Cameras: video surveillance on the NAS itself

10 min · 10 sections

The Cameras app turns the NAS into the recorder for the cameras you already own. Each camera records to your disk, in your folder, and you watch it from the panel without going through the manufacturer's cloud or their app.

What it does: find the cameras on your network, show the live view, record in chunks, keep the recordings for as long as you say, let you review them and alert you when it detects motion. What it does not do, on purpose: configure the camera. The manufacturer's app is there for that, and it does it better.

Adding a camera

Cameras → Add. There are three routes, in this order:

1. Search the network (ONVIF)

The Search for cameras button sends a probe to every network the NAS is on and lists the ones that answer, with their name and model. You pick one, enter the camera's username and password —the camera's, not the NAS's— and it tells you its own video address.

This is the good route: every manufacturer writes the RTSP address differently and hunting for it in the manual is exactly what makes people give up.

If none show up:

ONVIF ships switched off on many cameras (Reolink, Tapo, Ezviz…). You turn it on from their phone app, usually under Advanced settings → ONVIF, and it normally asks you to create a separate user there for it. This is reason number one.
The camera and the NAS have to be on the same network. A camera on the guest Wi-Fi or on another VLAN never gets the probe, which does not cross routers.
Some cameras only answer during the first minute after powering up. Restart it and search again.
If nothing works, carry on with the other two routes: you are not left without a camera.

2. By brand

If you know the brand, pick it from the list and enter the IP, the username and the password: the NAS builds that brand's known address (Hikvision, Dahua, Reolink, Tapo, Foscam, Axis and the generic ones). No ONVIF needed.

3. By hand

By pasting the full RTSP address, if you know it:

rtsp://username:password@192.168.1.60:554/Streaming/Channels/101

In all three cases, Test connects to the camera before saving and says what happened: if the password is wrong, if it does not answer or if the video cannot be understood. Saving a camera that does not work is no use to anyone.

Recording

Each camera records into the folder you choose, inside a household folder (so it shows up over SMB and goes into the backups like everything else). Recording is continuous and split into chunks of a few minutes: if something breaks, you lose one chunk, not the whole day.

Days of retention: how long recordings are kept before deleting themselves. Think about the disk: a 1080p camera takes on the order of 20–40 GB a day at high quality.
Size cap: in case the sum above gets away from you. On reaching the cap the oldest recordings are deleted even if they have not served their days.
The clean-up runs on its own; there is also a button to run it right now.

Video is stored exactly as the camera sends it, without re-encoding: the NAS spends no CPU on this and a modest machine copes with several cameras at once.

Watching the live view and the recordings

Live: the panel shows the camera's picture. Nothing to install. If the camera is motorised, whoever administers gets arrows and zoom over the picture to move it.
Recordings: the list of chunks by day and hour, with their size. You watch them in the browser or download them.
For the rest of the household, watching only. An account that does not administer gets Cameras at most with View (on their record in Users and groups → Apps): they see the live view and the recordings. Adding a camera, moving it or keeping a recording so the cleanup does not delete it is for whoever administers.
Who can see it, camera by camera. Out of the box, each camera is seen by **everyone who uses Cameras. On its card, "Who can see it"** opens the sharing window: untick "Everyone who uses Cameras" and choose people or groups. Anyone not on the list **sees neither the live view, nor the recordings, nor the alerts** of that camera — the guest has no reason to see the one in the kids' bedroom. Whoever administers always sees all of them.

Each camera records with its own system service (lgm-camara@<id>), so a camera that hangs does not drag the others down with it.

How the live view gets to you (and why it matters)

The live video arrives exactly as it leaves the camera, without re-encoding, and the browser plays it with under a second of delay. The NAS decodes nothing: it only splits it up. The corner of the picture says LIVE when it is working that way.

If the camera records in H.265, hardly any browser can paint it that way, so the panel switches itself to MJPEG —and says so in the corner—. That one does re-encode and does use the processor, which is exactly what is avoided in the normal case. If your camera allows it, set it to H.264: you will notice it in the NAS's load.

One single connection per camera. It does not matter how many people are watching the same camera or how many tabs you have open: the NAS opens one connection to it and shares the picture out. It matters because many home cameras only accept a couple of video connections at once and, past those, they start failing —recording included—. When the last window closes, the connection is released a few seconds later; reloading the page does not force a fresh negotiation with the camera. System check → Cameras shows how many live views are open right now.

