Features
Everything in one tool: customers, sites, people, scripts, guides, deployment, backups and an audit trail.
Wizard and command line
- Guided menus for every task, with the next step starred
- Every action also available as a command
- Built-in configuration check before you deploy
Customer server (VPS)
- WireGuard hub on a small KVM Debian or Ubuntu server
- Default-deny nftables firewall
- SSH mode: public, allow-list only, or tunnel only
- Safe to re-run: keys are kept, changes applied live
Site box
- Debian 12 or 13 on a ThinkCentre or any two-port x86-64 PC
- Detects uplink and camera port automatically
- DHCP for cameras in the .100 to .199 range
- Fixed or DHCP uplink address per site
Network isolation
- Cameras get no gateway, no DNS and no internet
- Only the tunnel may reach the camera network
- Admin SSH accepted only from the admin range
- Separate address ranges for boxes, viewers and admins
Self-healing tunnel
- Watchdog re-resolves the server name every 30 seconds
- Move a customer to a new VPS with one DNS change
- Tunnel returns after reboot, power cut or router loss
Teams and roles
- Viewer, operator and admin roles
- Assign operators to specific customers
- Account lock after 5 wrong passwords
- The last active admin cannot be removed
Secrets vault
- Encrypted with a master key kept outside the database
- Store a deployment SSH key once, use it for deploys
- Secret values never appear in the log or generated files
Audit log
- Hash-chained, tamper-evident history
- Records who did what, and to which customer
- Admin-only access
Backup and restore
- Daily encrypted server backup at 03:15, keeping 14
- Optional copy to a remote target
- One command backs up the whole build database
- Restore on a new build server
Guides written for you
- Technical setup guide for your staff
- Recovery guide for every customer
- Hand-over guide for the customer
- Printable box build record
People and access
- Viewers and admins join with a WireGuard public key
- Paste a full client config and the tool keeps only the public key
- Add or remove a person with one command
Hands-off reliability
- Starts automatically after a power loss
- Automatic security updates and reboot window
- USB Ethernet adapters kept out of power saving
Role overview
Give each person only what they need.
| Role | May do |
|---|---|
| Viewer | Read the customers assigned to them. |
| Operator | Add and change assigned customers, sites and people; generate scripts and deploy. A customer an operator creates is assigned to them automatically. |
| Admin | Everything: company settings, users, secrets, backup and restore, activity log and removing customers. |
What you get for every customer
One generate command writes the complete set of files into an output folder.
| File | Use |
|---|---|
deploy-<customer>.sh | Run on the customer’s VPS |
box-<customer>-<site>.sh | Run on the box at the site |
peers.txt | List of boxes and people |
GUIDE.md | Technical setup guide for your staff |
RECOVERY.md | Disaster recovery steps |
CUSTOMER-GUIDE.md | Hand-over guide for the customer |
Take control of your camera networks
One payment of €40. One year of updates included.
Buy now – €40 See what’s included