mirror of
https://github.com/itme-brain/nixos.git
synced 2026-03-23 16:29:42 -04:00
pruned
This commit is contained in:
commit
072951659a
114 changed files with 6922 additions and 0 deletions
162
system/machines/server/modules/frigate/README.md
Normal file
162
system/machines/server/modules/frigate/README.md
Normal file
|
|
@ -0,0 +1,162 @@
|
|||
# Frigate Camera Setup
|
||||
|
||||
## Camera Models
|
||||
|
||||
| Camera | Model | MAC | IP |
|
||||
|--------|-------|-----|-----|
|
||||
| cam4 | W461ASC | 00:1f:54:c2:d1:b1 | 192.168.1.194 |
|
||||
| cam1 | B463AJ | 00:1f:54:a9:81:d1 | 192.168.1.167 |
|
||||
| cam2 | W463AQ (ch1) | 00:1f:54:b2:9b:1d | 192.168.1.147 |
|
||||
| cam3 | W463AQ (ch2) | 00:1f:54:b2:9b:1d | 192.168.1.147 |
|
||||
| cam5 | SL300 | | | |
|
||||
|
||||
## Network Architecture
|
||||
|
||||
- Camera network: 192.168.1.0/24 (isolated, no internet)
|
||||
- Server NIC: enp2s0f1 @ 192.168.1.1
|
||||
- WiFi AP: TP-Link RE315 @ 192.168.1.254
|
||||
- DHCP range: 192.168.1.100-200
|
||||
|
||||
## RTSP URL Format
|
||||
|
||||
```
|
||||
rtsp://admin:ocu?u3Su@<IP>/cam/realmonitor?channel=<CH>&subtype=0
|
||||
```
|
||||
|
||||
- channel=1 for single-camera devices
|
||||
- channel=1,2 for dual-camera devices (W463AQ)
|
||||
- subtype=0 for main stream, subtype=1 for sub stream
|
||||
|
||||
## Camera Reset Procedures
|
||||
|
||||
### W461ASC (cam4)
|
||||
1. Keep camera powered on
|
||||
2. Reset button is on the back of the camera
|
||||
3. Press and hold reset button for 30-60 seconds until chime sounds
|
||||
|
||||
### B463AJ (cam1)
|
||||
1. Remove doorbell from mount
|
||||
2. Locate reset button on the back
|
||||
3. Press and hold until you hear chime reset sound
|
||||
4. Reconnect via Lorex app as new device
|
||||
|
||||
### W463AQ (cam2/cam3)
|
||||
1. Keep camera powered on
|
||||
2. Rotate the lens upwards to reveal hidden reset button
|
||||
3. Press and hold reset button until you hear audio prompt
|
||||
4. Flashing green Smart Security Lighting confirms reset
|
||||
5. Solid green = not fully reset, repeat if needed
|
||||
|
||||
### SL300 (cam5)
|
||||
1. Keep camera powered on
|
||||
2. Tilt camera lens upwards to reveal reset/microSD card cover
|
||||
3. Remove the cover
|
||||
4. Press and hold reset button until audio prompt
|
||||
5. Replace cover quickly
|
||||
6. Wait for green LED flash + audio confirmation
|
||||
|
||||
## Initial Setup
|
||||
|
||||
1. Temporarily enable internet for camera network:
|
||||
```bash
|
||||
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o enp2s0f0 -j MASQUERADE
|
||||
sudo sysctl -w net.ipv4.ip_forward=1
|
||||
```
|
||||
|
||||
2. Connect camera to "cams" WiFi network
|
||||
|
||||
3. Use Lorex app to configure camera (requires cloud - CCP middleman)
|
||||
|
||||
4. Get camera MAC from DHCP leases:
|
||||
```bash
|
||||
cat /var/lib/dnsmasq/dnsmasq.leases
|
||||
```
|
||||
|
||||
5. Add DHCP reservation in `system.nix`:
|
||||
```nix
|
||||
dhcp-host = [
|
||||
"aa:bb:cc:dd:ee:ff,192.168.1.XXX,camera_name"
|
||||
];
|
||||
```
|
||||
|
||||
6. Add MAC to firewall block list in `system.nix`:
|
||||
```nix
|
||||
iptables -A FORWARD -m mac --mac-source aa:bb:cc:dd:ee:ff -j DROP
|
||||
```
|
||||
|
||||
7. Update camera IP in `frigate/default.nix` and enable
|
||||
|
||||
8. Deploy and disable internet:
|
||||
```bash
|
||||
nixos-rebuild switch --flake .#server --target-host server
|
||||
sudo iptables -t nat -D POSTROUTING -s 192.168.1.0/24 -o enp2s0f0 -j MASQUERADE
|
||||
sudo sysctl -w net.ipv4.ip_forward=0
|
||||
```
|
||||
|
||||
## Storage
|
||||
|
||||
| Path | Bind Mount | Contents |
|
||||
|------|------------|----------|
|
||||
| /var/lib/frigate | /data/frigate/lib | Database, recordings, clips |
|
||||
|
||||
## Notes
|
||||
|
||||
- Lorex cameras are cloud-only for configuration (no local web UI responds)
|
||||
- RTSP works locally without internet
|
||||
- Cameras phone home aggressively when internet is available - keep isolated
|
||||
- Haswell CPU cannot hardware decode HEVC - using CPU decode
|
||||
- Consider T400 GPU for hardware acceleration if scaling to more cameras
|
||||
|
||||
## Port Scan Results (W461ASC)
|
||||
|
||||
- 80/tcp - HTTP (non-responsive, proprietary)
|
||||
- 554/tcp - RTSP (working)
|
||||
- 8086/tcp - Proprietary
|
||||
- 35000/tcp - Proprietary
|
||||
|
||||
## Planned Upgrades
|
||||
|
||||
Replace Lorex cameras with proper RTSP/ONVIF cameras for reliable Frigate integration.
