Buchanan Ranch · security · plan v1 · 2026-09-23

The Protect Cutover

Moving the property's cameras and doorbells off Google/Nest cloud onto UniFi Protect, recorded locally, on a camera network that cannot reach the internet. Everything below is built from what has actually been ordered — not the earlier spec.

10UniFi cameras when done (9 arriving + Pool 180 live)

3G6 Pro Entry readers replace the 3 Nest doorbells

12Nest cameras retired, one at a time

UDM ProProtect host until the back-ordered NVR arrives

VLAN 30Cameras network — live 23 Sept; Pool 180 on it

What's arriving

Four UniFi orders plus the ADU rack order on Amazon. Item counts on each order screen add up, so this is the complete list.

Where each camera goes

Your placement (23 Sept), which replaces the earlier nine-site plan. Every camera is wired to a PoE switch except the culvert, which has power but no data path and gets a wireless bridge. PoE is not a constraint anywhere: G6 Bullet draws 9.9 W, Turret 12.5 W, 180 15 W. The electrician's version of this table, with cable spec and mounting standards, is on the Camera Wiring Plan page.

That uses every camera bought: 3× 180, 5× Bullet, 1× Turret. Nothing is spare. Owner decision 2026-09-28: the drain box at the culvert now holds two devices — the base UDB you already own, giving the box its wireless uplink, and a USW-Lite-8-PoE switch (52 W budget), which powers and switches both C09 and C01 (fed by the new fence run). Both units are indoor-rated, so both live in a vented weatherproof box, now sized for both plus the switch's power brick, not just the UDB. The wireless signal from Garage 3 measured −74 dBm on the last walk — marginal, and now carrying two camera streams instead of one; do a WiFiman walk at the post before mounting, and if it stays below about −70 dBm the fix is a small outdoor AP on the near side, not a different bridge.

Rule that never bends: a Nest camera comes down only after its UniFi replacement has recorded a real event overnight and shows correctly on the phone, the kiosks and the Family Room TV.

Doorbells → G6 Pro Entry readers

Verified live today: the G6 Pro Entry runs on UniFi Protect alone. Ring-to-chime, two-way talk and recording all work with no UniFi Access hub — Access is only needed for NFC/Face unlock, which this house doesn't do (no smart lock, standing decision). Each reader is PoE+ at 18 W max. The two WiFi Smart Chimes pair to them in the Protect mobile app and plug into a wall outlet.

All three readers wire to the ADU closet (owner, 23 Sept) — matching the three "entry" ports already reserved on that closet's wall panel. 54 W of the 24-PoE's 95 W budget.

The DoorBird at the gate stays. It is the only unit with the gate relay and the 2-wire long run; nothing you bought replaces it.

Network security — the UniFi side

This is the part that makes the whole thing safer than Nest rather than just cheaper. Cameras go on their own network that cannot reach the internet or the rest of the house; only the Protect host and Home Assistant can reach them.

1 · Put the Cameras VLAN into service

VLAN 30 (192.168.30.0/24) was created on the UDM Pro on 17 June with the firewall designed, but no device has ever been moved onto it — every camera today, including the Pool 180 and the DoorBird, sits flat on VLAN 1 with the phones and TVs. This is the first change, done before any new camera is mounted, so new cameras land on the right network from their first boot.

Addressing

.10–.49 UniFi Protect cameras and readers · .50–.59 DoorBird · .100–.254 DHCP pool for adoption

Firewall

Cameras → Internet block · Cameras → every other VLAN block · allow only Home Assistant (192.168.0.11) and the Protect host into Cameras · established/related back out. mDNS stays off on VLAN 30.

Mechanism

A "Cameras" switch-port profile applied per port. A camera plugged into a Cameras port gets VLAN 30 with no config on the camera itself. Wireless bridges (Drain) carry the tag across.

Protect host

The UDM Pro is the gateway, so it reaches VLAN 30 natively. When the NVR arrives it goes on VLAN 30 too (or VLAN 1 with an allow rule) — decided at migration.

