to setup with docker. Works with any camera that broadcasts rtsp streams.

I have it running with 3 Sonoff cams and it works great, and sends alerts through NTFY for self-hosted notifications.

[–] utopiah@lemmy.ml 1 points 1 week ago (1 children)

3 Sonoff cams

Nice, these https://sonoff.tech/en-eu/collections/security-cameras ? No HomeAssistant integration? Do they require any application from Sonoff or does LightNVR handles everything once connected to LAN?

[–] thagoat@lemmy.dbzer0.com 1 points 1 week ago* (last edited 1 week ago) (1 children)

I have the B1P cams. There's an app that you need to use to set them up on your wifi, of course. And the app will give you the rtsp address to plug into lightnvr. You can also use that address in Hass to add the streams to your dashboard. There's no integration that I'm aware of. There's no need to use the sonoff app afterwards, unless you need to change wifi networks or upgrade the firmware.

[–] utopiah@lemmy.ml 1 points 5 days ago (1 children)

thanks, which app though? Is it open source too?

Im trying to buy hardware that requires no proprietary app at all, even for setup, only relying on well documented protocols.

[–] thagoat@lemmy.dbzer0.com 1 points 5 days ago

eWeLink. It's not open source, it's the sonoff official app.

[–] melfie@lemmy.zip 4 points 1 week ago (1 children)

I use Reolink cameras and recently got a Reolink NVR. I do block all Reolink devices from the internet in my OpenWRT firewall. I didn’t want to host a NVR on my server that’s already hosting a bunch of other stuff and further increase the blast radius of my server as a single point of failure. Reolink is all proprietary, but at least it’s local and works without internet access.

[–] TrickDacy@lemmy.world 2 points 1 week ago* (last edited 1 week ago) (2 children)

Thank you. What kind of server and storage do you use for the NVR and is it on a vlan or something? I'm trying to wrap my head around how much hardware I'll need to buy. I'm not that great with networking also so I've considered buying a cheap router for the system that isn't connected to the internet, instead of doing the vlan route.

[–] melfie@lemmy.zip 2 points 1 week ago* (last edited 1 week ago)

I use a Reolink NVR instead of my own server, along with SD cards in the cameras themselves as a backup. My switch has VLAN capabilities, but I haven’t configured my cameras to use it, mainly because I have Wi-Fi cameras outdoors (2 solar-powered and 1 doorbell camera connected to doorbell power). It’s a proprietary local setup that “just works”. I understand not trusting proprietary and wanting self-hosted open source all the way because I certainly don’t trust them to not collect my data and don’t allow Reolink devices to have internet access.

[–] Bane_Killgrind@lemmy.dbzer0.com 1 points 1 week ago

The reolink NVR is probably a Linux based SBC, it's built like an appliance and only runs the reolink software/firmware.

[–] eldavi@lemmy.ml 3 points 1 week ago

if you want completely free; completely private; and a project that will force you to learn A LOT because it's needful nature, there's motion and it'll work with any ip based camera. i used the ip webcam app to convert some old phones that i had laying around collecting dust into security cameras.

then i used google's desktop integrations with gnome to get alerts when i wasn't home and put the cameras on a segment of my network with no access to the internet to ensure privacy and it can also be containerized.