Self-Hosted Security Guide

Should you keep your phone connected 24/7 for security camera alerts? A practical guide for self-hosted setups.

Running Frigate NVR behind a Cloudflare tunnel or WireGuard VPN and wondering whether to leave your mobile connected around the clock? You're not alone. The r/selfhosted community debates this constantly. This guide walks through the real tradeoffs of always-on mobile monitoring: bandwidth costs, battery drain, notification reliability, detection tuning, and the point where maintaining your own stack stops making sense.

20

At one Class C multifamily property in Fort Worth, Cyrano caught 20 incidents including a break-in attempt in the first month. Customer renewed after 30 days.

Fort Worth, TX property deployment

See Cyrano in action

1. The case for always-on mobile monitoring

If you're running Frigate NVR, you've already invested significant time building a self-hosted security camera stack. You have object detection running on a Coral TPU, cameras feeding RTSP streams into your server, and recordings landing on local storage. The missing piece for many people is reliable real-time access from their phone.

The common approaches for remote access break down into two categories. First, tunneling solutions like Cloudflare Tunnel or Tailscale Funnel that proxy traffic through a third party. Second, VPN solutions like WireGuard or Tailscale (in VPN mode) that create a direct encrypted path back to your home network. Both work. The question is whether you should leave these connections active 24/7 or only connect when you need to check in.

The argument for always-on is straightforward: security events don't wait. If someone is breaking into your garage at 3 AM, you want to know immediately. An always-on connection means your phone can receive live stream data and alert context the instant Frigate detects something. You see the detection frame, the bounding box, and the classified object type without any connection delay.

The argument against always-on is equally practical. A persistent tunnel or VPN connection consumes battery, uses cellular data, and creates a continuously open path to your home network. For most people, the right answer depends on how they've architected their notification pipeline and how much latency they can tolerate between detection and alert.

2. Bandwidth and battery: what constant connections actually cost

Let's talk numbers. A WireGuard tunnel with keepalive packets set to the default 25 seconds uses roughly 3 to 5 MB per day in overhead when idle. That's negligible on most data plans. Cloudflare Tunnel running through cloudflared on your server has zero overhead on your phone since it's a server-side tunnel; your phone just hits the public URL when needed.

Battery is the bigger concern. WireGuard is remarkably efficient because it operates at the kernel level on most platforms and only transmits keepalive packets when idle. Real-world testing shows 1 to 3% additional daily battery drain on modern iPhones and Android devices. Tailscale (which uses WireGuard under the hood) is similarly lightweight. OpenVPN, by contrast, can drain 5 to 10% daily because it runs in userspace and maintains a heavier connection state.

The bandwidth spike happens when you actually open a live stream. A single 1080p camera stream at a reasonable quality setting pulls 2 to 4 Mbps. If you have Frigate configured to serve sub-streams for mobile (which you should), that drops to 0.5 to 1 Mbps. Watching a live feed for 10 minutes on a sub-stream uses about 40 to 75 MB. Over cellular, this adds up quickly if you're checking cameras frequently.

The practical recommendation: use WireGuard or Tailscale for the persistent connection (low overhead, kernel-level efficiency) and configure Frigate to serve JSMPEG or MSE sub-streams for mobile viewing. Reserve full-resolution streams for reviewing recordings on Wi-Fi. This combination keeps always-on viable without destroying your battery or data plan.

Make your existing cameras smarter without replacing them

Cyrano connects to any DVR or NVR via HDMI and adds AI-powered detection and alerting. No camera swaps, no network reconfiguration. Works alongside self-hosted setups or as a standalone solution.

Book a Demo

3. Tuning detection zones and alert thresholds

Always-on monitoring is only useful if your alerts are meaningful. The number one complaint in every Frigate thread is alert fatigue: getting woken up at 2 AM because a raccoon walked through the detection zone or a car's headlights triggered a false positive. Tuning your detection pipeline is essential before you commit to 24/7 mobile notifications.

Start with detection zones. In Frigate, you define zones as polygons overlaid on each camera's view. The key principle is to make zones as small as possible while still covering the areas you care about. Don't set a zone that covers your entire front yard; set one that covers the walkway to your door and another that covers the driveway. This immediately eliminates detections from the sidewalk, the street, and the neighbor's property.

Next, configure object filters. Frigate's object detection model classifies detections as person, car, dog, cat, and other types. For security purposes, you probably only want notifications for "person" detections in sensitive zones. Set minimum score thresholds (0.7 or higher works well for most setups) and minimum object size to filter out distant or ambiguous detections. You can also set "required zones" so that a person must be detected within a specific zone (not just anywhere in the frame) before an alert fires.

