As a CCTV enthusiast, I do not generally recommend ubiquiti cameras unless the person wants to wholly live in the unifi ecosystem.

They’re very pricey for what you get, even though they are pretty good. They’re most often not even near the best in class despite their price, though (looking at you, doorbell camera)

They also don’t play nice with open/self hosted NVRs. It’s getting better due to consistent demand, but the reality is that they’re at their best when you use unifi protect, on unifi devices. So IMO it’s all or nothing, and since there’s a lot better value in other brands, I choose not to use them anymore.

They’re pretty user friendly, though

It’s super easy to configure over a LAN.

You set up a folder path to sync, authorize it between two machines, and set up your configuration (mirrored sync, one way, etc).

For photos taken by my phone for example, I have two syncs set up (maybe not the best way to do it it’s just how I did it in 5 min when I started and never changed it)

Phone has a 2 way sync set up with my photo folder with my desktop. Meaning, when I delete/modify a photo either at my phone or the desktop it deletes/modifies the photo on the other device.

Additionally, I have a 1-way sync of my photo folder between my desktop and my server archive, so the server only pulls in new files and never deletes or modifies existing files in the archive. So if something happens to my sync folder or if I delete something on accident then I have an archive copy, important for precious memories. Every now and then I just delete the contents of the archive folder and it immediately re-syncs the existing folder of all the stuff I actually wanted to keep. Could set up a cron job but I’m too lazy.

For Joplin I just have a folder on each device that’s JUST my Joplin notes that syncs between my devices that use Joplin. Easy as pie - as soon as I turn on my laptop or desktop it syncs up with whatever changes have happened on the other two.

For syncthing I like to make a top level sync folder on each device and then nest many folders under that top level, each to sync distinct things depending on what device it is. You can just sync a main folder if you want but I like the granular control, and as you figure out more stuff to sync it scales much better if you start that way, and name folders consistently.

Just be careful in the beginning and always back stuff up. It’s not TOO easy to mess up but if you did it would be unforgiving. Test it with some random stuff before you start sending anything important.

As someone who used NC with Joplin for a long time, I wouldn’t recommend it. I prefer syncthing now, much simpler to manage and find your files vs it being nested in a big clunky NC instance.

Joplin works really well for me. Was syncing via nextcloud for a long time but syncthing is way easier to manage and more bulletproof as long as you configure it correctly

You mentioned immich somewhere, I think that’s a good one to set up. Don’t throw your entire life’s photo album at it at first, but it’s really good to test a variety of functions and transfer speeds.

Oh yeah… And TAKE NOTES about your setup. Like, for each container, make notes of how you set it up and why. Trust me this is REALLY important for maintaining your stuff. If you go down a rabbit hole for two days and find a couple forum threads that lead you to how you need to modify the configs for your use case, a year from now you will have forgotten everything.

Document, document, document.

If tailscale is your preferred method to access your network from outside your home it’s one of the most important parts of your setup, in terms of both security and functionality.

Luckily, overlay VPNs like tailscale are pretty easy to set up without glaring security problems, but you definitely want to triple-check you aren’t messing things up. The thing is, you don’t know what you don’t know, so you might not realize if you make a mistake. But like I said, it’s pretty hard with those types of setups.

To actually answer your question though, I recommend you get one or two containers working locally and then figure out how to access them from your tailnet before you dive in and set up your entire stack. Docker adds another layer of complexity when it comes to accessing things so I recommend you get it right and then deploy and test each container individually.

Don’t set up 10 containers and then try to see if they all work, go steadily and deliberately, checking to make sure each works, and then snapshot your functional setup before you start using it heavily.

Don’t forget to plan for backups and updates.

I’ve never encountered what you’re describing. There’s always other ways to authenticate than through a mobile app, at least from my experience, and I think I’ve used about a dozen different banks/credit unions over the past 15 or so years. Last credit union I cut ties with had ZERO MFA for their web portal, except on account creation. Like, no SMS, no email, nothing - just user+pass, and making sure you have the right background picture of the login screen you picked on account generation (like, a duck or a football or whatever). Completely ridiculous in 2025 (when I cancelled my account).

Regarding the OP, I think any new competition in this space right now is good, even if it ends up just being a triopoly vs a duopoly (fat chance with this thing but we can hope).

Ideally though we need an open protocol/standard that can be implemented through any manner of device software.

