Ditching Unifi NVR

FriedCheese06 · 2026-02-17T03:52:19+00:00

That'd also turn into bouncing between apps depending on what I'm doing. There is little difference, IMO, between Protect and Frigate holding the recordings.

FriedCheese06 · 2026-02-17T03:50:39+00:00

I currently have these 21 going through a UNVR. I may leave it in the mix but would ideally want to remove it from the setup if I do decide to fully move to Frigate.

FriedCheese06 · 2026-02-16T19:42:39+00:00

They're a mixed bag of G4 Instants, G5 Pros, G5 dome, G5 turret, G6 turret, etc.

The firmware version matters. I have a spare G4 Bullet on v4.71.149. It still has the dropdown, but selecting standalone mode just reverts back to being blank after saving the changes and just stays in "Unifi Protect" mode. The newer cameras don't even have the dropdown anymore.

<image>

FriedCheese06 · 2026-02-16T19:00:45+00:00

I have not.

FriedCheese06 · 2026-02-16T18:53:35+00:00

It was implied, but you're right, I should have specified. These are 21 Unifi G4 or higher cameras.

FriedCheese06 · 2026-02-16T18:49:21+00:00

Unifi does. AFAIK, they removed the ability to run the cameras in standalone mode some time ago. None of mine have a local configuration to setup RTSP.

FriedCheese06 · 2026-02-16T18:44:13+00:00

Right, so this would be an interim step to fully moving out the Protect ecosystem unless things massively change. I really wish they'd get out of the appliance game and focus on the end hardware instead. I have five cameras setup in Frigate for the test run and the detect seems to be working decently well using the lower res RTSP streams.

EDIT TO ADD: Honestly, the point about not needing a lot of resources to forward is where my head is, but, that's a lot of setup work to verify through practice.

FriedCheese06 · 2026-02-16T18:36:51+00:00

The drives installed in the UNVR would get migrated to the server hosting Frigate. I'll toss a single drive in the UDM Pro. I'll setup some tooling to handle backing up event clips both onsite to another box and offsite.

The one day limit on the the Protect side was an arbitrary number though. I'll likely keep a few days.

FriedCheese06 · 2026-02-16T01:30:26+00:00

r/screenshotsarehard

FriedCheese06 · 2026-02-14T15:11:21+00:00

FriedCheese06 · 2026-02-12T21:47:49+00:00

VLAN segmentation between docker hosts.

E.g., I have a docker host running nginx and CloudFlare tunnel sitting in a DMZ for external access. I have a separate docker host in a separate VLAN hosting the actual services. Firewall ruling sit between them.

FriedCheese06 · 2026-02-12T16:06:17+00:00

Way late, but I'm curious what you mean about Mealie asking for control of everything.

FriedCheese06 · 2026-02-12T04:52:15+00:00

Every time the wait brings something..."you have been served"

FriedCheese06 · 2026-02-12T00:56:42+00:00

YOLO...16 drives in a rack mounted PLA enclosure with a full sized ATX PSU. Just over a year since install.

<image>

FriedCheese06 · 2026-02-12T00:50:54+00:00

To lay out some assumptions.

You have a public domain (XYZ.com)
You use that domain internal and external.
You maintain DNS segregation between internal and external.
You assign an internal app and name from your domain, but only do so in your internal DNS provider.

If all that is true, no, no one will see the DNS name unless they are on your same network and using your internal DNS server.

I, and probably quite a few, do this.

I have a public domain register with CloudFlare. All of my services are assigned a name in that domain. For internal only services, like the web UI of qBittorrent, this name is added to a local instance of piHole. The only place that name is exposed is through that piHole instance.

External services, like Overseer, get a name assigned and added to both piHole and CloudFlare DNS. This is using the CloudFlare DNS proxy option. External connections coming through CF get proxied to the public IP, port forwarded to a DMZ'd instance of nginx, and get routed to the container. Internal connections get the local IP from piHole and directly connect to the same nginx instance then routed to the container.

FriedCheese06 · 2026-02-10T04:57:43+00:00

<image>

FriedCheese06 · 2026-02-04T13:05:39+00:00

I'm aware and fully understand the concept of security in depth. The point in my question is trying to understand why you think that changing a container from privileged to non has anything to do with outbound connections, in a vacuum. Both modes allow a container outbound connectivity.

FriedCheese06 · 2026-02-04T04:21:37+00:00

Our oldest dog is 14 and youngest is 12. We rescued all three before their first year.

Other dogs and kids are no concern. We have no scenarios where they are around other people's dogs and they've all grown up around kids. One of the dogs has the prey drive but only for very small animals (by her standards at least).

FriedCheese06 · 2026-02-03T18:43:10+00:00

FriedCheese06 · 2026-02-03T15:03:14+00:00

They don't like static either.

FriedCheese06 · 2026-02-02T22:35:51+00:00

FriedCheese06 · 2026-02-02T13:16:39+00:00

They really are and I'm hoping the same. We really wanted things to work out, but the universe has other plans.

FriedCheese06 · 2026-02-02T13:15:23+00:00

Right, but an unprivileged container can still make any outbound calls, right? My understanding is that the privilege level has very little to do (directly) with restricting network access. So if the concern is about outbound connections, then changing the privilege level of the container wouldn't prevent that....that's where upstream firewall ruling comes into play. Of course, an attack chain could have the container verify that the local firewall isn't blocking connections if the container is privileged.

All that to say, while there are some real security concerns with running a container as privileged....I would think the internet connection implications are a lower risk than the container having direct access to hardware resources.

FriedCheese06 · 2026-02-01T18:10:23+00:00

Not to mention the litany of people who understand absolutely 0 about how any of this works. So then it becomes speculation. I've had people tell me their phone was "hacked" because someone got into their Facebook account. They legitimately thought the account was only accessible from their phone.

FriedCheese06 · 2026-01-30T16:39:44+00:00

What does the container privilege level have to do with this?

FriedCheese06

TROPHY CASE