Time-based filtering adds another layer. Most legitimate activity happens during predictable hours. Set quiet hours where only high-confidence detections in critical zones trigger notifications. During daytime, you might accept lower thresholds. After midnight, restrict alerts to the zones closest to entry points with higher confidence requirements.

Finally, use Frigate's snapshot and clip review workflow. Spend 15 minutes each week reviewing false positives and adjusting your zones and thresholds accordingly. After two to three weeks of tuning, most setups achieve a false positive rate low enough that every notification is worth checking.

4. Notification reliability: push vs persistent connections

This is where the "should I stay connected 24/7" question gets nuanced. There are two fundamentally different architectures for getting alerts to your phone, and they have very different reliability characteristics.

Push notificationsuse a relay service (APNS for iOS, FCM for Android) to deliver a message to your phone without any persistent connection. Frigate can send notifications through MQTT to Home Assistant, which then dispatches push notifications via the Home Assistant Companion app. Alternatively, you can use Ntfy, Pushover, or Gotify as standalone notification relays. The advantage: your phone doesn't need a VPN or tunnel active. The disadvantage: push notifications pass through third-party infrastructure (Apple, Google, or your chosen relay), they can be delayed by 1 to 30 seconds depending on conditions, and aggressive battery optimization on Android can suppress them entirely.

Persistent connectionskeep your phone directly connected to your home network. When Frigate detects an event, the app (whether it's the Frigate web UI in a browser, Home Assistant, or a custom solution) receives the event in real time over the tunnel. Latency is typically under 1 second. The disadvantage: you need the VPN or tunnel running, and if the connection drops (which happens with cellular handoffs, Wi-Fi transitions, and sleep mode), you have a blind spot until it reconnects.

The most reliable setup combines both. Use push notifications as the primary alert mechanism (they work regardless of VPN state) and keep the persistent connection available for instant live view access when you receive an alert. This way, you get the notification through Ntfy or the HA Companion app, tap it, and the VPN is already connected so you can immediately pull up the live feed and recording.

For anyone considering a managed alternative, services like Cyrano handle the entire notification pipeline out of the box. The device connects to your existing DVR/NVR, runs detection locally, and pushes alerts with screenshots directly to your phone through a managed cloud relay. No MQTT broker configuration, no Home Assistant dependency, no push notification debugging. It's a different philosophy: trade the control of self-hosting for reliability you don't have to maintain.

5. Self-hosted vs managed monitoring: when DIY makes sense

The self-hosted security camera community exists because commercial systems have historically been expensive, cloud-dependent, and limited. Frigate, with a Coral TPU and a decent server, delivers object detection quality that rivals or exceeds what Ring and Nest offer, with complete local control over your footage. That's a genuine achievement.

But there's a maintenance cost that's easy to underestimate. A full self-hosted monitoring stack includes: the cameras, the NVR or Frigate server, a Coral TPU, a reverse proxy or VPN for remote access, an MQTT broker, Home Assistant or another automation platform, a notification relay, and storage management for recordings. Each component needs updates, monitoring, and occasional troubleshooting. When your Frigate container crashes at 2 AM because a Docker update broke the Coral USB passthrough, your "security system" is down until you fix it.

Self-hosted makes the most sense when you enjoy the tinkering, have the skills to debug issues quickly, and treat the project as a hobby that also provides security value. It also makes sense when privacy is a hard requirement and you cannot accept any footage leaving your network.

Managed monitoring makes sense when reliability is the top priority. If you're securing a property where downtime has real consequences (a business, a rental property, or a home in a high-crime area), the calculus shifts. Solutions like Cyrano sit in an interesting middle ground here: the device plugs into your existing DVR via HDMI, so your footage stays local and your camera infrastructure doesn't change. But the detection, alerting, and notification pipeline is handled by the device and its managed cloud backend. You get local processing with managed reliability.

The honest answer for most r/selfhosted users: run Frigate for the learning experience and the control it provides. Set up push notifications through Ntfy or the HA Companion app. Keep WireGuard running for instant live view access. Spend the time to properly tune your detection zones. And if you reach a point where maintaining the stack feels like a second job rather than a hobby, know that managed options exist that work with the cameras and DVR you already own.

Want reliable camera alerts without maintaining the stack?

Cyrano plugs into your existing DVR or NVR and handles detection, alerting, and notifications out of the box. 15-minute setup, no camera replacement required.

Book a Demo

$450 one-time hardware. $200/month starting month 2.