📹 Security-Camera Live Streaming Add-On

1 · Two-Path Product Strategy

Because Eric is an authorized TP-Link reseller (and can obtain dealer accounts for other brands), this add-on has two revenue lanes instead of one:

2 · Brand Compatibility Matrix

Verdicts are for our pipeline: can an on-LAN bridge pull a live stream (RTSP/ONVIF) and relay it to the browser? Sources verified July 2026.

Key sources: TP-Link FAQ 2680 · Amcrest RTSP KB · Reolink RTSP · UniFi Protect API · Wyze RTSP · Nest Device Access · iSpy XMEye DB

3 · TP-Link Tapo — Specifics (your reseller line, consumer tier)

Enabling RTSP/ONVIF (per camera)

1. Tapo app → Device Settings → Advanced Settings → Camera Account → create a local username/password (6–32 chars, avoid special characters). This is the RTSP/ONVIF enablement.
2. Newer firmware: Tapo app → Me → Third-Party Services / Tapo Lab → Third-Party Compatibility → ON (default OFF on 2025+ firmware).
3. ~40 wired models supported incl. C100, C110, C200, C210, C320WS. Battery models = no RTSP (exception: D235/D225/TD25 doorbells when hardwired).

rtsp://CAMERAACCT:PASS@CAMERA_IP:554/stream1   ← main stream (HQ)
rtsp://CAMERAACCT:PASS@CAMERA_IP:554/stream2   ← substream ~640×360@15fps (use this)
ONVIF: port 2020, Profile S

Why VIGI VMS "can't see" Tapo cameras (field note, July 2026)

Tested live on the Boom Media LAN: VIGI VMS Auto Discover only finds VIGI-protocol devices — Tapo cameras never appear in the scan. They must be added via Manually Add → ONVIF → camera IP → port 2020 → Camera Account credentials. Same-subnet required (guest Wi-Fi / VLAN / AP client-isolation blocks it).

What VIGI VMS works with

• Full (Auto Discover) VIGI IP cameras and VIGI NVRs — playback, smart events, PTZ.
• Manual Add via ONVIF Tapo (per above), Amcrest (port 80), Hikvision/Annke/LTS, Dahua/Lorex, Reolink (port 8000), and often XMEye DVRs (ONVIF port 8899 — hit-or-miss by firmware).
• Never Ring, Nest, Wyze — cloud-only, no ONVIF. VIGI VMS also can't ingest a raw RTSP URL; the device must answer ONVIF.

4 · Amcrest — Specifics (best-in-class, the reference brand)

• RTSP is on by default, port 554, digest auth, spec-stable Dahua URL format (unchanged ~10 years):

Camera:  rtsp://user:pass@IP:554/cam/realmonitor?channel=1&subtype=0   (0=main, 1=sub)
NVR:     same URL — channel = camera number on the recorder
Playback: /cam/playback?channel=1&starttime=...                        (recorded clips, later, free)
Snapshot: http://IP/cgi-bin/snapshot.cgi?channel=1                      (JPEG — cheap dashboard thumbnails)

• HTTP CGI API (Dahua rebadge): snapshots, MJPEG, PTZ, events — the snapshot endpoint means the dashboard can show refreshing thumbnails without holding streams open.
• ONVIF: yes; newer firmware wants a dedicated ONVIF user (Settings → System → ONVIF) — for our pipeline plain RTSP + snapshot.cgi suffices.
• Documenting Amcrest first doubles as coverage for generic Dahua and Lorex-recorder installs (same URLs).

Sources: Amcrest RTSP KB · NVR RTSP KB · Official HTTP API spec (PDF)

5 · XMEye / Xiongmai Deep-Dive — the Gurapos DVR ⭐

Confirmed: Gurapos's DVR is a Xiongmai device registered on the xmeye.net cloud portal (visible under the Boom account by cloud serial, custom device credentials). It's online and healthy — but that tells us less than it seems:

Why the cloud-ID path is a dead end

• No documented public API; the only SDK is a closed C/C++ OEM NetSDK with no English docs or ToS — nothing to build a SaaS on.
• All open-source tools (OpenIPC python-dvr, dvrip, sofiactl) speak DVRIP directly to TCP 34567 on the LAN only — none traverse the cloud relay.

