# NVR Shield — Decisions

## Why Pi Zero 2W?

- **Cost:** $15/unit keeps BOM at ~$41, enabling $149 retail with healthy margin
- **Power:** 5V micro-USB, can share NVR's UPS or any USB port
- **Size:** Tiny, fits behind NVR or in structured media panel
- **OS:** Raspberry Pi OS Lite (Bookworm) — mature, read-only overlayfs support, Tailscale package

**Alternatives considered:**
- Pi 4/5: Overkill. 4x the cost, no benefit for API polling workload
- ESP32: Too constrained. No Python, limited HTTP client, no Tailscale
- On-NVR agent: Reolink NVRs don't support custom agents. Would require rooting

## Why Tailscale Instead of Direct VPN?

- Zero customer firewall configuration needed — Tailscale punches through NAT
- Pre-configured at flash time, ships ready to connect
- Tag-based ACLs (`tag:nvr-shield`) keep devices isolated from rest of tailnet
- Customer never sees or manages the VPN

## Why reolink-aio Library?

- Active open-source Python client for Reolink cameras/NVRs
- Supports both HTTP and HTTPS API
- Handles login/session management
- Maintained, documented, tested against Reolink firmware

**Alternative:** Direct HTTP calls with `requests`. Rejected — reolink-aio handles auth, errors, and data parsing.

## Why One Pi Per Site (Not Per NVR)?

- Single Pi Zero 2W can poll 5-10 NVRs with zero performance issues (lightweight HTTP calls, no video)
- Simplifies deployment: one device per physical location
- Cleaner pricing: per-site, not per-NVR
- Reduces BOM for multi-NVR sites

## Why Core Dashboard on :8090?

- Existing Ops Portal runs on :8090. NVR Shield is a natural extension
- Shares auth (central auth JWT validation)
- Path-based routing: `/nvr-shield/` sits alongside existing `/backup-restore/`, `/ops/`

## Why Wasabi S3?

- Already used for all ITPP backups (hermes, app1, app2, app3)
- No egress fees for clip retrieval/viewing
- Per-bucket IAM policies for customer isolation
- Immutability for compliance/audit trail

## Pricing Decisions

- Hardware at $149: 3.6x BOM ($41) — covers labor (flashing, packaging, shipping), still competitive with off-the-shelf NVR monitoring appliances ($200-500)
- Monthly tiers: $49 (monitoring) / $97 (clip vault) / $147 (AI rules) — follows ITPP convention: annual = monthly, simple increments
- No per-NVR surcharge: cleaner pitch, fewer objections