← Articles

Frigate Private Camera Network: Local NVR Setup and Remote Access

Frigate is an open-source network video recorder that performs object detection on hardware you control. A private deployment keeps camera streams, detection, recordings, and review inside the home or site network. The privacy result depends on more than installing one container: cameras, storage, detector, authentication, integrations, and remote access all create separate boundaries.

Choose a deployment shape

These are planning starts, not a bill of materials. Frigate's documentation ties load to camera count, resolution, frame rate, codecs, detection, enrichments, and retention. Benchmark the real streams. The official guide describes 4 GB as a basic minimum, 8 GB as a minimum when enrichments are used, and 16 GB as a general recommendation for larger or heavier setups.

Keep cameras on a restricted network

Put cameras on a dedicated VLAN or firewall segment when the router supports it. Allow each camera to reach the Frigate host on the required stream and management ports. Block camera-initiated internet access unless a documented feature requires it. Use unique camera credentials, update firmware, disable vendor peer-to-peer cloud access, and prefer a read-only viewer account for RTSP or ONVIF where supported.

Frigate does not automatically make a cloud-dependent camera private. If the camera sends telemetry, retains a vendor account, or needs a cloud relay, that path still exists. Confirm behavior at the firewall rather than trusting an app toggle.

Use separate detection and recording streams

The project recommends tuning a low-rate stream for detection and a higher-quality stream for recording. A lower-resolution substream reduces decode and detection load, while the main stream preserves evidence quality. Frigate's camera guide recommends about 5 frames per second for typical detection and treats 10 frames per second as a practical upper range for most use cases.

Container and storage boundary

The recommended Docker Compose installation maps persistent configuration into /config and recordings into /media/frigate. Frigate first writes recording segments to /tmp/cache; the installation guide recommends a memory-backed tmpfs for that cache. Keep the database on reliable local storage. The project warns that placing the SQLite database on SMB or NFS can create locking problems.

Size storage from measured camera bitrate, recording mode, camera count, and retention. Continuous recording uses more capacity but avoids gaps caused by missed motion or detections. Event-only recording reduces storage and can miss context. Encrypt disks when physical access matters, restrict file permissions, and back up configuration separately from disposable video history.

frigate/
├── docker-compose.yml
├── config/
└── storage/

Authentication and ports

Create separate viewer or camera-limited roles for people who do not need administration. If an upstream authentication proxy is used, set trusted proxies narrowly and protect the proxy-to-Frigate path. Header-based identity is only useful when clients cannot bypass the proxy and reach the backend directly.

Private remote access with Tailscale

The simplest remote route is a private tailnet rather than a public port forward. Install Tailscale on the Frigate host or use a subnet router when the host cannot run it. Apply access rules to specific users or devices. Tailscale Serve can terminate HTTPS inside the tailnet and reverse proxy a local service; Tailscale documents that normal access-control rules also apply to Serve.

Remote access does not replace Frigate authentication or camera permissions. Use both layers: the tailnet decides which devices can reach the host, while Frigate roles decide which cameras and actions a user can access. Do not use Tailscale Funnel for a private camera service because Funnel publishes a service to the public internet.

Integrations create outbound paths

MQTT and Home Assistant can remain on the local network. Push notifications, remote object detectors, external model hubs, URL-based model downloads, remote backups, and vendor camera services may not. Inventory each hostname or destination, the data sent, authentication method, and failure behavior.

• Keep camera stream credentials in supported environment substitutions rather than public configuration copies.
• Use a local detector and local model file when the objective is an offline inference path.
• Disable unused MQTT, two-way audio, restream, ONVIF, and enrichments.
• Test core recording and review with the internet link blocked.
• Inspect DNS and firewall logs after enabling an integration.

Failure points before relying on the system

Commissioning checklist

1. Block camera internet access and confirm required local streams still work.
2. Run the authenticated UI on 8971 and verify port 5000 is not reachable from an untrusted client.
3. Confirm detect and record streams use the intended resolution, frame rate, and codec.
4. Measure decode, detector latency, memory, temperature, and disk use with all cameras active.
5. Review each user role and limit camera access.
6. Test recording, export, deletion, reboot, detector loss, disk pressure, and remote-access loss.
7. Document every outbound integration and repeat the firewall check after upgrades.

Sources

• Frigate installation and port documentation
• Frigate hardware and storage planning
• Frigate camera stream setup
• Frigate authentication and roles
• Frigate restream security
• Tailscale Serve and access controls
• Tailscale subnet router documentation