Security operations control centre

Live Video Operations Matrix

Configured RTSP / RTSPS / ONVIF camera streams with browser HLS playback

Local time --:--:--

24/7 monitor

0Total cameras

0Online

16.8MStream Balancer

UnverifiedEstimated rank population

0Optical Tamper: 0

0Recording

0Needs attention

Wall profile Shared

Rotate Page 1 of 1

Visual Heatmap Timeline

REC SYNC 12:00:00 UTC

Clip: Not marked

00:00:00

Continuous Motion Alarm / Incident AI Detection

Findings & unified timeline

Bookmark the exact active-video position and review recordings, alarms, AI observations and incidents together.

Forensic Evidence Export

Load footage, select recordings below, then create a case-linked cryptographic export.

No recordings loaded.

AI Natural Language Video Forensic Search (Prompt-to-Evidence)

Search indexed observations using a positive description, camera and optional date/time. All descriptive terms must match; unanalysed footage is not searched. Example: "person carrying backpack on 29/10/2026".

Indexed evidence search

AI Person & Vehicle Description Search

Search indexed observations and optionally queue fresh live-camera analysis using observable descriptions.

Camera AI analytics enabled Analyse active camera alarms ANPR enabled for this camera Person-of-interest monitoring On-demand description search Sampling interval (seconds) Minimum confidence

Description similarity is an investigative lead only. It does not establish identity, ownership, or involvement; every candidate requires authorised human review. Recorded search samples one bounded frame per retained segment and is not an exhaustive frame-by-frame examination.

Enter observable person or vehicle details. Live analysis is queued through recorder-node workers.

Recent governed searches

Reopen long-running distributed searches without keeping this page open.

Loading search history…

Person-of-interest appearance monitoring

Active cases trigger periodic analysis only on cameras with person-interest monitoring enabled. This is non-biometric candidate detection.

Loading active person-interest cases…

Governed AI Operations

Inference health, signed model inventory and human review. Candidate detections are not confirmed security events.

InferenceChecking…

Engines—

Active workers0

Recording isolationRequired

Loading safe-degraded state…

Model inventory

Only signed, verified models can enter the dual-approved activation workflow.

Model	Runtime	Digest	Status	Control
Loading models…

Human review queue

Observed facts, machine candidates and operator conclusions remain separate and attributable.

Loading observations…

6Total Loading Bays

0Bays Occupied

6Bays Available

0Dwell Overstays

0Active Gate Passes

0%Yard Occupancy

Active Loading Bay Matrix (Bays 1 – 6)

Live vehicle docking, dwell timers, overstay alarms and lane incursion enforcement

ANPR Synchronized

Boom Barrier & ANPR Gate Control

AUTOMATED

Entry Boom Barrier (Gate A)

Linked to Camera: Main Entry ANPR

State: LOWERED (SECURE) • Pass Validation: ACTIVE

Exit Boom Barrier (Gate B)

Linked to Camera: Main Exit ANPR

State: LOWERED (SECURE) • Fee Verification: ENFORCED

Recent Gate Arrival Audits

Digital Bus Gate Passes & Staging

Registry

0/50

Yard North

0/30

Yard South

0/20

Overflow Bay

Issued Digital Gate Passes

Plate / Pass	Operator / Route	Valid Until	Status

Legacy manual zones — not the verified rank population

0Live Headcount

0Legacy Entries (Lifetime)

0Legacy Exits (Lifetime)

0Legacy Peak (Lifetime)

4Active Zones

0%Facility Capacity

Monitored Counting Zones & Capacity Gauges

Bi-directional tripwire line crossing, live headcount and automated overcrowding safety alerts

NORMAL

Camera Tripwire Crossings

Commissioning required

Automatic directional counting requires validated camera-to-zone mapping and a commissioned crossing detector. Sampled person detections do not establish entry or exit direction. Manual corrections are available on each zone card.

                  Automatic tripwire readiness has not been verified for this installation.
                

