Revisiting cloud backup of CCTV

Last year I described how I send CCTV footage from Zoneminder to OneDrive. I’m now using Frigate, so I had to make some changes.

It’s a good idea to send clips and snapshots to cloud storage when motion is detected, as intruders will look for, and destroy, recording devices. My method relies on my Synology NAS and the Cloud Sync package to allow me to connect my Linux system to OneDrive. I described it in a previous post, but in short I mount a directory from the NAS on my Linux server, and that directory is in turn synced to OneDrive.

On my Linux server, the NFS directory is mounted at /mnt/onedrive

$ df -h |grep onedrive
192.168.1.26:/volume1/onedrive  2.7T  1.7T  1.1T  60% /mnt/onedrive

I was using the filter feature of Zoneminder to determine which clips to copy, and renaming those clips to something a little more user friendly.

With Frigate I’ve set up something that’s similar, but without the delays that were inherent with Zoneminder filters, that only run every 20 seconds by default.

I should note that this only works when running Frigate under Docker. If you’re running Frigate as a Home Assistant add-on, you’ll need a different method. It also relies on having a Synology NAS and using CloudSync. There are no official Linux clients for OneDrive, although there is an unofficial open source option. Dropbox does have an official client for Linux, so if you use Dropbox you could cut out the middleman.

I’m running Frigate under Docker (well, actually Podman, but the differences aren’t relevant for this), and I’m using a docker volume to store the clips and recordings. In my case, I’ve mapped drive /data/frigate on my host to /media/frigate in the docker container so that when the container writes clips to /media/frigate they appear on my host under /data/frigate. This has subdirectories for clips and recordings.

As with the Zoneminder setup, I could have chosen to use the NAS mounted drive directly by using an appropriate subdirectory as the target of the docker volume – i.e:

-v /mnt/onedrive/cctv:/media/frigate

Instead of

-v /data/frigate:/media/frigate

I chose not to do that in order to avoid a dependency on the Synology.

In order to copy the clips, I first had to identify when a new clip was created. Luckily Linux has a feature for that – the inotifywait command can be used to wait for changes to a file or directory and act on the result. The command is:

inotifywait -m -e close_write /data/frigate/clips

The -m parameter, monitor, tells inotifywait to run indefinitely instead of exiting after the first event.
The -e close_write option tells inotifywait which event I’m interested in – close_write fires after a file, which has previously been opened in writable mode, is closed. In other words, when Frigate has finished writing the file.

The output consists of the directory, the event or events, and the filename concerned:

/data/frigate/clips/ CLOSE_WRITE,CLOSE back_garden-1632563420.114654-1pzl6g.mp4

The filenames are encoded with the unix timestamp, and once again I wanted to convert that to something more friendly before copying to OneDrive. It will also pick up changes to the Frigate database, frigate.db-wal, so I wanted to filter to pick up the jpg and mp4 files. A simple shell script did the trick:

# cat /opt/local/bin/frigatechanges.sh
#!/bin/bash

inotifywait -m -e close_write /data/frigate/clips |
while read dir events filename
do
        echo $filename |grep "jpg\|mp4" > /dev/null
        if [ $? -eq 0 ]
        then
          unixtime=`echo $filename |cut -d '-' -f2`
          datestamp=`date -d "@$unixtime" +%Y-%m-%d_%H-%M-%S`
          newfilename=`echo $filename | sed -e s/$unixtime/$datestamp/`
          cp /data/frigate/clips/$filename /mnt/onedrive/cctv/frigate/clips/$newfilename
          echo Frigate file: Copied $filename to $newfilename
        fi
done

This extracts the timestamp, replaces it with a readable format, and then copies the file to the Synology mount point.

Finally, I wrapped the script in a systemd unit file so that I can run it automatically on boot:

# cat /etc/systemd/system/frigatefile.service
[Unit]
Description=Frigate file watcher
Wants=network.target
After=network-online.target

[Service]
Type=simple
Restart=always
ExecStart=/opt/local/bin/frigatechanges.sh

[Install]
WantedBy=multi-user.target

So how responsive is it? Is there a major delay between files being written and then appearing in OneDrive?

It’s pretty much immediate. As soon as the file has finished writing, the copy is triggered and CloudSync takes care of uploading it to OneDrive. The length of time is determined solely by the time it takes to upload the file, which is obviously determined by your internet speed. Most of the clips I get are in the range of 30 – 60MB, and my nominal internet upload speed is 20Mb/s, giving an estimated upload time of between 12 and 24 seconds. In practice I don’t quite get those speeds, but it’s close enough. The internal copy from the Linux server to Synology is negligible, as it’s over a local gigabit connection.

The copy obviously doesn’t start until the clip is complete – i.e. when Frigate has finished detecting motion – so there is a window for an intruder to prevent files from being uploaded. Once in the house, though, an intruder would have to identify and destroy the devices before they had a chance to upload the clips.

There are also other ways in which the security system could be evaded. A really determined intruder might start by cutting the phone line to my house, thus preventing the files from being uploaded and also preventing notification alerts from being triggered.

If I was truly paranoid, I’d have both devices in a secure location within the house that would at least slow down efforts to find and damage them. I’d have them both connected to a UPS so that they worked even if the intruder somehow managed to cut power, and I’d have a secondary 4G internet connection, also UPS powered, to upload the files…

There’s only so much you can do though, and in reality the real security probably comes from a combination of a visible alarm system, security cameras, and lights on at night acting as a deterrent.