The recording doesn't stop when the link does.

Trailers get parked where the infrastructure isn't.

A surveillance trailer has no structured cabling, no server room and no second uplink. Kilo's architecture is a direct response to the three things that actually go wrong out there.

• The uplink fails first

  Answered by ADR-003

  Cellular and fixed-wireless links on remote sites are intermittent and bandwidth-constrained. Kilo keeps continuous video on local trailer storage and uses the network for identity, alerts and deliberate incident exports — never as the primary video path.

• Nobody should port-forward to a trailer

  Answered by ADR-002

  Remote viewing runs through a Cloudflare Tunnel that the trailer dials out to. No inbound port is opened, and the only service reachable through it is the Rust gateway. Frigate's own unauthenticated port is never published or routed.

• Cameras are the weakest device on site

  Answered by the camera network

  IP cameras run firmware you do not control. Kilo puts them on an isolated camera network with no route to the tunnel-facing side, using unique least-privilege accounts with vendor cloud and P2P features switched off.

One chain, two halves. Only one of them needs the internet.

Switch the link condition below. The camera-to-disk half of the chain is unchanged either way — that is the whole design.

What Kilo does today.

• Local disk

  Continuous recording

  Recording is enabled continuously and stored on trailer storage, not in a cloud video pipeline. The default profile keeps seven days of continuous footage and thirty days of event and alert clips.

  retain 7 d · alerts 30 d · snapshots 30 d

• Outbound only

  Remote access with no open ports

  A Cloudflare Tunnel is dialled out from the trailer. Nothing listens for inbound connections from the internet, and only the Rust gateway is routed. Locally, the gateway binds to loopback by default.

  cloudflared · gateway :8080

• Role mapping

  Authenticated, role-based viewing

  Operators sign in with a company account. The gateway reads the protected app_metadata.kilo_role claim and maps it to a Frigate role: full admin, read-only viewer, or a custom per-site role. Anything missing or malformed becomes viewer.

  admin · viewer · custom

• Network isolation

  Separated camera network

  Cameras sit on their own network with no route to the tunnel-facing side, on a dedicated VLAN with no general internet access. Frigate reaches them; the internet does not.

  internal network · dedicated VLAN

• Vendor neutral

  Standards-based cameras

  Kilo talks to standard ONVIF/RTSP cameras rather than a single vendor's ecosystem. Each camera is onboarded with a fixed lease, a unique least-privilege account, and separate main and substream URLs verified from the recorder host.

  ONVIF · RTSP · main + substream

• Opt-in acceleration

  VAAPI hardware decoding

  The base deployment mounts no devices at all. Hardware-accelerated decoding is available through an explicit overlay that adds only /dev/dri/renderD128 — no privileged mode, no host networking, no card0.

  overlay only · ADR-005

What an operator actually sees.

Kilo puts Frigate's console behind its own authentication. The video interface is Frigate 0.17.2; the identity, roles and transport are Kilo's.

• Live view Live streams served through Frigate's integrated go2rtc restreaming.
• Timeline playback Scrub recorded footage and jump to a moment inside the retention window.
• Snapshots Still captures kept for thirty days alongside the clip retention.
• Incident export Pull a specific clip off the trailer deliberately, instead of streaming everything off-site.

The gateway is the trust boundary.

Frigate is never exposed directly. Every request crosses a Rust service that verifies the session, decides the role, and rewrites the identity headers before anything reaches the video engine.

• Public surface

  Only the gateway is reachable. Frigate's internal unauthenticated port 5000 is never published or routed.

• Token verification

  Asymmetric ES256/RS256 signatures checked against the project JWKS, plus issuer, audience, expiry and required claims. Symmetric tokens are rejected outright.

• Authorization

  Read only from the protected app_metadata.kilo_role claim, which users cannot edit. User-editable metadata is never consulted; missing or malformed values fall back to read-only viewer.

• Sessions

  Tokens live in HTTP-only cookies with SameSite=Lax, marked Secure whenever the deployment is served over the tunnel.

• Header hygiene

  The caller's Authorization header is stripped. Identity is re-injected as X-Forwarded-User and X-Forwarded-Groups alongside a shared proxy secret that must be at least 64 characters — enforced at startup, so a weak secret prevents boot.

• Offline tolerance

  JWKS values are cached for ten minutes so already-issued sessions survive brief WAN interruptions.

• Container hardening

  Runs as non-root UID/GID 500 with the RuntimeDefault seccomp profile, all Linux capabilities dropped and privilege escalation disabled. No host networking, host ports, USB or privileged mode.

• Secrets

  Only schemas and examples are committed. Camera credentials, session keys and tunnel tokens are created out of band, so a repository clone is not enough to deploy or to read a camera.

• Recommended on site

  Full-disk encryption on the host and recording volume, MFA for administrators, short access-token lifetimes, and cameras on a VLAN with no general internet access.

Two shapes, one image set.

The same pinned components run as a Docker Compose stack on a trailer or as an isolated Kubernetes workload. Nothing about the deployment requires a control plane in the cloud.

Control-plane code is Rust-first (Rust 1.88 toolchain). Formatting, lint, test, Compose and manifest validation run from a single check script.

Where Kilo actually is.

Kilo is an early-stage product with a running demo, not a shipped fleet. Here is the honest state of it.

1. Ph 00

   Foundation

   Rust/Axum authentication gateway, Frigate 0.17.2 with go2rtc, Compose workflow, tunnel scaffold, security model and operations runbook.

   Complete
2. Ph 01

   Kubernetes demo

   Isolated namespace, pinned node, bounded resources, 50Gi volume, Traefik ingress, non-root hardened pod, optional VAAPI overlay, and readiness/liveness/startup probes.

   Complete
3. Ph 02

   Functional NVR pilot

   Real camera with separate record and detect streams, VAAPI enabled and benchmarked, and seven days of measured recording, storage growth, thermals and dropped frames.

   Planned
4. Ph 03

   Trailer operations

   Defined management and camera VLANs, encrypted recording media with SMART/NVMe health, UPS status and graceful shutdown, WAN-loss tests, per-trailer overlays, and alerts for camera offline, recording stopped, disk health and tunnel loss.

   Planned
5. Ph 04

   Fleet management

   Immutable versioned trailer releases, staged and canary upgrades with rollback verification, site-level roles and camera access boundaries, and retention plus legal-hold procedures.

   Planned