Pilot playbook (S2 — no hardware)

Our starting approach for early pilots is Scenario S2: no hardware purchase. The CV worker runs on your laptop or a free always-on VM and pulls the camera’s RTSP stream from outside the store. We buy an in-store box (S3) later, once a pilot is proven or a store isn’t reachable.

S2’s core trade-off

S2 only works if the camera stream is reachable from the internet. That means either the store’s router port-forwards the camera, or you VPN into its network. Exposing a camera to the internet is a real security risk and often blocked by the ISP — read the gatekeeper and security sections before promising a store anything.

The scenarios, in one line each

	Scenario	Hardware	Use when
S0	Build on your laptop with sample clips	none	Always — the dev loop
S1	Process the store’s recorded footage	none	Every sales pitch + accuracy check
S2	Live, pull RTSP remotely to laptop/VM	none	Our first live pilots
S3	Small box in the store, reads RTSP locally	buy a box	The real product / scaling
S4	Stream every store to a cloud GPU	avoid	Effectively never

Full detail: docs/research/cv-deployment-scenarios.html in the repo.

The one rule

The worker runs where the video is. YOLO has to watch the video, and the video lives in the store. In S2 we bring the video out to the worker — which is exactly why it needs a reachable stream.

Step 0 — do S1 first

Before touching anyone’s router, validate on recorded footage:

1. Have the owner export a few hours of yesterday’s clip from their DVR/NVR to a USB stick (or grab it on a site visit).
2. Run the worker offline on that clip.
3. Confirm two things: the entrance is actually in frame, and the count is accurate.

This costs nothing, risks nothing, doubles as your sales proof (“your Tuesday: 340 visitors, peak 6–7pm”), and catches the #1 failure mode early — a camera pointed at the counter/register instead of the door. If the angle is wrong, no networking fixes it.

The gatekeeper — check for CGNAT

Most small-business/home connections share one public IP across many customers (CGNAT). If the store is behind CGNAT, port-forwarding is impossible and S2-by-public-IP is dead.

Check first: log into the router, read its WAN IP, and compare to what whatismyip shows. If they differ — or the WAN IP is in 100.64.0.0/10 (100.64–100.127) — it’s CGNAT.

• Not CGNAT → port-forwarding works, S2 is on.
• CGNAT → you need a VPN/tunnel (a tiny device at the store) or you fall back to S1 for now / S3 later.

Making the stream reachable (if not CGNAT)

• Port-forward on the router — forward an external port to CAMERA_IP:554. You do this via the router admin login; the owner can’t. So you need the router password, not just the camera password.
• NVR/DVR cloud (P2P) — some recorders expose feeds through a vendor cloud app; pull from there instead of port-forwarding.
• VPN into the store LAN — cleanest security-wise, but needs a VPN-capable router or a small device on-site.

Security — this is on you now

Exposing a camera means you own its security:

• Change the default password to a strong, unique one. Never leave admin/admin or admin/12345 — internet-exposed cameras with default creds are compromised within hours.
• Use a non-standard external port, not 554.
• If the router/camera supports it, allowlist inbound to your worker’s IP only.
• Pull the substream (lower resolution), not the main stream — one camera at 5–8 FPS is plenty, and it keeps the shop’s bandwidth usable (S2 uploads video 24/7).

Where the worker runs

No GPU needed for one camera — CPU is plenty (YOLO clears well above the 5–8 FPS you need).

• Your laptop/PC — simplest, free, fine while it’s on.
• Oracle Cloud Always-Free (Ampere ARM VM) — the only genuine free 24/7 VM; use it if you want the worker off your machine. Run plain ONNX/PyTorch CPU (OpenVINO’s speedups are Intel-only).

Building the RTSP URL

You construct it from the camera brand, its local IP, the port, and the credentials:

rtsp://USERNAME:PASSWORD@HOST:554/<brand-specific-path>

HOST = the public IP (port-forwarded) or the local IP (over VPN).

Brand	Path (sub-stream in parentheses)
Hikvision	/Streaming/Channels/101 (sub: /Streaming/Channels/102)
Dahua	/cam/realmonitor?channel=1&subtype=0 (sub: subtype=1)
Generic ONVIF	discover via an ONVIF scan

Test it opens in VLC (Open Network Stream) or ffprobe before wiring the worker.

When to graduate to S3

Move to an in-store box (~1,000 TND mini-PC N100) when: the store is CGNAT’d (can’t reach the stream), or you’re scaling to paying customers and want reliable local RTSP with video that never leaves the shop.

See the site-survey checklist for exactly what to collect on the visit and the message to send the owner.