Ultra Low-Latency WebRTC Surveillance & NVR Architecture

Eliminating 3-10s Latency Bottlenecks: Standard HLS and RTSP-over-HTTP introduce severe segment buffering latencies (3,000ms to 10,000ms), making real-time situational response impossible during perimeter breaches.

WebRTC PeerConnection Gateway: Eye connects directly to go2rtc via WebSocket signaling, establishing an ultra-low latency WebRTC RTP stream directly into an HTML5 <video> element with sub-500ms glass-to-glass latency.

Intelligent Stream Fallbacks: If WebRTC UDP candidates are blocked by restrictive enterprise NATs/firewalls, the player dynamically degrades gracefully to MSE (Media Source Extensions) and HLS without dropping the session.

Sub-Stream Adaptive Scaling: In multi-camera matrix views (3x3, 4x4), client bandwidth is preserved by pulling low-bitrate D1 sub-streams, automatically upgrading to 4K Main Streams when a camera is focused in Spotlight mode.

Rolling Segment Ring Buffer: Video streams are continuously segmented into 10-second MPEG-TS chunks stored in a 12-hour FIFO ring buffer on local NVMe/SSD storage, automatically pruned to prevent disk saturation.

Dynamic M3U8 Manifest Generation: Rather than relying on a static HLS file, our API dynamically stitches contiguous .ts chunks into an on-the-fly HLS playlist enriched with #EXT-X-PROGRAM-DATE-TIME tags.

Discontinuity-Aware Timeline Seeking: When network or power drops cause gaps between recording chunks, the manifest synthesizer inserts #EXT-X-DISCONTINUITY tags, allowing seamless timeline scrubbing across disconnected segments.

Direct Range-Request Streaming: Segment requests (/api/recordings/[filename]) support RFC 7233 byte-range headers (HTTP 206 Partial Content), enabling sub-second random seeking on iOS Safari and mobile browsers.

Zero-GPU Frame Differencing: Background motion detection analyzes frame-to-frame pixel luminance variance without requiring heavy neural network hardware, ensuring high-density multi-camera monitoring on low-power Intel NUCs or Raspberry Pi 5s.

Configurable Sensitivity & Cooldowns: Avoids false alarms from swaying foliage or lighting changes through configurable motion thresholds, min-trigger area percentages, and event debounce timers.

Automated MP4 Transcoding & Snapshot Extraction: When motion exceeds the trigger threshold, the system immediately captures a high-resolution JPEG keyframe snapshot and stitches pre/post buffer chunks into an MP4 clip.

Database Event Indexing: Events are recorded to SQLite with metadata, duration, camera source, and thumbnail URLs for rapid search, filtering, and 1-click incident review.

Native-Grade Mobile Alerting: Leveraging standard W3C Web Push and Service Worker PushManager APIs, security alerts are delivered directly to lock screens on iOS 16.4+ (installed PWA) and Android devices.

VAPID Key Security & Payload Encryption: Push payloads are end-to-end encrypted with ECDSA P-256 keys, ensuring camera snapshots and alarm descriptions cannot be intercepted by intermediate push relay servers.

Rich Notification Payloads: Push notifications include the camera name, exact timestamp, and an interactive snapshot image that directly opens the focused camera playback view when tapped.

Automated Subscription Pruning: Subscriptions that return HTTP 410 Gone or 404 Not Found from Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) are automatically pruned from the database.

Zero External Database Setup: By packaging SQLite inside (file:./data/eye.db), Eye eliminates the overhead of managing PostgreSQL or MySQL clusters for residential and small-business security setups.

Prisma ORM Portability: Database models (Users, MotionEvents, PushSubscriptions, SystemSettings) are strictly typed with Prisma, enabling 1-line schema migrations and seamless switching to PostgreSQL if desired.

WAL Mode Performance: SQLite is configured with Write-Ahead Logging (WAL) and synchronous=NORMAL, enabling concurrent high-speed event writes during intense multi-camera motion spikes without locking read queries.

Automatic Seeding & Default Credentials: Fresh deployments automatically seed the default admin account and default camera stream profiles on initial container start.

HMAC-SHA256 Ephemeral Stream Tokens: Video streams are protected by time-limited, cryptographic tokens verified on every WebSocket handshake and HLS chunk request, preventing unauthorized link sharing.

Granular Camera ACLs: Multi-user Role-Based Access Control (RBAC) allows administrators to assign specific camera feeds to distinct users while restricting access to administrative settings.

One-Touch Privacy Mode: Instantly cuts all external video streams to guest and viewer accounts with a single toggle in the dashboard, ensuring privacy for residential occupants.

Self-Contained Docker Architecture: Packaged as a lightweight multi-stage Docker container containing Next.js 16, go2rtc, ffmpeg, and SQLite for 1-command reproducible deployment.