Documentation

Configuration

Configuration

OpenNVR is built on open standards. Configuration is accomplished using a combination of the web interface or specific files such as server/.env and docker-compose.yml.

Setting Up Your Cameras

You must use the OpenNVR UI to map endpoints since NVR routing configurations are dynamic:

  1. Navigate to the Cameras page in the UI.
  2. Select Add Camera.
  3. Name your Camera.
  4. Paste the rtsp://, rtmps://, or http:// stream endpoint from your IP Camera.
  5. In the next section, configure Retention Policies (E.g., “Retain Continuous Recording for 14 Days” or “Retain Events for 30 Days”).

✅ ONVIF Discovery: From Cameras → Add Camera → Discover, OpenNVR scans your local subnet for reachable ONVIF cameras and lists them. Discovery uses a unicast subnet scan, so it works the same in Docker bridge mode on Windows, macOS, and Linux — no host networking required. You can always add a camera by its RTSP URL if discovery is blocked by network/firewall rules.

Storage Configurations

Recordings are saved to ./recordings (relative to the compose file) by default. For production, point the recording volume at a physical drive or NAS by setting RECORDINGS_PATH in .env:

# Linux
RECORDINGS_PATH=/var/lib/opennvr/recordings
# Windows
RECORDINGS_PATH=D:/opennvr-recordings

Then re-run docker compose -f docker-compose.yml up -d to remount. Ensure the Docker daemon has read/write permissions for that directory. See Storage Mapping for details.

Secrets & TLS

Application secrets. ./scripts/generate-secrets.sh (or .ps1 on Windows) writes cryptographically random values into .env for the four secrets the core validates at boot — SECRET_KEY, CREDENTIAL_ENCRYPTION_KEY, INTERNAL_API_KEY, MEDIAMTX_SECRET — plus the PostgreSQL password. The launcher runs this for you; run it by hand only for the manual/unattended install. There are no shipped default credentials.

TLS certificates. The launcher (./start.sh / .\start.ps1) auto-generates a self-signed certificate into ./nginx-certs/ for the HTTPS UI at https://localhost/ — accept the browser warning once. The cert never leaves the host. If your LAN IP changes, regenerate with ./start.sh refresh-certs. For a public deployment, front OpenNVR with a real reverse proxy (Caddy, Traefik, nginx) holding a CA-issued certificate.

Logs

All logs are emitted via stdout to Docker. You can monitor OpenNVR’s core operations anytime:

docker compose logs -f opennvr-core