Alert me when it detects motion

Each camera's card has a switch, Alert me when it detects motion. It comes switched off and you turn it on camera by camera: a camera overlooking the street would alert on every car going past, and an alert that always arrives stops being read.

How it works:

It looks at what is being recorded, not at the camera. Every half minute the NAS checks the last six seconds of the chunk being recorded right then. It does not open a second connection to the camera: many home cameras only take a couple of connections, and the extra one takes room away from the recording.
At most one alert every two minutes per camera. Somebody cooking in front of the kitchen camera does not produce forty alerts.
Zones that do not count. On the same card you paint over the image the zones to ignore — the pavement, the top of a tree, the glare of a street lamp. Whatever happens there does not alert. That is what makes the alert useful on a camera facing the street.
It only works while the camera is recording. The alert looks at the footage: with Record switched off, or with the camera stopped by its schedule, there is nothing to look at and no alert arrives. The panel says so under the switch.
The alert carries the photo of the moment. It arrives complete by email, Telegram and Discord, and you also see it in the panel's bell. Through ntfy the alert arrives without the photo, because that service needs a public address for the image and the photo of the inside of a house is not published on the internet.

The lower-quality video (optional)

Almost every camera provides a second, lower-resolution video alongside the main one. If you put its address on the card —searching the network for the camera fills it in for you— the panel uses it for the wall of all the cameras and for the live view on a phone: it shows up faster and uses far less network, which you notice when you watch from outside the house. Full screen and recording keep using the main video, so the quality of what is stored does not change.

Network tips

Give every camera a fixed IP on the router (a reservation by MAC). If the router changes its IP, recording stops until you fix the address. If you use the NAS's DHCP, the reservation is made from the panel.
Use the secondary channel (sub stream) if you only want surveillance and not cinema quality: it takes a quarter of the space.
Do not open the cameras' port on the router. Cheap cameras are among the most attacked things there are. To watch the live view from outside, come in through the VPN.
The recordings are ordinary files inside a household folder: they go into the backups if you include that folder —and mind the size if you do.

Recording schedule

Each camera picks when it records: always, only during set hours and days (a window that may cross midnight, such as 22:00 to 07:00) or only when nobody is home, choosing the family's phones among the network's devices (the NAS has to be the one handing out addresses). Outside its schedule the camera shows “off schedule”, with the time it comes back, and not as a fault. Schedules from before 1.69 (the weekly grid) are converted to a window on their own: check each camera's, because it may record more hours than before.

Talking through the camera

If the camera has a speaker and lets other programs use it (the ONVIF back channel, found on Dahua, Amcrest and many compatible cameras; or, on Hikvision, its own route), a microphone appears at the bottom centre of its live view. Tap it and what you say comes out of the camera's speaker while it shows “You can be heard through the camera”; tap it again to stop. The browser asks for microphone permission the first time, and the panel has to be encrypted (https and port 5001).

If the camera does not announce a speaker, the button does not appear. Reolink and Tapo use their own protocol, and the NAS cannot talk through them.
One person at a time per camera, and five minutes in a row at most.
Talking is for administrators, and it is written to the activity log.

Floor plan (Business)

In the Business edition, the Floor plan tab shows the cameras on the building's plan. An administrator uploads the image of the plan (JPEG or PNG, up to 25 MB; up to eight plans, one per floor) and taps Place cameras: each camera is placed with a tap where it is, dragged to move it and, once selected, adjusted for the direction it faces, its field of view and its range. Nothing is saved until Save is tapped. Tapping a camera on the plan opens its live view, and each account sees on the plan only the cameras it can see.

Copy of protected recordings (Business)

Protected recordings (the padlock in Recordings) can be sent automatically to another device: in Recordings → Copy of protected recordings → Set up, choose a Backup destination (another NAS over SSH or an unencrypted folder). When it is turned on, the NAS writes a test file to the destination, reads it back and compares it; if it does not match, it is not turned on and it says why.

Each protected recording is sent when its hour ends and is checked there file by file, with a checksum; until then it does not count as copied.
They go into the lgm-camaras-protegidas folder of the destination, one subfolder per camera.
Removing the padlock here does not delete it there. If a copy fails, you get an alert.