|
||||
|
||||
| Current | Replacement | Price | Notes |
|
||||
|---------|-------------|-------|-------|
|
||||
| cam1 (B861AJ) | Reolink Video Doorbell WiFi | ~$120 | 5MP, wired power + WiFi, always-on |
|
||||
| cam4 (W461ASC) | TP-Link Tapo C110 | ~$30 | 3MP, compact, window-friendly |
|
||||
| cam2 + cam3 (W463AQ) | Reolink E1 Pro | ~$45 | 4MP, 355° pan |
|
||||
| cam5 (SL300) | **Remove** | - | Obstructed, overlaps with cam4 |
|
||||
|
||||
**Total: ~$195**
|
||||
|
||||
### Reolink Video Doorbell WiFi
|
||||
|
||||
- URL: https://reolink.com/us/product/reolink-video-doorbell-wifi
|
||||
- Model: SKU 2267808
|
||||
- Resolution: 5MP (2560x1920 @ 20fps)
|
||||
- Dimensions: Standard doorbell form factor
|
||||
- Power: Hardwired 12-24VAC or DC 24V (always-on, no battery)
|
||||
- Network: 2.4GHz/5GHz WiFi
|
||||
- Protocols: RTSP, ONVIF, RTMP, HTTPS
|
||||
- FOV: 180° diagonal (135° H, 100° V)
|
||||
|
||||
### TP-Link Tapo C110
|
||||
|
||||
- URL: https://www.tp-link.com/us/home-networking/cloud-camera/tapo-c110/
|
||||
- Resolution: 3MP (2304x1296 @ 15fps)
|
||||
- Dimensions: 2.66" x 2.15" x 3.89" (compact cube, similar to Lorex W461ASC)
|
||||
- Power: 9V DC adapter
|
||||
- Network: 2.4GHz WiFi
|
||||
- Protocols: RTSP, ONVIF (officially supported NVR mode)
|
||||
- RTSP URL: `rtsp://user:pass@IP:554/stream1` (main), `stream2` (sub)
|
||||
- Frigate: Confirmed working - https://www.simonam.dev/tapo-c110-frigate-config/
|
||||
|
||||
### Reolink E1 Pro
|
||||
|
||||
- URL: https://reolink.com/us/product/e1-pro/
|
||||
- Resolution: 4MP (2560x1440)
|
||||
- Dimensions: ~4" dome with pan/tilt
|
||||
- Power: 5V DC adapter
|
||||
- Network: 2.4GHz/5GHz WiFi
|
||||
- Protocols: RTSP, ONVIF
|
||||
- Features: Pan 355°, Tilt 50°, person/pet detection
|
||||
|
||||
**Why replace Lorex:** Cloud-dependent config, no ONVIF, doorbell sleeps on battery, aggressive phone-home behavior requires network isolation.
