root
9615f0263f
- README: project overview, pricing, deployment model - ARCHITECTURE: system design, data flow, components, security - DECISIONS: Pi Zero 2W, Tailscale, reolink-aio, Wasabi S3 choices - ROADMAP: 3-phase plan (MVP, monetization, expansion) - CHANGELOG: concept (Aug 1) and full documentation (Aug 5) - Customer onboarding information request sheet
56 lines
2.3 KiB
Markdown
56 lines
2.3 KiB
Markdown
# NVR Shield — Decisions
|
|
|
|
## Why Pi Zero 2W?
|
|
|
|
- **Cost:** $15/unit keeps BOM at ~$41, enabling $149 retail with healthy margin
|
|
- **Power:** 5V micro-USB, can share NVR's UPS or any USB port
|
|
- **Size:** Tiny, fits behind NVR or in structured media panel
|
|
- **OS:** Raspberry Pi OS Lite (Bookworm) — mature, read-only overlayfs support, Tailscale package
|
|
|
|
**Alternatives considered:**
|
|
- Pi 4/5: Overkill. 4x the cost, no benefit for API polling workload
|
|
- ESP32: Too constrained. No Python, limited HTTP client, no Tailscale
|
|
- On-NVR agent: Reolink NVRs don't support custom agents. Would require rooting
|
|
|
|
## Why Tailscale Instead of Direct VPN?
|
|
|
|
- Zero customer firewall configuration needed — Tailscale punches through NAT
|
|
- Pre-configured at flash time, ships ready to connect
|
|
- Tag-based ACLs (`tag:nvr-shield`) keep devices isolated from rest of tailnet
|
|
- Customer never sees or manages the VPN
|
|
|
|
## Why reolink-aio Library?
|
|
|
|
- Active open-source Python client for Reolink cameras/NVRs
|
|
- Supports both HTTP and HTTPS API
|
|
- Handles login/session management
|
|
- Maintained, documented, tested against Reolink firmware
|
|
|
|
**Alternative:** Direct HTTP calls with `requests`. Rejected — reolink-aio handles auth, errors, and data parsing.
|
|
|
|
## Why One Pi Per Site (Not Per NVR)?
|
|
|
|
- Single Pi Zero 2W can poll 5-10 NVRs with zero performance issues (lightweight HTTP calls, no video)
|
|
- Simplifies deployment: one device per physical location
|
|
- Cleaner pricing: per-site, not per-NVR
|
|
- Reduces BOM for multi-NVR sites
|
|
|
|
## Why Core Dashboard on :8090?
|
|
|
|
- Existing Ops Portal runs on :8090. NVR Shield is a natural extension
|
|
- Shares auth (central auth JWT validation)
|
|
- Path-based routing: `/nvr-shield/` sits alongside existing `/backup-restore/`, `/ops/`
|
|
|
|
## Why Wasabi S3?
|
|
|
|
- Already used for all ITPP backups (hermes, app1, app2, app3)
|
|
- No egress fees for clip retrieval/viewing
|
|
- Per-bucket IAM policies for customer isolation
|
|
- Immutability for compliance/audit trail
|
|
|
|
## Pricing Decisions
|
|
|
|
- Hardware at $149: 3.6x BOM ($41) — covers labor (flashing, packaging, shipping), still competitive with off-the-shelf NVR monitoring appliances ($200-500)
|
|
- Monthly tiers: $49 (monitoring) / $97 (clip vault) / $147 (AI rules) — follows ITPP convention: annual = monthly, simple increments
|
|
- No per-NVR surcharge: cleaner pitch, fewer objections
|