This is exactly it - storage is the best example

Could I run all of my stuff using a cloud service? Of course, but it would be very expensive and only available if my internet works (and there’s a lot of hops between me and my data in the cloud)

I can buy a 2TB HDD for £64 - most cloud providers charge that much per year for 1TB

Proxmox because it’s just Debian with a pretty UI for QEMU

I’m liking it a lot more than ESXi - it’s just better honestly

Yep, monitoring in multiple places with Zabbix

I have pfSense as well (soon to be OPNsense) and that shows traffic per network it’s connected to, so that’s great for live traffic

Zabbix monitors the networks and collects traffic data

Zabbix also monitors all containers and their network traffic

Don’t try to be clever and change the port from 3389 to something else either

Scanners can fingerprint traffic and just blast the other ports instead

I (foolishly) did this a few years ago and luckily I had account lockout enabled

Constant attempts all day long - they were even able to enumerate local users and try to log in as them (fortunately they never could cause the passwords were random keepass ones)

Don’t do it, seriously

I’ve recently just been through the Google Keep “divorce”

Why? Because they fucked up the Android app and it didn’t show any of my reminders for 3 weeks

I’ve since moved all my reminders to Google Calendar (which is where they should have been from the start to be honest)

All my notes were exported from Google Takeout and I moved the ones I actually needed to Obsidian

I’ve been using that with Syncthing for the past few weeks and it’s just so much better

Oh wow that’s a hell of an improvement

It’s been about 4 years since I last used it so I’m happy to see they’re still actively improving it

Log tail with Zabbix trigger could work

Sure thing

Also I thought that frigate is only usable through home assistant, but that only means android app I guess.

Nope, Home Assistant is just a nice integration with it

The web UI is fast and responsive - even on mobile in Chrome

You can easily view object detections and recordings by day and hour through the web UI too

It’s extremely well done

Anyway, I am actually in process of picking few cameras, likely going with tplink vigi, like C340 and see if it will play nicely.

Frigate have docs on recommended cameras

https://docs.frigate.video/frigate/hardware

Regardless of what cameras you choose, please ensure you VLAN and firewall them off - these cameras effectively run a Linux distro and should not be trusted or accessible

For example, my Reolink cameras can access NTP and DNS just so their clocks are correct

They can’t access anything else on the network

The CCTV VM sits on the same network as the cameras and has host firewall rules to deny access from the cameras

Frigate just connects to each camera’s stream and does its magic from there

version: "3.9"
services:
  frigate:
    container_name: frigate
    privileged: true # this may not be necessary for all setups
    restart: unless-stopped
    image: ghcr.io/blakeblackshear/frigate:stable
    shm_size: "512mb" # update for your cameras based on calculation above
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /opt/dockervolumes/frigate/config/config.yml:/config/config.yml
      - /mnt/cctv/frigate:/media/frigate
      - type: tmpfs # Optional: 1GB of memory, reduces SSD/SD Card wear
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "8554:8554"     # RTSP feeds
      - "8555:8555/tcp" # WebRTC over tcp
      - "8555:8555/udp" # WebRTC over udp
    environment:
      FRIGATE_C1_PASS: ${FRIGATE_C1_PASS}
      FRIGATE_C2_PASS: ${FRIGATE_C2_PASS}
      FRIGATE_C3_PASS: ${FRIGATE_C3_PASS}
      FRIGATE_C4_PASS: ${FRIGATE_C4_PASS}
    labels:
      - traefik.enable=true
      - traefik.http.routers.cctv.rule=Host(`cctv.${DOMAIN}`)
      - traefik.http.routers.cctv.entrypoints=websecure
      - traefik.http.routers.cctv.tls.certresolver=cloudflare
      - traefik.http.services.cctv.loadbalancer.server.port=5000
    networks:
      - proxy
networks:
  proxy:
    external: true

For just yourself? Get a domain that you can actually remember and use and then set up a WireGuard server (I recommend the Linuxserver.io WireGuard image)

Use that to access your stuff

Do you have 1 thing you desparately need to be publicly accessible? VLAN the VM off so it’s on its own and put a reverse proxy in front of it with HTTPS (and ideally MFA if you need auth)

Oh man where were you 6 hours ago hahaha

I was having a mare with the recording - I had it set to 0 days which I assumed meant “just fill the storage” but that’s completely wrong

Seems to be working great so far, gonna trial it for a week then decom my Shinobi

I’ve just set it up and it seems excellent so far

Just having trouble with the env vars - it’s not accepting my custom vars for {C1_PASSWORD} for example

Yep OP is right, but OP didn’t mention the fucking disasterous WireGuard implementation they tried to pull off

God that was a mess

This is yet another reminder to tick off “switch to OPNsense” on my to do list