|
||||
294
system/machines/server/modules/frigate/default.nix
Normal file
294
system/machines/server/modules/frigate/default.nix
Normal file
|
|
@ -0,0 +1,294 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.modules.system.frigate;
|
||||
nginx = config.modules.system.nginx;
|
||||
domain = "ramos.codes";
|
||||
user = config.sops.placeholder."RTSP_USER";
|
||||
pass = config.sops.placeholder."RTSP_PASS";
|
||||
|
||||
in
|
||||
{
|
||||
options.modules.system.frigate = {
|
||||
enable = mkEnableOption "Enable Frigate NVR";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Allow user to access frigate recordings via SSHFS
|
||||
users.users.${config.user.name}.extraGroups = [ "frigate" ];
|
||||
|
||||
# go2rtc config with credentials from sops
|
||||
sops.templates."go2rtc.yaml" = {
|
||||
content = ''
|
||||
rtsp:
|
||||
listen: ":8554"
|
||||
webrtc:
|
||||
listen: ":8555"
|
||||
streams:
|
||||
cam1: "rtsp://${user}:${pass}@192.168.1.167/cam/realmonitor?channel=1&subtype=0#backchannel=1"
|
||||
cam1_sub: "rtsp://${user}:${pass}@192.168.1.167/cam/realmonitor?channel=1&subtype=1"
|
||||
cam2: "rtsp://${user}:${pass}@192.168.1.147/cam/realmonitor?channel=1&subtype=0#backchannel=1"
|
||||
cam2_sub: "rtsp://${user}:${pass}@192.168.1.147/cam/realmonitor?channel=1&subtype=1"
|
||||
cam3: "rtsp://${user}:${pass}@192.168.1.147/cam/realmonitor?channel=2&subtype=0#backchannel=1"
|
||||
cam3_sub: "rtsp://${user}:${pass}@192.168.1.147/cam/realmonitor?channel=2&subtype=1"
|
||||
cam4: "rtsp://${user}:${pass}@192.168.1.194/cam/realmonitor?channel=1&subtype=0"
|
||||
cam4_sub: "rtsp://${user}:${pass}@192.168.1.194/cam/realmonitor?channel=1&subtype=1"
|
||||
'';
|
||||
mode = "0444"; # go2rtc runs as dynamic user, needs read access
|
||||
};
|
||||
|
||||
# go2rtc service using sops-templated config
|
||||
services.go2rtc.enable = true;
|
||||
systemd.services.go2rtc = {
|
||||
serviceConfig.ExecStart = mkForce "${pkgs.go2rtc}/bin/go2rtc -config ${config.sops.templates."go2rtc.yaml".path}";
|
||||
after = [ "sops-nix.service" ];
|
||||
wants = [ "sops-nix.service" ];
|
||||
};
|
||||
|
||||
services.frigate = {
|
||||
enable = true;
|
||||
package = pkgs.unstable.frigate;
|
||||
hostname = "frigate.${domain}";
|
||||
vaapiDriver = "i965"; # Haswell iGPU for H.264 decode
|
||||
settings = {
|
||||
mqtt.enabled = false;
|
||||
|
||||
ffmpeg = {
|
||||
hwaccel_args = "preset-vaapi"; # VAAPI for H.264 substream detection
|
||||
input_args = "preset-rtsp-restream"; # TCP transport for go2rtc
|
||||
};
|
||||
|
||||
birdseye = {
|
||||
mode = "continuous";
|
||||
width = 1280;
|
||||
height = 720;
|
||||
quality = 8; # 8 - 31
|
||||
};
|
||||
|
||||
motion = {
|
||||
enabled = true;
|
||||
};
|
||||
|
||||
detect = {
|
||||
enabled = true;
|
||||
min_initialized = 3;
|
||||
max_disappeared = 25;
|
||||
width = 1280;
|
||||
height = 720;
|
||||
};
|
||||
|
||||
audio = {
|
||||
enabled = true;
|
||||
max_not_heard = 30;
|
||||
min_volume = 600;
|
||||
listen = [
|
||||
"glass"
|
||||
"shatter"
|
||||
"fire_alarm"
|
||||
"boom"
|
||||
"thump"
|
||||
"siren"
|
||||
"alarm"
|
||||
"explosion"
|
||||
"burst"
|
||||
];
|
||||
};
|
||||
|
||||
audio_transcription = {
|
||||
enabled = true;
|
||||
model_size = "small";
|
||||
language = "en";
|
||||
};
|
||||
|
||||
record = {
|
||||
enabled = true;
|
||||
continuous.days = 3; # Full 24/7 footage
|
||||
motion.days = 7; # Motion segments after continuous expires
|
||||
detections.retain = {
|
||||
days = 14; # Any tracked object (person, car, etc.)