Live Crossing Activity Feed

Real-Time Stream

Time	Zone	Direction	Headcount	Camera

Governed investigative workflow

Authorized Person Watchlist & Reference Search

Enroll a protected reference photo, extract observable appearance with Gemini, search retained footage, and alert on future candidates. Results never establish identity, criminal status, an arrest instruction, or legal authority.

Two-person activationCreator and approver must be different authorized users.

Biometric Facial Recognition Policy (POPIA / GDPR Compliance)

Facial identification is intentionally excluded by default to maintain strict compliance with POPIA Sections 26–33 and GDPR Article 9, preventing unconsented mass surveillance liabilities.

POPIA/GDPR Compliance Mode (Biometrics Disabled)

Current Surveillance Baseline: Non-biometric behavioral & appearance mode. The system tracks observable clothing colors, garments, accessories, vehicle attributes, and dwell times without extracting or comparing facial biometric templates.

Enroll authority-backed profile

Case / subject label

Reference photo (Upload & Crop Person)

Legal basis Source authority / agency Authority reference Authority expiry Risk classification Candidate threshold Known observable context Response instruction I confirm the authority record is current and permits this processing.

Search retained video

Retrospective processing is bounded to authorized, analytics-enabled cameras and samples retained recording segments with single-threaded throttled decoding to protect live streaming. Review all candidates against original footage before escalation.

Authority-backed watchlist registry

Loading protected registry…

Candidate review queue

Select “Review candidates” on a profile.

Scouting & Idling Watchdog (90-Day Investigative Evidence Retention)

Detects individuals idling for extended periods (3+ minutes) who may be conducting pre-incident scouting. High-resolution snapshot evidence is locked and preserved for a mandatory 3-month (90-day) retention window.

No suspicious scouting or idling events detected.

ONVIF WS-Discovery Network Probe

Broadcast UDP WS-Discovery across local interfaces. Device capabilities are negotiated and must be accepted per model and firmware.

Click "Broadcast Subnet Scan" to discover connected IP cameras.

Privacy & Security Controls

Control Status

Audit records are SHA-256 hash-chained to make changes detectable. Footage access and retention are policy-controlled. These technical controls support governance but do not certify legal or standards compliance.

Tamper-Evident Cryptographic Audit Log

ID	Timestamp	Operator	Action	Details	SHA-256 Hash Signature

Control Room Incident Command

Loading incidents…

Operational Site Map

Active map

Administrators can drag camera markers to reposition them. Arrow keys move a focused camera by 1%; hold Shift for 0.1%.

Create or select a site map.

Administrator operations

Centralized Camera Firmware Management

Inventory camera firmware, govern approved releases, and prepare staged update campaigns with exact-model safeguards.

Fail-closed updates No firmware is dispatched without a qualified adapter and preflight.

Users & Role-Based Access

Administrator-only account lifecycle, role and camera-scope controls.

Create User

Passwords require uppercase, lowercase, number, special character, and at least 12 characters.

User Directory

Loading accounts…

Account	Role	Status	MFA	Camera Scope	Actions
Loading users…

Host —

System state Checking…

Running 0

Failed 0

Active service inventory

Inventory has not been loaded.

Service	Category	State	Description
Open this page to load services.

Multi-Node Cluster & Failover Hive (N+1 Redundancy)

Distributed recording nodes, active camera leases, and automated failover telemetry

Cluster Healthy

Active Camera Recorder Leases

Camera	Assigned Node	Assigned Since	Lease Expiration	Lease Status
Loading cluster assignments...

Vendor-neutral security integration

External Alarm Integration API

Connect debt, parking, access-control, alarm-panel, PSIM and SIEM systems to the VayaNVR operator alarm and video-wall workflow.

Per-system bearer credentials Explicit camera allowlists Idempotent event receipts Bounded event rates

Enrol source system

The API token is displayed once after creation.

Integration name System type Purpose / description Maximum events per minute Permitted cameras Use Ctrl/Command to select several cameras. Events outside this scope are rejected.

JSON alarm contract

HTTPS is required for off-site or untrusted networks.