Who else needs reach

Verified from live sockets 23 Sept: Scrypted (.19) talks only to the UDM Pro's Protect — needs nothing. go2rtc (.16) pulls the DoorBird directly by IP (RTSP :554) — one allow rule .16 → DoorBird. And the DoorBird pushes ring/motion events to HA (.11:8123) — one allow rule DoorBird → HA. The design doc missed both; the plan adds them.

2 · Protect host: UDM Pro now, NVR later

Everything adopts onto the UDM Pro's Protect today (SkyHawk #1 is already in it). The plain UNVR takes 18 4K cameras, the UDM Pro's own limit was never confirmed from a primary page — at 10 cameras + 3 readers you are within any published figure, but this is flagged as assumed.

When the NVR arrives, the supported path is Protect backup on the UDM Pro → restore onto the NVR. Cameras re-attach on their own; footage does not carry over (the UDM Pro keeps it viewable read-only), the DoorBird needs a manual 10-minute re-adopt, and HA's Protect integration plus every RTSPS stream URL re-point to the new host. That's a half-day with the cameras briefly dark — a planned cutover, not a surprise. Both SkyHawks go into the NVR then (no RAID: standing decision, footage is replaceable).

3 · Accounts and access

• 2FA on the ui.com owner account — it is the remote path to the network and now to every camera. Verify it's on; if not, that's a five-minute gate.
• Home Assistant gets its own local Protect user with view + camera-control rights only, never the owner login. The existing HA integration user is re-checked against that.
• Kiosks never hold camera credentials. They view through the control site (go2rtc/Scrypted), same as today. Nothing changes on the tablets.
• Remote viewing: the Protect app rides the same ui.com remote access the network app already uses; on Tailscale (P4) it also works direct to the UDM Pro. No port forwards, no UPnP — both stay off and get checked.
• Firmware: camera and Protect updates run through the existing upgrade-check contract (reported, then applied when you say), not Ubiquiti's auto-update — a bad camera firmware would otherwise roll across 13 devices overnight.
• Stolen-camera test: an outdoor camera port is physically reachable. On VLAN 30 that port yields nothing — no internet, no route to the house, only inbound from HA/Protect. This is the reason to do step 1 before the cameras go up, not after.
• Cabling: all 16 ADU runs are shielded Cat6A (already bought); ground the shield at the rack end only.

Recording policy

Continuous-vs-Detections was left open in the earlier plan. Detections is the recommendation and the default here; say so if you want continuous on the gate or driveway.

Storage is its own plan

The UNAS 2 → UNAS Pro 8 move (four 24 TB drives, the UNAS 2 reborn as backup target) runs on its own track and its own page: The NAS Cutover. The only crossover with cameras is the rack: both wait on the ADU rack build.

Retiring the Nest cameras

Twelve Nest cameras today, all Wi-Fi, all cloud. None comes down until its replacement passes the overnight test above. Swap order follows the wiring order, so the gate and garage cameras retire first.

What changes in the house software as they go

• Doorbell → kiosk pop-up is wired to the three Nest doorbells by name today; it gets rewired to the readers' ring event so the tablets still show the door.
• "Someone at the Door" stays announce + live image only (no lock actions, ever).
• TV casting improves: Nest cams could never cast; Protect cameras cast to the Family Room TV today (gate and pool already proven). Every replacement gains this.
• Control site: the /cameras (Nest) page and the /security (Protect) page merge once the last Nest goes; until then both stay, exactly as they are.
• Home Assistant: the Nest integration is removed last, after the Drain is covered. The retired Nest cams are factory-reset before they leave the house. The driveway-Nest Wi-Fi re-setup task on the punch list is dropped — those two retire early.
• Notifications: all Telegram alerts stay off (standing instruction). Protect's own push notifications on your phone are the door-ring path.

Build order

you hands-on · claude keyboard · GATE stops until you say go.

1. claudeCameras VLAN goes live DONE 23 Sept

   Cameras firewall zone + 11 rules, port profile, reservation; Pool 180 moved to 192.168.30.10 and verified by name (Protect recorded a new event 100 s after the move; tiles, HA, gate feed, neighbours all checked). Open: per-network mDNS can't be set on this controller (site-wide setting — your call), and the HA→camera allow rule needs a sharper test. DoorBird and the new cameras follow later, each as its own change.