Security: never expose this device class to the internet

• Mirai botnet 2016 (hardcoded root:xc3511, CVE-2016-1000245).
• SEC Consult 2018: ~9M devices with blank default admin password, hardcoded default:tluafed backdoor usable via the cloud, predictable UIDs, unencrypted traffic, unsigned firmware (CVE-2018-17915/17917/17919).
• 2025: fresh ONVIF auth-bypass CVEs on XM530-based cameras (e.g. CVE-2025-65856).

Gurapos onboarding plan (Path A, bridge-only)

1. Get DVR local IP + admin credentials + 10 min at the DVR (or its on-LAN web UI).
2. Enable RTSP: Main Menu → System → NetService → RTSP (port 554).
3. Probe URL variants (firmware-dependent) from a laptop with VLC:

rtsp://IP:554/user=admin&password=XXX&channel=1&stream=0.sdp?real_stream
rtsp://IP:554/user=admin_password=XXX_channel=1_stream=0.sdp
(stream=0 main · stream=1 sub; channel = camera number)

4. If H.265-only: set the DVR substream codec to H.264 (or transcode at the bridge — avoid if possible).
5. Install bridge box on the LAN; DVR gets zero port forwards, ideally its own VLAN.
6. Strip audio at the bridge (see §10).

6 · Field-Test Playbook — qualify any client in 15 minutes

7 · Architecture — Options Compared & the Pick

Why not the obvious shortcuts

The pick: "Displayee Bridge" (go2rtc at the edge, MediaMTX in the cloud)

• Both components MIT-licensed. (Shinobi is disqualified — selling access requires their paid enterprise license. Scrypted's licensing is murky. Frigate = future AI-events upsell, overkill for live view.)
• go2rtc at the edge: single binary, native Tapo/Ring/HomeKit quirk handling, near-zero CPU for remux — a Pi handles 4–8 substreams (pilot before promising counts).
• MediaMTX at the core: sourceOnDemand = only pull/relay while someone's watching (dashboard); continuous push only for cameras pinned to signage. External-auth callback wires directly into Supabase tenancy.
• Always deliver H.264 to browsers (Firefox has no HEVC-in-WebRTC): pull the camera's H.264 substream, never transcode if avoidable.
• Latency tiers: WebRTC sub-second for "is my kitchen OK right now"; HLS via Bunny for the 24/7 signage tile (one origin pull serves N screens).
• UniFi Protect sites: skip the bridge dance — provision RTSPS streams programmatically via their official API key.

8 · Cost Math & Suggested Add-On Pricing

Ingest is free (DO inbound). DO egress overage $0.01/GiB; Bunny CDN $0.01/GB NA/EU ($0.005 volume). All-in ≈ $0.20–$3.50/cam/mo.

9 · Hardware Kits & Reseller Programs (Path B)

Reseller / dealer programs — direct answers

Ranking for a 5–20 cam/month integrator: TP-Link SolutionX > Amcrest dealer > Reolink. Apply to Amcrest anyway (free), but lead with VIGI.

⚠️ FCC Covered List — brands to never resell

Brand-line comparison (4-cam kit basis)

The three Boom kits

Margin & labor benchmarks

• Hardware: integrator norm 20–40% markup (NSCA recommends ≥30%; survey average 35%). Hardware at 30% is table stakes — the recurring streaming fee is where Boom's real margin lives.
• South Florida install labor: techs bill $85–150/hr; per-camera $40–120 wireless, $80–250 wired; labor = 50–70% of system budget. Palm Beach concrete/block pushes to the top of range → price Boom installs at $150–200/camera wired.