POST /api/integrations/v1/alarms/{integration_id}

Authorization Bearer vnr_int_...

{
  "external_event_id": "debt-check-0001842",
  "event_type": "VEHICLE_DEBT_ALERT",
  "severity": "HIGH",
  "camera_id": 5,
  "message": "Vehicle has an outstanding enforcement notice",
  "action_required": "Security must verify and notify the authorized officer",
  "subject": {
    "type": "VEHICLE",
    "license_plate": "ABC 123 GP",
    "reference_id": "case-88421"
  },
  "metadata": {
    "amount_due": "REDACTED_OR_POLICY_APPROVED"
  }
}

Connected systems

No integrations loaded.

Operator alarm test

Creates a real, auditable test alarm and video-wall takeover.

Recent API deliveries

No bearer credentials or raw request bodies are retained.

Self-Hosted Public Gateway (Ngrok Alternative)

Encrypted reverse tunnel to your dedicated public server for worldwide SSL portal access and remote viewing without port forwarding.

Active Public Domain: https://mydns.maponya-tech.com SSL & Cloudflare Active

Gateway Status

ONLINE (Tunnel Active)

Public Server Host

41.222.36.19 (Port 22 SSH)

Tunnel Forwarding

Port 13000 (Relay) → Port 3000 (VMS)

Systemd Service

vayanvr-relay-tunnel.service

Dynamic DNS (DynDNS) Manager

Monitors WAN IP changes and automatically keeps domain A records synchronized via Cloudflare DNS API, DuckDNS, or self-hosted webhook.

Active Provider

Cloudflare DNS API

Target Hostname

mydns.maponya-tech.com

Detected WAN IP

Detecting...

Last Sync Status

SYNCHRONIZED

WireGuard Direct VPN (Legacy)

Direct point-to-point WireGuard mesh for dedicated operations room networks.

Do not port-forward the web portal or SSH. Off-site users connect via Public Gateway or WireGuard, authenticating with their assigned role and scoped cameras.

Enrolled remote peers

Load status to view the required router rule.

Recording Storage & Online Archive

Manage primary recording volumes and verified offsite archive destinations.

Keep active recording on mounted storage. USB, SAN, NAS and LucidLink must be mounted by Linux before selection. S3, SFTP and FTPS are for archive, backup or evidence copies; plain FTP is blocked.

Active storage paths

Verified system backups

Database, configuration metadata and Site Map assets. Use a BACKUP destination below for an independent off-site copy.

Recovery & recorder failover assurance

Backup RPO, verified off-site restore drills and recorder-node redundancy.

Capacity & failure domains

Storage Allocation Graph

Loading storage allocation graph...

Attached USB / SAN / NAS / LucidLink

Detect writable, enrolled filesystems presented to this recorder node.

Online archive destinations

Credentials are encrypted at rest and never returned by the API.

Destination name Connection type Purpose Mounted path HTTPS endpoint Bucket Region Folder prefix Provider Access key ID Secret access key Server host Port Username Password Remote path TLS mode

Archive transfer & restore

Queue verified recordings or database backups, monitor readback integrity, and request audited restores.

ONVIF Profile G Edge Storage Recovery

Audit network recording timeline dropouts and trickle-backfill footage directly from on-camera SD cards.

Zero-Data-Loss Architecture: When network switches, Wi-Fi bridges, or WAN uplinks drop, enterprise cameras record to onboard MicroSD. This engine compares recorder indexed timelines with expected recording intervals and schedules background trickle recovery via RTSP playback replay.

Target Camera

Audit Window

Enterprise Telemetry & Diagnostics

VMS Platform Health & Ingestion Watchdog

Host CPU utilization Loading…

Host RAM usage Loading…

Storage Capacity Loading…

Adaptive Stream Balancer Not measured Awaiting routing metrics

Verified Database Backup Status not loaded

Recording Storage Capacity

Loading capacity…

Used: Calculating... Capacity and retention policies are checked separately. Free: Calculating...