2. claudeFix "Switch Gate" GATE · may need a power-cycle at the gate

   The gate switch has been invisible to the controller since about 13 Sept. Diagnose from the hub first (bridge link, adoption state); if it needs a physical power-cycle, that's you at the gate enclosure. Prerequisite for the two gate camera runs and for the DoorBird move.

3. claudeAccounts pass

   2FA state on the ui.com account reported to you; HA's Protect user checked and scoped; UPnP and port-forward audit on the UDM Pro; Protect firmware auto-update turned off. Nothing here needs you unless 2FA is off.

4. youADU rack build per the ADU page

   Rack arrives Saturday. Both USW-24-PoE switches go in per that page's steps 4–6 (owner decision 2026-09-28: the Pro Max 16 goes to Garage 1, not this rack). claude adopts both switches, applies the port profiles (three "entry" ports set to Cameras), and confirms the uplink.

5. youElectrician wires and mounts per the Camera Wiring Plan: Garage 3 → Gate → Garage 1 → drain box → dog run

   Every run labelled at both ends, terminated, and tested end to end with the result sent to you before it counts as done (the wiring plan's "label, terminate, test" box). Each run lands on a Cameras port, camera mounted and plugged in. claude adopts each camera as it appears, names it, sets recording and detections, checks the stream on phone/kiosk/TV, and tells you when its Nest can come down. Garage 1 needs the Pro Max 16 installed and its uplink confirmed first; the dog run (C01) needs the drain box's Lite 8 installed and its outdoor fence run pulled first.

6. youReaders on the three doors + chimes plugged in

   All three runs land on the ADU rack.claude adopts the readers in Protect, pairs the chimes, rewires the kiosk pop-up and the door script, then retires the three Nest doorbells.

7. claudeCoverage check, then the Nest integration comes out

   Walk each retired Nest's old view against the new cameras; anything uncovered (Entryway, Front Yard) is named before its Nest is unplugged. Nest integration removed from HA last; cameras factory-reset.

8. youDrain box: UDB, Lite 8 switch, and both cameras

   WiFiman walk at the post first; electrician adds the GFCI outlet and the up-sized enclosure (owner decision 2026-09-28: it now has to fit the UDB, the USW-Lite-8-PoE switch and its power brick); UDB, Lite 8, and the C09 bullet go in, then the outdoor fence run to C01 lands on the same switch. claude adopts the bridge, the switch, and both cameras, checks the wireless link holds overnight under both streams, then retires the Nest Drain and the Nest Side Gate (if it's the same gate as C01).

9. claudeNVR arrival: migration day GATE · pick a quiet day

   Protect backup → restore to the NVR, both SkyHawks installed, DoorBird re-adopted, HA and stream URLs re-pointed, everything re-verified by name. Old footage stays on the UDM Pro read-only until you're done with it.

Your decisions

1. Second USW-Lite-8-PoE ($109), was for the Primary Suite closet — owner to confirm: cancel? Superseded 28 Sept: C01 now lands at the drain box instead, over an outdoor fence run, so this order (and the port-18 trunk change it needed) may no longer be needed. Not cancelled here — your call.
2. Culvert / drain box enclosure: the vented NEMA 3R box already planned for the UDB now also needs to fit the USW-Lite-8-PoE switch (99.6 × 163.7 × 31.7 mm) and its power brick — size it up before ordering.
3. Continuous or Detections on the gate and driveway? Default is Detections everywhere.
4. Where is SkyHawk #2? It was bought 29 Aug; only #1 is confirmed installed.
5. NVR: UNVR G2 is the assumption; the plain UNVR ($299, 18 cameras) is in stock now if you'd rather not wait.
6. SuperLink Gateway: notify-me at store.ui.com so the six sensors aren't shelf stock for months.
7. Remote viewing: keep ui.com remote access as the camera path from your phone (already how the network app works), or Tailscale-only once the phones are on it (P4)?

Verified vs assumed