Protect records; Home Assistant adds context

Reliable home surveillance should not depend on a cloud service to record what happens at the door. UniFi Protect stores video on the local console and performs supported detection features locally. Home Assistant adds logic: combine an event with alarm state, turn on a light, display a camera or send a useful notification.

This separation keeps Home Assistant from becoming an improvised video recorder. Protect remains responsible for streams, retention and event review; Home Assistant consumes the API and RTSPS streams needed for dashboards and automations. A Home Assistant outage should not stop recording, and an Internet outage should not keep Protect from recording locally.

The target is a local-first, segmented and recoverable design. No inbound port is opened to cameras or the Protect console. Remote access uses a service built for that purpose, while notifications use authenticated Home Assistant endpoints instead of a public directory.

Logical architecture

UniFi cameras ──> Protect console / NVR ──> Local recordings
                         │
                         ├── Local API + RTSPS ──> Home Assistant
                         │                       ├── Dashboards
                         │                       ├── Automations
                         │                       └── Mobile notifications
                         │
Internet ──> No direct inbound access to cameras or the NVR

Size recording before building automations

Start with evidence requirements: which areas should be covered, for how many days and at what level of detail? Camera count, resolution, bitrate, recording mode and disk capacity determine actual retention. The console estimate is a starting point; a production-setting trial confirms daily growth.

Protect can apply retention periods and, on supported releases, keep recent footage at high quality before reducing the quality of older footage. Downgraded video cannot later regain its original quality. Export important footage before it expires or is reduced.

Plan power as well. A Protect console, PoE switch and Home Assistant host on a UPS can continue through a short outage. Test graceful shutdown, restart and stream recovery; theoretical runtime is not a recovery exercise.

Decision	Question to answer	Practical validation
Coverage	Entrances, garage, yard and private areas to exclude	Check framing by day, at night and in rain
Retention	Days needed to discover an incident	Measure actual consumption for a representative week
Mode	Continuous, detections or schedule	Simulate a busy day and network outage
Quality	Resolution, frame rate and bitrate	Confirm required faces and details remain readable
Power	Console, storage, network and Home Assistant on UPS	Remove power and time recovery

Ubiquiti — Managing storage and retention in Protect ↗

Separate cameras, management and personal devices

Place cameras in a dedicated VLAN and keep management interfaces on an administration network. The Home Assistant server can reside in a services VLAN: it initiates the necessary connections to Protect, without giving the camera VLAN broad access to workstations, NAS storage or backups.

For adoption, Ubiquiti recommends keeping Protect devices and the console on the same VLAN. Cross-VLAN adoption is possible in selected scenarios, but it requires the correct ports and console address. The simplest design adopts devices in their intended segment, then applies explicit rules based on the port reference for the deployed release.

Do not copy a rule list without observation. Allow flows by source and destination, log denials during the pilot and confirm actual connections. Protect ports evolve with features; a broad 'cameras to all private networks' rule hides dependencies instead of documenting them.

Source	Destination	Starting policy	Purpose
Cameras	Protect console	Allow only required Protect flows	Adoption, video and device state
Home Assistant	Protect console	Allow required local HTTPS/API and RTSPS	Entities, events, thumbnails and video
Admin workstation	Protect and Home Assistant	Allow HTTPS management	Configuration and troubleshooting
Cameras	Approved DNS, NTP and update services	Allow as required	Time, resolution and lifecycle
Cameras	Other private VLANs	Deny and log	Limit lateral movement
Internet	Cameras and console	Deny all inbound access	Eliminate direct exposure

Create a dedicated local identity for Home Assistant

The integration does not use a Ubiquiti cloud account. In the UniFi OS console reached through its local address, create a local user reserved for Home Assistant and restrict it to local access. Do not reuse the daily administrator account or its password.

Protect permissions determine the entities and actions exposed to Home Assistant. Full Management enables the complete feature set, but it also grants sensitive capabilities. If the requirement is limited to cameras, sensors and events, start with the minimum compatible permissions and add one only when a specific feature requires it.

Create an API key in Control Plane integration settings. An administrator currently has to create the key, but it should belong to the intended service identity. Treat it as a secret, keep it out of repositories and revoke it when the server changes or an incident occurs. The integration requires UniFi Protect 7.1.0 or later and does not support Early Access releases.

Use a clear account name such as ha-protect and document its owner.
Disable cloud access for this local account.
Grant only the required cameras, events and actions.
Create a separate API key and record its revocation procedure.
Keep a separate administrator identity for configuration changes.

Home Assistant — UniFi Protect prerequisites and permissions ↗

Add the integration and validate one stream at a time

In Home Assistant, add UniFi Protect from Settings, Devices & services. Enter the console's local IP address, local account and API key. Use a stable DHCP reservation or an address configured according to platform guidance; an internal DNS name also works if resolution remains available during an Internet outage.

Validate one camera, one motion sensor and one event before creating automations. Home Assistant consumes RTSPS streams enabled through Protect's public API and selects the highest quality by default. Medium and low streams are available as disabled entities: enable them only when a dashboard or constrained device needs them.

If a stream is unavailable, the integration can fall back to repeated snapshots, increasing console load. A dashboard showing many live cameras can also consume significant decoding and network resources. Start with one primary view, use thumbnails for the others and open live video on demand.