|
||||
mode = "motion";
|
||||
};
|
||||
alerts.retain = {
|
||||
days = 30; # Zone violations, loitering - important stuff
|
||||
mode = "all";
|
||||
};
|
||||
};
|
||||
|
||||
snapshots = {
|
||||
enabled = true;
|
||||
retain = {
|
||||
default = 3;
|
||||
};
|
||||
quality = 80;
|
||||
};
|
||||
|
||||
|
||||
cameras = {
|
||||
cam1 = {
|
||||
enabled = true;
|
||||
ffmpeg.inputs = [
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam1";
|
||||
roles = [ "record" ];
|
||||
}
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam1_sub";
|
||||
roles = [ "detect" "audio" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
cam2 = {
|
||||
enabled = true;
|
||||
motion.enabled = false;
|
||||
detect.enabled = false;
|
||||
objects.mask = [ "0.969,0.078,0.846,0.075,0.845,0.034,0.97,0.037" ];
|
||||
ffmpeg.inputs = [
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam2";
|
||||
roles = [ "record" ];
|
||||
}
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam2_sub";
|
||||
roles = [ "detect" "audio" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
cam3 = {
|
||||
enabled = true;
|
||||
motion.enabled = false;
|
||||
detect.enabled = false;
|
||||
ffmpeg.inputs = [
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam3";
|
||||
roles = [ "record" ];
|
||||
}
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam3_sub";
|
||||
roles = [ "detect" "audio" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
cam4 = {
|
||||
enabled = true;
|
||||
audio.enabled = false;
|
||||
motion.mask = [ "0.811,0.109,0.954,0.111,0.959,0.065,0.811,0.055" ];
|
||||
zones.zone1 = {
|
||||
friendly_name = "lot";
|
||||
coordinates = "0.299,0.438,0.191,0.951,0.453,0.964,0.453,0.437";
|
||||
loitering_time = 10;
|
||||
};
|
||||
ffmpeg.inputs = [
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam4";
|
||||
roles = [ "record" ];
|
||||
}
|
||||
{
|
||||
path = "rtsp://127.0.0.1:8554/cam4_sub";
|
||||
roles = [ "detect" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
classification = {
|
||||
custom = {
|
||||
"door" = {
|
||||
enabled = true;
|
||||
name = "door";
|
||||
threshold = 0.8;
|
||||
state_config = {
|
||||
cameras = {
|
||||
cam2.crop = [
|
||||
0.8595647692717828
|
||||
0.39901413156128707
|
||||
0.9903488513256276
|
||||
0.6315191663236775
|
||||
];
|
||||
cam3.crop = [
|
||||
0.0008617338314475493
|
||||
0.3909394833748086
|
||||
0.12040036569190293
|
||||
0.6034526066822848
|
||||
];
|
||||
};
|
||||
motion = true;
|
||||
};
|
||||
};
|
||||
"lot" = {
|
||||
enabled = true;
|
||||
name = "lot";
|
||||
threshold = 0.8;
|
||||
state_config = {
|
||||
cameras = {
|
||||
cam4.crop = [
|
||||
0.2757899560295573
|
||||
0.5156825410706086
|
||||
0.4445399560295573
|
||||
0.8156825410706086
|
||||
];
|
||||
};
|
||||
motion = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Add SSL to frigate's nginx virtualHost
|
||||
services.nginx.virtualHosts."frigate.${domain}" = mkIf nginx.enable {
|
||||
useACMEHost = domain;
|
||||
forceSSL = true;
|
||||
locations."/go2rtc/" = {
|
||||
proxyPass = "http://127.0.0.1:1984/";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Frigate segment cache in RAM (reduces disk writes)
|
||||
fileSystems."/var/cache/frigate" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = [ "size=512M" "mode=0755" ];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
# Set ownership after tmpfs mount
|
||||
"d /var/cache/frigate 0750 frigate frigate -"
|
||||
# Create log directories for Frigate API (NixOS uses journald, but API expects these)
|
||||
"d /dev/shm/logs 0755 frigate frigate -"
|
||||
"d /dev/shm/logs/frigate 0755 frigate frigate -"
|
||||
"d /dev/shm/logs/nginx 0755 frigate frigate -"
|
||||
"d /dev/shm/logs/go2rtc 0755 frigate frigate -"
|
||||
];
|
||||
|
||||
# Pipe journald logs to files for Frigate GUI
|
||||
systemd.services.frigate-log-pipe = {
|
||||
description = "Pipe logs to /dev/shm for Frigate GUI";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "frigate.service" "go2rtc.service" "nginx.service" ];
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Restart = "always";
|
||||
ExecStart = pkgs.writeShellScript "frigate-log-pipe" ''
|
||||
while true; do
|
||||
${pkgs.systemd}/bin/journalctl -u frigate -n 500 -o cat > /dev/shm/logs/frigate/current 2>/dev/null
|
||||
${pkgs.systemd}/bin/journalctl -u go2rtc -n 500 -o cat > /dev/shm/logs/go2rtc/current 2>/dev/null
|
||||
${pkgs.systemd}/bin/journalctl -u nginx -n 500 -o cat > /dev/shm/logs/nginx/current 2>/dev/null
|
||||
chown frigate:frigate /dev/shm/logs/*/current
|
||||
sleep 5
|
||||
done
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Backup recordings/database
|
||||
modules.system.backup = {
|
||||
paths = [ "/var/lib/frigate" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue