Private · From Richard · For Ron
My recommended setup for your cameras
Ron — this is me talking to you, not a tech manual written for someone else. You need to see the building while you’re in Puerto Rico. You do not need the Mac mini to be the only way in.
Bottom line — how I would set you up
If it were my building and I was leaving for Puerto Rico, I would configure it this way:
- DVR/NVR connected straight to the building router, recording locally to its own hard drive.
- Manufacturer phone app as your normal, everyday way to watch live cameras and playback while you are away.
- Tailscale on your phone and the Mac mini as a private backup / support network — not your daily camera app.
- Remote desktop on the Mac so I (or another trusted tech) can help you without teaching you SSH.
- No secondary Mac camera software unless we confirm the exact system supports ONVIF/RTSP and we have a real reason to duplicate the recorder.
- A direct path and a local restart plan that keep working even if the Mac dies.
If the Mac mini dies, the manufacturer’s app should still work.
If the manufacturer’s cloud has a bad day, Tailscale may give us a second private route to the recorder — if we set that up right.
Visual: how the pieces connect
Keep this picture in your head. Cameras feed the recorder first. The phone is the destination. The Mac is optional help — not the only bridge.
Building → you in Puerto Rico
records locally
Three paths from here
Primary
cloud / app
in Puerto Rico
Backup
private access
in Puerto Rico
Optional
at building
or secondary software
Primary = what you use every day. Backup = private door if we need it. Optional = so I can help without standing in the building.
You should have two independent ways in
I do not want one piece of gear to be a single point of failure.
Live view, playback, alerts — the normal way you use it every day.
Private path onto the LAN if the cloud side of the manufacturer is flaky — when we configure it properly.
So I can support you. Not your main camera remote control.
Option 1 — Use the system exactly as designed
This is probably the best answer for a nontechnical owner. I would start here.
Most complete DVR/NVR packages sold through places like Best Buy are designed to:
- Record locally to their installed hard drive
- Connect directly to the building router
- Provide an iPhone / Android app
- Show live cameras remotely
- Play recorded footage remotely
- Send motion or person alerts
- Avoid requiring a computer to remain running
Common brands and apps
The actual recorder label and manual must be checked. Different generations from the same manufacturer sometimes use different apps.
| System brand | Typical mobile ecosystem |
|---|---|
| Swann | Swann Security |
| Lorex | Lorex or Lorex Cloud (depends on recorder) |
| Night Owl | Night Owl Protect or model-specific app |
| Reolink | Reolink |
| Defender | Defender app for that product family |
| Arlo / Ring / Eufy | Their own cloud-oriented applications |
Typical direct setup (do this before Puerto Rico)
- Connect the DVR/NVR to the router with Ethernet.
- Connect a monitor and mouse directly to the recorder.
- Create a new administrator password — no defaults.
- Install all current recorder firmware.
- Enable the manufacturer’s remote / mobile service.
- Install the correct manufacturer app on your phone.
- Scan the QR code on the recorder (or enter its device ID).
- Test live view and recorded playback while the phone is on cellular — not the building Wi‑Fi.
- Give the recorder a DHCP reservation in the router.
- Put the recorder, router, modem/ONT, and network switch on a UPS battery backup.
That cellular test is non-negotiable before you leave.
If it only works on building Wi‑Fi, it is not really remote access yet.
Advantages
- Simplest everyday experience
- Mac mini is not required
- DVR keeps recording if the Internet fails
- Usually no port forwarding
- Alerts and playback in one app
Disadvantages
- Remote access may depend on the manufacturer’s cloud/relay
- Older or budget recorders can have weak apps
- Some systems lock you to proprietary cameras
- Support and app quality vary by brand
Option 2 — Tailscale as a private backup doorway
Tailscale can securely put your phone onto the building’s private network without hanging the DVR on the open Internet.
Important: installing Tailscale on the phone and Mac does not automatically make the DVR available.
The Mac has to be set up as a subnet router so traffic can reach ordinary devices on the building LAN. That means advertising the building subnet (for example 192.168.1.0/24) and approving that route in the Tailscale admin panel. That is a real configuration step — not a checkbox in the phone app alone.
Tailscale’s current macOS client wants a modern Mac OS (Monterey 12 or later for the current client path). We install from their package, not a random third-party link.
What this can give you from Puerto Rico
- Turn on Tailscale on your phone
- Reach the DVR’s private address (example:
192.168.1.50) - Open the recorder’s local web interface — if it has a usable mobile-friendly page
- Sometimes use a manufacturer app that allows entering a local IP
- Reach other authorized building equipment
- Reach the Mac mini privately for administration
Hard limitation
Tailscale cannot invent a camera interface that does not exist. The recorder still needs at least one of:
- A usable web interface
- A client app that can talk to a local IP
- RTSP streams
- ONVIF services
- A manufacturer desktop client that runs on the Mac
Some older recorders still want Windows software or ancient plug-ins. An iPhone on Tailscale will not magically fix that.
Tailscale failure problem
If the Mac mini is the only subnet router and it powers off, freezes, loses Ethernet, logs out badly, fails after an update, or does not reboot clean after an outage — the Tailscale route disappears.
That does not stop the DVR from recording locally, and it does not break the manufacturer app if that path was set up correctly on its own.
Stronger Tailscale design (later, if we care)
Instead of relying only on the Mac, Tailscale can sometimes run on a compatible router, a small Linux box, a NAS, an Apple TV as subnet router, or two routers for high availability. That is better resilience — and more networking work. We only go there if we decide the private path is critical enough.
Option 3 — Use the Mac only for remote technical support
This is a smart use of the Mac mini even if it never records a single camera.
