# Single-site deployment

The default deployment pattern. Most customers start here.

## Topology

`R+1`: 1 router + 1 Cell + N cameras + optional operator workstation.

```
                Internet (WAN)
                     │
                     ▼
                ┌──────────┐
                │  Blocao  │
                │  Router  │
                └────┬─────┘
            ┌────────┴────────────┐
            │                     │
       VLAN-10                VLAN-20
       Cameras (N)            Cell
       192.168.10/24          192.168.20.10
       │
       ├── cam-01 (PoE)
       ├── cam-02 (PoE)
       ├── cam-03 (WiFi 5GHz)
       └── cam-04 (...)
```

## Hardware shopping list (4-cam example)

| Item | Model | Notes |
|---|---|---|
| Router | GL.iNet GL-MT6000 | 4×2.5GbE LAN + 1×2.5GbE WAN, WiFi 6E |
| Cell | Banana Pi BPI-W3 + 1TB NVMe + 4TB HDD | RK3588 with 6 TOPS NPU |
| Cameras | 4× Reolink RLC-820A or equivalent | 4K, ONVIF, PoE |
| PoE switch | Mikrotik CSS610-8P-2S+IN | 8 PoE+ ports + 2 SFP+ |
| UPS | Any 600W+ | Cell + router for 30min |

Approximate hardware cost: €1,500-2,500 depending on cameras chosen.

## Install procedure

1. **Prep at office**:
   - Flash router with Blocao firmware (image from CI artifacts).
   - Verify Balena fleet has the Cell stack ready.
   - Pre-configure site ID and network parameters in the wizard if known.

2. **On site**:
   - Mount cameras, run cabling.
   - Connect: cameras → PoE switch → router LAN port (trunked VLAN), Cell → router LAN port, WAN cable to upstream router/modem.
   - Power on router first, then Cell, then cameras.

3. **First boot**:
   - From a laptop on VLAN-30 (or via Tailscale if pre-provisioned), open `http://blocao-router.local/`.
   - Wizard runs. Installer goes through 6 steps (~15 minutes).
   - Provisioning completes; redirects to SYNOPSIS.

4. **Camera onboarding**:
   - From CAMS panel, click ADD CAMERA.
   - Auto-discovery finds cameras in VLAN-10.
   - For each: authenticate, force password rotation, test stream, name, save.
   - Verify event flow in SYNOPSIS.

5. **Verification**:
   - HEALTH panel shows all green.
   - MQTT panel shows events flowing.
   - Walk in front of a camera, confirm event in MQTT live tail.

6. **Handover**:
   - Customer-side admin gets operator credentials.
   - Walk through FORENSICS panel with sample data.
   - Document case management workflow if applicable.

Estimated time on site: half a day for an experienced installer with prepped hardware.

## What customer sees

Day 1 after install: cameras recording, events being detected, console accessible from mgmt VLAN or via Tailscale.

Day 30: 30 days of footage retained, queries work across that range, evidence packs exportable for any case.

Day 90: typical first review meeting. Customer feedback informs config tweaks (zone definitions, retention overrides, model thresholds).

## Common gotchas

- **Camera vendor portal phone-home blocked**: cameras may show "cloud disconnected" in their own UI. This is intentional. Show the customer the DNS sinkhole stat for reassurance.
- **WiFi cameras drop**: 2.4GHz is congested, 5GHz has range issues. Use cabled cameras when possible; HaLow as the future option for distance.
- **WAN flaky**: hub bridge will queue events and reconnect. Customer doesn't need to do anything.
- **Wrong NTP**: chrony with NTS is the default. If a customer has a strict internal NTP server, configure it in the wizard step.
- **Operator forgets password**: recovery via console port on the router (physical access) or hub-side Keycloak admin reset.

## Limits of single-site

- One Cell ≈ 8-12 cameras at 1080p H.265 with full Frigate. Beyond that, scale to `R+2` (two Cells).
- Local storage limit: see [`../01-architecture/storage-retention.md`](../01-architecture/storage-retention.md).
- No cross-site queries (need hub).
- No central operator audit (need hub).

For single-site only, the customer doesn't need a hub subscription. Standalone mode (configured in wizard step 5) skips hub registration entirely.