Sources: VIGI ONVIF/RTSP FAQ · Amcrest dealer application · Reolink distributor T&Cs · FCC Covered List · Dec 2025 FCC rule · IPVM margin report · Miami labor guide

10 · Legal Notes — Florida (brief; not legal advice)

• 🚨 Audio is the felony trap. Florida is all-party consent (Fla. Stat. § 934.03); non-consensual audio recording = third-degree felony + civil damages (§ 934.10). Restaurant cameras with mics capture customer conversations. Ship with audio stripped at the bridge by default; audio = explicit opt-in behind a consent warning.
• Video-only in areas with no reasonable expectation of privacy is generally legal; never restrooms/changing areas (§ 810.145 video voyeurism — note its safe harbor for security systems with conspicuously posted written notice). Include a "This area is under video surveillance" signage kit in onboarding — it doubles as the statutory safe harbor.
• Employees: post notice + handbook policy; NLRB GC Memo 23-02 treats monitoring that chills organizing as presumptively unlawful. No cameras in break rooms.
• Reseller shield: ToS attestation that the customer owns the premises, won't enable audio without compliance, keeps cameras out of § 810.145 areas, posts notices; indemnification + termination right. Have a FL attorney review before launch.

11 · Where It Fits in Displayee + Phased Build Plan

Displayee (Displayee/app/) already ships the surfaces this needs — this is an extension of the existing video subsystem, not a greenfield build:

• Video infra: di_video_libraries / di_video_gallery_items tables, api/videos/* routes, Bunny webhooks, VideoPlayer.tsx, signed-URL playback, per-library RLS.
• Device infra: pairing + heartbeat (api/devices/*) — the same pattern extends to bridge boxes (a bridge is just another paired device that heartbeats).
• Player surfaces: /player/[id], /g/[id], Fire TV / Electron / Chrome players — a camera feed becomes a new playlist tile type.

12 · The Demo System (also = the P0 pilot) — ✅ LIVE as of July 13, 2026

The original $0 recipe (all owned hardware):

Quick-start (Tapo → go2rtc → MediaMTX, ~30 minutes)

# 1. Per camera, in the Tapo app:
#    Device Settings → Advanced → Camera Account → create user/pass
#    Me → Third-Party Services / Tapo Lab → Third-Party Compatibility → ON
#    Note the camera IP (app shows it, or router client list) — reserve it in DHCP

# 2. On the spare PC — go2rtc.yaml (go2rtc has a native tapo handler too):
streams:
  demo_cam1: rtsp://ACCT:PASS@192.168.1.50:554/stream2
  demo_cam2: rtsp://ACCT:PASS@192.168.1.51:554/stream2
publish:                       # push outbound to the droplet relay
  demo_cam1: rtsp://USER:PASS@mediamtx.boommedia.us:8554/gurapos-demo/cam1

# 3. On boom-hosting via Coolify: run bluenviron/mediamtx container
#    (ports 8554 RTSP-in, 8889 WebRTC/WHEP out; set publish/read credentials)

# 4. Watch from anywhere: http://mediamtx-host:8889/gurapos-demo/cam1
#    → later this URL is what <VideoPlayer> wraps in the Displayee dashboard

Cheap upgrades (in order)

1. Free VIGI camera — the SolutionX partner Rewards Store promo currently gives partners a VIGI camera at no cost → the PoE/business-line demo unit for client pitches.
2. Amcrest refurb turret ~$40 (refurbs ~30% off) — demos the exact Dahua-style URLs + snapshot-thumbnail flow that the Gurapos recorder-swap would use.
3. Real bridge box ~$120–150 (N100 mini-PC) — the only spend worth making before client-facing demos, so the demo unit = the install unit.

Zero-hardware dev note: ffmpeg can publish a synthetic test-pattern stream into MediaMTX — build the Displayee dashboard UI with no camera at all.

🛒 Which Tapo models to buy — expanding the demo network cheap (2–4 cams)

Every camera on TP-Link's official camera-account list supports RTSP/ONVIF (FAQ 4372). The cheap picks, street prices ⚑:

13 · Appendix — SaaS Build-Status Audit (verified on disk, July 13, 2026)

Note: the boundary doc's claim that Displayee is "docs-only" is outdated — the full app lives at Displayee/app/ (nested git repo). Eric's 4 pending Rewardee/BOO steps remain the top ecosystem blocker (see SaaS/.md/CLEANUP_EXECUTION_HANDOFF.md).