They’re not the same.

Hiding an unlocked treasure chest in the forest is obscurity. Sure, you might be the only one who knows it’s there at first but eventually someone might come across it.

Having a vault at a bank branch is security - everyone knows there’s a vault there, but you’ll be damned if you’re going to get into it when you’re not authorized.

Good passwords, when implemented correctly, use hashing (one way encryption) to provide security. It’s not obscured, people know you need a password to access the thing (in our example)

You can self host Protect. It’s what I did for ages when I was using a few of their cameras. Don’t have to use cloud unless you want to.

There’s a lot of downsides to ubiquiti (I’ve been dunking on them all over this thread) but there’s a LOT of great stuff too, and being able to self-host their management suite if you choose to do so is GREAT. That doesn’t make me want to invest in their walled garden for cameras, but for people who want to get into a functional ecosystem they’re a great choice. Overall the price:performance curve is not worth it to me, though, but neither are apple products, even though I know they work well also.

Their support for ONVIF is, as you said, limited. Being able to add a camera into your protect feed is a good start, but until they make it work better for PTZ, audio, sub stream capture, and everything else it’s not worth note IMO.

RTSP allows you to check a live feed in another software suite (even just VLC) but again, without the cameras themselves being ONVIF standard you’re missing all the aforementioned features and now you’re really REALLY overpaying for what is essentially a dumb camera.

I’ve experimented with ubiquiti cameras and for the most part I find them very overpriced for their quality point. They’re good cameras, but they’re not ONVIF compatible so if you want to get into their (super overpriced and limited) ecosystem you won’t be able to intermix other cameras easily.

A good example is their doorbell camera. It’s just not good. And they don’t have more than one model, so if you want a good one you’re buying something else, that won’t work in their software, so now you’re using two systems to watch your cameras.

I’m glad they work for you, but I don’t recommend getting into their camera ecosystem.

Server equipment is not on any normal burglar’s list of items to nab. It’s such a low risk I think it’s completely not worth worrying about.

It’s incredibly unlikely they’ll know what they’re looking at in the first place, and won’t be assed to carry out heavy switches and PC gear “just in case” to look it up later. They want to get in, check rooms and closets, drawers, etc and GTFO before you come home or a neighbor notices. Computers aren’t as expensive as they used to be. Gaming laptops might look attractive, but other than that you’re fine.

They want jewelry, cash, guns, good tools, silver, modern game consoles, expensive bicycles, etc. These are all things that are easy to carry and pawn or sell well on the street. Nobody is selling switch gear at a pawn shop or to random people, so even if they know the value of what they’re looking at (extremely unlikely) they’ll leave it because it’s too hard to fence.

If you’re that worried about theft then set up good full disk encryption and have off-site backups of your data (should do that anyways) but you don’t need to worry about physical security at home, at least not specifically in regards to your home lab.

Businesses are at much higher risk for hardware theft, from employees or from others that are targeting the locations specifically because they DO understand the value and have a way to offload the gear, but those same people won’t be randomly breaking into people’s houses hoping they’ve got Cisco gear in a closet somewhere.

I’d recommend using unifi/ubiquiti switches. They’re a bit pricey but they’re incredibly solid and you can manage them with a self hosted container of unifi controller software.

A good place to start is one of their 8port POE switches. I have a couple and they’re L3 switches (so you can do VLAN stuff like you want), and I’ve never ever had a problem with any of them. Even with the inexpensive ones their POE budget is pretty good, and great to power other switches or APs. They don’t power some cameras so you might need injectors for some thirsty gear.

The controller software is pretty good, and will let you manage the switches without getting into command line config at first (which can be a crutch so be cautious of that, especially if you want to branch out into other cheaper switches or take advantage of good 2nd hand gear deals you find).

But for your network I think an 8 port and a WAP are a good place to start. Get away from using your combo router as your wireless AP (or use both) and get some VLANs set up, and work on inter-VLAN routing and firewall rules.

How do you want to segment your network?

I recommend you have the following to start:

-management VLAN

-trusted devices

-guest/IoT devices

Just getting those three set up correctly will teach you a lot and let you environment. Firewall/routing rules to allow connections through in certain directions and not others is… fun to get the hang of if you’re new.