Install Tailscale on it, then pick one controlled remote-access method:
- macOS Screen Sharing over Tailscale
- Apple Remote Management
- Chrome Remote Desktop
- AnyDesk, Splashtop, or TeamViewer
Apple’s built-in Screen Sharing and Remote Management cannot both be “the active mode” the same way at once — we pick the clean setup and stick to it. Chrome Remote Desktop is simple and works from phones and tablets too.
That lets me (or another trusted person):
- Open the camera manufacturer’s Mac application
- Check whether cameras are online
- Adjust recorder or router settings
- Download footage
- Restart apps
- Troubleshoot the building network
Sensible use of the Mac. Still not the sole viewing route for you.
Option 4 — Turn the Mac into a second NVR
Only makes sense if the cameras or recorder expose ONVIF or RTSP streams.
SecuritySpy
Strongest Mac-native NVR I have looked at — recording, motion, remote viewing, mobile apps. Pricing is by camera count; there is a trial. Compatibility is the real gate: ONVIF is good, many Lorex ONVIF cams work, many Swann units are proprietary and will not, Reolink varies, battery/cloud-locked cams are usually poor fits.
Agent DVR
Runs on Mac, Windows, Linux, Docker, Pi. Flexible, free for basic local use; remote/mobile/cloud/business features are paid. More power — more maintenance.
Other software you should still look at
I am not claiming this is the entire universe of software.
There are other products and stacks out there. After we know your exact recorder and camera models, I want you (and me) to look at all reasonable options, not just the first two names that show up in a search. That list may include:
- Xeoma — cross-platform, Mac support
- Scrypted — advanced smart-home / HomeKit style integrations (more technical)
- Home Assistant — great for dashboards and automation; not automatically a full commercial NVR
- Frigate — powerful local detection; usually happier on Linux/Docker with a technical admin
- VLC — fine to test an RTSP stream; not a building security system
- The manufacturer’s own desktop client — often the easiest Mac option if they ship one
- Anything else the hardware manuals point to, or that supports your exact ONVIF/RTSP models cleanly
We pick software after we know the gear — not before.
Why duplicating the NVR is often unnecessary
If the recorder you bought already records all channels, manages storage, handles motion, does playback, sends alerts, and has a usable app — rebuilding all of that on the Mac adds another database, disk, app, set of passwords, and machine that must stay healthy.
A second NVR is worth it when you specifically want a second independent copy of footage, better detection, multi-brand unified view, HomeKit-style automation, a custom building dashboard, longer retention than the box allows, or off-recorder evidence backup.
Option 5 — Remote-control the Mac and watch the DVR through it
Workable. Inelegant.
- Mac runs the recorder’s viewing software
- You remote-control the Mac from your phone
- You watch cameras through that remote desktop session
Treat this as emergency or support — not daily life. Phone controls are awkward, video can be choppy, and both the Mac and the remote-desktop service have to be healthy.
How you connect if the Mac fails
We write this down before you leave.
1. Direct manufacturer route
- Correct phone application installed
- Recorder account / device ID saved
- Remote live view tested on cellular
- Recorded playback tested on cellular
- Notifications tested
- Recovery email + multifactor authentication set
- Manufacturer support number + recorder serial number written down
2. Local emergency route
A trusted person at the building should be able to:
- View the recorder on its directly attached monitor
- Use its mouse
- Restart the DVR/NVR
- Restart the modem/router
- Check UPS status
- Follow short written instructions (we leave those on-site)
3. Independent private route
If private LAN access really matters, put Tailscale on a compatible router or a second always-on device so the Mac is not the only doorway.
Physical resilience
- DVR/NVR, router, switch, and modem on UPS
- Mac mini on UPS if we keep it
- Ethernet over Wi‑Fi wherever possible
- DHCP reservations for the recorder (and cameras if fixed IPs matter)
- Router and recorder set to recover after power loss
- Adequate ventilation
- Trusted local contact with a key
- Optional smart power strip only if it is secure and has a safe restart procedure
Security rules I would follow on your system
- Do not expose DVR web, RTSP, SSH, VNC, or remote-desktop ports directly to the Internet
- Avoid manual port forwarding unless a qualified installer has a real reason
- Disable router UPnP if you do not need it
- Replace every default password
- Separate accounts per person when the system allows it
- Multifactor authentication on manufacturer, Apple, Google, remote-access, and Tailscale accounts
- Update firmware before you rely on it
- Do not reuse the building Wi‑Fi password as the DVR password
- Ideally put cameras and the DVR on a separated camera network / VLAN
- Keep a written inventory: camera addresses, recorder address, serial numbers, apps, account ownership
- Never depend only on motion alerts — confirm continuous or scheduled recording is actually on
- Verify clock, time zone, and automatic time sync on the recorder
If the Mac stays at the building unattended
- Wired Ethernet
- Disable automatic sleep
- Enable automatic startup after power failure
- Install updates before departure; avoid surprise major upgrades while you are gone
- Verify Tailscale starts automatically
- Verify any support software starts automatically
- Separate admin account for technical support
- Test full shutdown and power restore
- Test access with no monitor attached
- Think carefully about FileVault — after some restarts it can block unattended services until someone logs in locally
- Keep it on a UPS
- Do not open public SSH or public Screen Sharing on the router
What I need from you before we buy more software
Send me clear photographs of:
- Front and back of the DVR/NVR
- Its model-number label
- One camera’s model-number label
- The router model
- The recorder’s Network or Mobile App screen (cover QR codes and passwords before you send)
With those photos I can stop talking in generalities.
We will lock the exact app, compatibility, Tailscale design, and install sequence for your equipment — and we will still compare other software options if your gear opens that door.