Check	Expected result	If it fails
Connection	Integration loads without another sign-in	Check local account, API key, DNS and time
Camera	Entity is available with a recent image	Check camera permission and enabled stream
Live view	RTSPS remains stable for several minutes	Check firewall, MTU, quality and NVR load
Event	Motion or detection appears once	Check entity type, attributes and availability
Recovery	Entities return after an NVR restart	Review logs and startup order

Home Assistant — UniFi Protect configuration and entities ↗

Send a notification with a protected thumbnail

A useful notification identifies the camera and shows the event. The integration supplies proxy endpoints for thumbnails, video and snapshots. Home Assistant signs URLs used by automations, so the Protect console does not need Internet exposure.

This example waits two seconds for the event image, then sends its thumbnail. Replace the entity and mobile notification service. Test with the phone locked, on Wi-Fi and on cellular data. If notifications become noisy, add an occupancy condition, schedule or cooldown instead of disabling detection at the source.

For attachments retained by Home Assistant, prefer the authenticated media source. The /www directory is served publicly under /local and is a poor choice for surveillance images. Avoid copying every event to the Home Assistant disk as well; retain only data governed by an explicit policy.

Home Assistant automation — motion with thumbnail

alias: Door motion with image
description: Sends the Protect thumbnail when motion starts
triggers:
  - trigger: state
    entity_id: binary_sensor.g4_instant_motion
    from: "off"
    to: "on"
actions:
  - delay:
      seconds: 2
  - action: notify.mobile_app_your_phone
    data:
      title: "Motion at the door"
      message: "UniFi Protect detected motion."
      data:
        image: >-
          /api/unifiprotect/thumbnail/{{ config_entry_id(trigger.entity_id) }}/{{ trigger.to_state.attributes.event_id }}
mode: single

Turn detections into context, not irreversible decisions

Person, vehicle, package or plate events can reduce noise, but they remain probabilistic observations. Use them to select a message, turn on a zone or request confirmation. Never unlock a door or gate from a plate, face or NFC serial alone: an image, printed plate or copied identifier can fool the mechanism.

A sensitive automation should combine independent signals and retain human approval. For example: person detected at the door, resident phone present, alarm disarmed and confirmation in an actionable notification. Even then, the unlock action should expire quickly and create an audit record.

Plan for unavailable states as well. Some events can be replayed or change state after a restart. Apply a maximum age, inspect event timestamps and make actions idempotent: a second execution must not unlock twice, extend a timer forever or send a burst of messages.

Notification and lighting: low risk, direct automation is reasonable.
Siren or call: require multiple signals and a short time window.
Unlocking: require human confirmation and a second contextual factor.
Video deletion: never automate from a detection.
Privacy mode: protect changes with permissions and logging.

Reach the system remotely without publishing cameras

Do not forward camera, Protect or Home Assistant ports directly through the router. For Home Assistant, Home Assistant Cloud is the simplest option for most homes; a VPN such as Tailscale or a router VPN also works. A reverse proxy is possible, but it requires TLS, correct trusted-proxy configuration, updates and continuous monitoring.

UniFi Site Manager establishes remote management through outbound connections, without requiring an inbound port. Ubiquiti states that recordings remain on the local console and remote connections are end-to-end encrypted. That does not replace account control: enable multi-factor authentication for interactive accounts, remove old devices and review sessions.

In Home Assistant, enable MFA, use a unique password and revoke unused tokens from the profile Security page. The Protect API key belongs to the server, not the phone; it should never become a shortcut for remote access.

Method	Benefit	Responsibility
Home Assistant Cloud	No router port to open	Protect the account and test notifications
VPN	Private access to multiple services	Maintain keys, routes and clients
Reverse proxy	Fine control over domain and TLS	Hardening, updates, headers and logs
UniFi Site Manager	Protect access without inbound ports	MFA, roles and session removal

Back up configuration and archive evidence separately

A Protect configuration backup speeds console recovery, but it does not move recordings to a new console. Ubiquiti notes that video stays on the original host and reusing disks can reformat them. Export important footage to protected storage before a migration, disk operation or retention expiry.

For Home Assistant, schedule automatic backups to at least one independent location and download the emergency kit containing the encryption key. An encrypted copy on a NAS, offline medium or cloud location reduces the chance that one host failure takes both the system and its backup.

Document two different procedures: restore automation and preserve video evidence. The first covers dashboards, secrets, devices and routines; the second covers chain of custody, timestamps and a readable exported file. Test both without erasing production.

Item	Protection	Test
Protect configuration	Automatic backup and copy outside the console	Restore to a compatible lab platform
Current recordings	Sized local retention and disk health	Find an older event and play the clip
Critical footage	Immediate export to protected storage	Play the file on another device
Home Assistant	Encrypted backups to an independent location	Restore a recent backup in a lab
HA backup key	Offline emergency kit	Confirm the authorized owner can retrieve it

Commissioning checklist

Commission the system through scenarios, not because every entity is green. Walk in front of each camera by day and at night, disconnect the Internet, restart Home Assistant, restart the console, simulate an absent phone and retrieve an older event. A notification should reach the right recipient without putting an image at a public URL.

The result should be easy to explain: Protect keeps recording locally; Home Assistant adds useful responses; cameras cannot roam the network; remote access does not expose the NVR; an outage or false positive cannot trigger a dangerous action. Keep the flow matrix, service accounts, retention settings and test results with the home's documentation.

Confirm time, DNS and updates on Protect, Home Assistant and cameras.
Test every zone by day, at night and with real movement.
Validate live video, thumbnail, clip and event completion.
Disconnect the Internet and confirm local recording continues.
Restart Protect and then Home Assistant while watching recovery.
Test firewall rules from a device in the camera VLAN.
Revoke a test token and confirm access stops.
Restore a backup and play an exported clip on another device.
Review permissions, retention and recipients after every major change.

About the author

Marc-Antoine Lambert

Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.

Discuss your environment →