Put the cams on their own VLAN with no route to the internet and let Frigate pull the RTSP streams. Block DNS for that VLAN too, or they’ll keep trying to phone home. Curious what you pick for the NVR side.

If nothing’s exposed and it’s all behind Netbird, you don’t strictly need it. I still would, because apps like Vaultwarden’s web vault won’t load without a secure context. A wildcard cert via DNS challenge is a one-time setup. Everything else is optional.

Put it on its own VLAN or guest SSID in OpenWRT, then add a firewall rule that only lets your client subnet reach it on 631 and 9100. Block WAN for that zone completely. AirPrint discovery needs mDNS across zones, so you’ll want umdns or avahi as a reflector, and that’s the part that usually breaks. I’m building a home box that does this by default for IoT stuff. Would you want it to just work, or would you rather see the rules?

Which part do you want to spend the least time maintaining: photo backups, remote access, or updates? I’m designing Doomsday Box, a home-server concept, and trying to understand what should work without constant attention. Your planned setup is relevant. Would you mind giving blunt feedback on the idea? https://heyeddi.com/projects/doomsday-box

Is the two-disk requirement for capacity, redundancy, or keeping workloads separate? I’m exploring an N150 home-server concept and trying to understand where a compact box becomes too limiting. Storage seems like a decision worth getting right before choosing the enclosure.