What are you planning on using as your router? Your combo router might tie your hands if that’s what you plan to use for everything. Combo routers generally suck at everything. You can get a cheap router also, edgerouter er-x is a fine choice but it’s not the best, but it’ll still outdo whatever you currently have, I’m sure. Put it behind your modem at your network edge and you can manage your vlan routing and your firewall on one device.

Additionally you can set up a VPN server on one of your PCs and set up static routes to allow you to tunnel in and access your network when you’re out (wireguard for the win).

Good luck on your journey! There’s a lot to learn so don’t get frustrated then your stuff doesn’t work. Back up your configs so you can revert back and be REALLY careful because it’s easy enough to make your stuff insecure by trying to make stuff work. Yeah it’ll function but next thing you know you’ve got a ransomware virus on your entire network… Not fun, I hear.

As you set up your VLANs look into VLAN traversal, it’s a means of network attack that allows attackers to cross over from one VLAN to another when you set up trunk/switch ports and VLAN tagging incorrectly. Again, your stuff will work but it’ll be vulnerable (not really a problem at home as long as your firewall works fine but still).

Edit: you can go with a router with several ports but I’d recommend you shy away from that if you have the money for dedicated devices. Routers are better at routing (L3) and switches are better at switching (L2). Their guts are built for different things and your network will be much faster if you use them for their intended purpose.

Not trying to go down a rabbit hole, nor invade your teen’s privacy, but have you done any kind of packet inspection on what’s going out/in? Teens can surprise you with the kind of stuff they’re up to sometimes.

I’m not sure why your resolver started acting up but what you’re describing doesn’t sound like normal cause/effect. Four people on a residential connection, even if you throw in a ton of electronic devices and iot/crap that calls home constantly shouldn’t cause any kind of ISP engagement.

Not like it really matters, for 99.9% of people having a forwarder is easy and just fine and there isn’t good reason to troubleshoot it if there’s a working solution. I’m pretty privacy conscious and I don’t even think having my own forwarder is worth the hassle, I am just choosy about my upstream.

If pi hole is configured to use another DNS it will still forward your request, just not to your ISP DNS server. Essentially you’re providing your DNS requests to a 3rd party, for a slight boost to performance (because they’ll have tons of stuff cached and can do recursive queries faster if you’re requesting a site not in their cache.) Your web pages will load faster because you don’t have an SBC trying to manually figure out what’s the IP for bigfuckdaddyhairbrushemporium.net

The downside is you’re exposing your DNS queries to a 3rd party and it’s a bit of a privacy hit, as the upstream DNS server you select has your public IP correlated with your DNS requests. Doesn’t really matter to most, but it does for some.

Even if your ISP did have something in place to try and prevent abuse I find it unlikely it would trigger over normal traffic. Do you have a huge network/many hosts/exposed services?

You haven’t really given enough information about your config to diagnose.

If you’re able to access it from your local network but not your outside network it’s a port forwarding/firewall or routing issue. My guess is it’s a firewall issue either on your network edge (likely integrated into your router) or on your server that’s hosting immich.

Unless you do one of the following you won’t be able to access it from outside your network:

-set up a VPN and tunnel into your network. Wireguard or tailscale/zerotier will be easiest.

-set up port forwarding correctly. Not my first choice, best to VPN in rather than poke holes in your firewall, especially if you’re a noob.

-set up a reverse proxy. This is a bit more complicated than a VPN or overlay VPN (tail scale etc), but it works fine and will be secure as well.

If you haven’t done one of those three things then you won’t be able to access anything from outside your network, for good reason - your firewall is by default set up to deny connections that are initiated from outside your network, so when you’re trying to connect from the outside it looks at your traffic trying to start a connection to your server and naw dawg’s it.

Edit: just saw from another comment you’re not able to connect from your home Wi-Fi. If that’s the case, are you running a VPN on your phone? That can cause problems. Have you tried using the server’s local IP instead of your external IP? 192.168.x.x most likely. You can try to disable the server’s firewall and see if that lets you connect as well. Is your server on the same subnet as your phone? 192.168.1.x and 192.168.2.x won’t talk unless you set your router up correctly.

Just shooting in the dark here without more info

Edit2: if you’re running inmich in a container or VM your configs on that might not be set up correctly to allow you to reach it as well. It can be a lot of things but my money is on firewall/routing somewhere. Start by making sure you’re trying to connect to the local IP of the server, then try to disable server firewall (don’t forget to enable it again whether that solves it or not), and see if that works.