Camera Stream Ingestion Watchdog

Active stream monitor

Camera	Source Protocol	Ingest State	Resolution	Est. Bitrate	Recording Mode
Loading camera stream health...

Core Subsystems & Gateway Health

MySQL Engine Not checked

Database status comes from the latest metrics query. Audit-chain verification is a separate check.

Media Ingestion Not checked

Media-engine readiness is separate from individual stream and recording health.

WebSocket Gateway ONLINE

Real-time event broadcasting enabled

System Management

Administrator-only public access, recording storage, and verified backup policy. Storage directories must already exist and be writable by the recorder service.

System timezone Select from every IANA timezone supported by the server. The choice is applied to the portal, application, database sessions and Linux host. Public portal URL Allowed browser origins Comma-separated; the current browser origin cannot be removed. Recording directory Database backup directory Snapshot directory Site Map image directory HLS working directory Evidence export directory Reserved free storage (GB) Backup interval (hours) Backup retention (days) Maximum backup age (hours)

SMTP Notifications

Credentials remain server-side. A test message is sent only after an administrator explicitly requests it.

SMTP status has not been loaded.

AI Vision & Multi-Model Engine

Configure multimodal AI models (Google Gemini, Ollama / Local Llama, or OpenAI-compatible vision) for ANPR, POI identification, and scouting detection.

Active AI Provider Endpoint URL Model Identifier API Key / Token (leave blank to keep current)

Storage Failure Domains

External Recording Storage

Detects mounted USB disks, SAN block storage, and NFS/SMB/Ceph/Gluster/SSHFS network shares. The portal does not format disks or mount untrusted devices.

Central Camera Firmware

Approved, exact-model firmware inventory and staged update campaigns. Firmware is never sent to a camera until a compatible vendor adapter is configured.

Per-camera Update Status

Approved and Draft Firmware

Update Campaigns

ONVIF Interoperability Evidence

Runs bounded, read-only checks against an initialized camera and preserves the exact vendor, model and firmware result. This is internal interoperability evidence, not an official ONVIF conformance certification.

Camera Per-check timeout Required operating scope

Host Network Address

A static-IP change requires approval by a second administrator and automatically rolls back after two minutes unless confirmed from the new address.

Pending Two-Person Approvals

Secure Host Wi-Fi

WPA2/WPA3 enrollment through the restricted network helper. A healthy wired recovery path and a second administrator are required.

Wi-Fi state has not been loaded.

Select a wireless interface and scan.

1Select the network and enter its password.
2Request approval from another administrator.
3Use the approved request ID and connect.
4Confirm the transaction within 120 seconds.

Network SSID WPA2/WPA3 password Hidden network Change reason Approved request ID

Open and legacy WPA-only networks are displayed for awareness but cannot be enrolled. Active credentials remain root-only in netplan with mode 0600.

Device Model Qualification

Records apply only to the exact model and firmware tested. Passing requires evidence, an expiry date and approval by another administrator.

Physical Wall Display Nodes

Display name Physical location Assigned wall profile Monitor/page index Canvas width Canvas height Processor topology Horizontal bezel compensation (px) Vertical bezel compensation (px)

The enrollment token is shown once.

No display nodes loaded.

Control Room Hardware Compatibility

Standards-based compatibility is shown separately from model-specific physical certification.

Control-plane role: loading…

Loading hardware compatibility…

Decoder & Display Controller Fabric

Loading driver registry…

Loading controllers…

Standards Assurance Register

Loading assurance controls…

Time Synchronization Assurance

Checks the recorder NTP state and measures clock drift on currently connected ONVIF cameras. This is operational evidence, not site certification.

No clock evidence loaded.

Enforced Privacy Masking

Select a camera

Masks are permanently burned into live, wall, snapshots and recordings at ingest. Changing or removing an existing mask requires approval from a second administrator.

Alarm Context & Camera Relationships

Govern which nearby, approach, departure, overlap or PTZ-handoff cameras accompany an alarm.

Loading camera relationships…

System Alarm Messages

Loading operational alarms…