What a self-hosted CCTV server is
A self-hosted CCTV server records camera streams on hardware you control. Frigate, ZoneMinder or MotionEye runs on Linux, takes RTSP feeds from ONVIF cameras and writes clips to your disk. Keep the recorder on the camera network, reach it through WireGuard and use a VPS only as a relay or off-site copy.
Three parts make the system: IP cameras that publish an RTSP stream, a recorder that pulls those streams and stores clips, and a way to view them remotely without exposing the recorder to the internet. There is no monthly subscription in that chain unless you add one.
- Cameras must speak RTSP over the LAN and support ONVIF for discovery. Most PoE cameras from Hikvision, Dahua, Reolink and Amcrest do.
- The recorder is a Linux machine with Docker, a disk sized for retention, and enough CPU to decode the streams.
- Remote access is a VPN tunnel. Port forwarding an NVR is how cameras end up in botnet scans.
Frigate, ZoneMinder or MotionEye
All three are free and self-hosted. They differ in how they decide what to record and how much hardware they expect.
| Software | Licence | How it records | Best for |
|---|---|---|---|
| Frigate | MIT | AI object detection on the stream; records clips around people, vehicles and animals | Home and shop setups that want alerts that mean something |
| ZoneMinder | GPL | Continuous or motion-triggered recording, MySQL/MariaDB, mature PTZ support | Larger installations and users who want classic NVR behaviour |
| MotionEye | GPL | Lightweight motion detection with a simple web UI | Two or three cameras on modest hardware |
Frigate is the usual starting point because object detection cuts storage and false alerts at the same time. It bundles go2rtc for restreaming, so one camera feed can serve the recorder and a live view without a second connection to the camera.
Storage maths before you buy a disk
Bitrate decides storage, not megapixels. Multiply the camera bitrate by time and you get the daily figure; retention multiplies it again.
| Bitrate per camera | Per camera, 24/7, one day | 4 cameras, 30 days |
|---|---|---|
| 2 Mbps | about 21 GB | about 2.5 TB |
| 4 Mbps | about 43 GB | about 5.2 TB |
| 6 Mbps | about 65 GB | about 7.8 TB |
| 8 Mbps | about 86 GB | about 10.4 TB |
This is why continuous recording gets expensive. Event recording in Frigate typically keeps 10–20% of the day, which turns a 5 TB month into roughly 0.5–1 TB. Set retention in days rather than hoping the disk lasts.
Server specs for four and eight cameras
Decoding is the load. Four 4 MP streams on CPU detection need more than a file server would, and object detection adds a second pass on top.
| Cameras | CPU / RAM | Disk | Notes |
|---|---|---|---|
| 4 × 4 MP | 4 vCPU / 8 GB | 1 TB SSD | CPU detection works; a Coral USB or OpenVINO device drops CPU sharply |
| 8 × 4 MP | 8 vCPU / 16 GB | 2–4 TB | Hardware decode and an accelerator are close to mandatory |
| Any, 24/7 | Add 2 GB RAM | Surveillance-grade HDD is fine for clips | SSD for the OS and database, spinning disk for footage |
Shared memory trips people up. Frigate decodes through /dev/shm, so a 64 MB default container limit crashes with camera errors; set shm_size to 256 MB for a few cameras and higher for 4K. A 4K stream also costs four times the decode work of 1080p for little gain at night.
Remote viewing with WireGuard, not port forwarding
Put the recorder on a private network and join it from your phone with a VPN. Tailscale is WireGuard with the key exchange handled for you, which makes it the fastest route for a small site.
- On the recorder: curl -fsSL https://tailscale.com/install.sh | sh, then sudo tailscale up.
- Sign in and note the 100.x.y.z address Tailscale assigns. That address is stable.
- Install the Tailscale app on your phone and sign in to the same account, so both devices join one tailnet.
- Open http://100.x.y.z:5000 for the Frigate interface. It loads over mobile data because the tunnel carries the traffic.
- Leave the router alone. Do not forward 5000, 8971 or 554 to the internet, and keep ufw denying inbound.
You know it worked when the live view loads on mobile data with Tailscale connected and fails when you switch Tailscale off. That failure is the proof the camera UI is not public.
If the site is behind carrier-grade NAT and needs a stable entry point, run WireGuard on a small VPS and point both peers at it. That relay is a legitimate VPS job; recording to the VPS is a different question, covered next.
Why a cloud VPS is a relay, not the recorder
Cameras sit on a shop or home network. Sending every stream to a datacenter burns upload bandwidth, adds a failure point on the internet link, and turns a local recording into a remote one that stops when the connection drops.
A VPS earns its place in three jobs: the WireGuard relay above, an off-site copy of event clips, and a Frigate instance for cameras that already live on a network with good upload. A WebJi VPS with root access covers all three, and the off-site copy should land on storage that is not the same disk, which is what server backup solutions are for.
What we do not sell is a managed CCTV service or a camera bundle. You buy the server; Frigate, ZoneMinder or MotionEye is yours to run.
When self-hosting CCTV is the wrong choice
Consumer cloud cameras with no RTSP output cannot feed these tools, and no amount of server hardware changes that. Check for an RTSP URL before you buy cameras, not after.
Running the recorder beside other services? The self-hosted automation tools guide covers Docker and backup discipline on the same box. Self-hosting also fails when the upload link is a home broadband line that drops daily, when nobody will check disk health, or when the site has a legal retention requirement that needs a documented chain of custody. In those cases a commercial NVR with a maintenance contract is the honest answer, and a free tool is not.
Frequently Asked Questions
Can I run a CCTV server on a VPS?
Yes, for cameras whose network has enough upload bandwidth, or as a relay and off-site clip copy. Recording every stream in a datacenter costs upload capacity and stops when the internet link drops, so most sites record locally and use the VPS for remote access.
How do I self-host CCTV with Frigate or ZoneMinder?
Install Docker on a Linux machine, add the camera RTSP URLs, and start the container with a volume for footage. Frigate needs config.yml with each camera and an MQTT broker for detection events. ZoneMinder needs a database and a web server, which the packaged Docker image provides.
How much storage do CCTV recordings need?
At 4 Mbps a camera writes about 43 GB a day, so four cameras over 30 days need roughly 5.2 TB. Event-only recording in Frigate usually keeps 10–20% of that. Set a retention period and let the software overwrite the oldest clips.
Can I view cameras remotely without port forwarding?
Yes. Put the recorder and your phone on the same WireGuard or Tailscale network and open the recorder's private 100.x address. Nothing on the router is exposed. Port forwarding an NVR interface is what gets camera systems found by scanners.
How much bandwidth does CCTV streaming use?
One 4 Mbps camera uses about 43 GB a day, so four cameras move roughly 170 GB daily if you record them all continuously. Remote viewing adds only the stream you watch. Compress with H.264 and lower the frame rate before you upgrade the internet line.
Is a VPS enough for four to eight cameras?
Compute is enough: 4 vCPU and 8 GB RAM handles four 4 MP streams with CPU detection, and eight cameras want 8 vCPU and 16 GB. The limit is usually the upload link from the camera site, plus disk cost for retention in a datacenter.