onvif-protect-bridge

GitHub repo

I've been using UniFi Protect for home security, but I've got a bunch of older cameras on a DVR that don't speak ONVIF properly. It needs proper ONVIF discovery and compliant SOAP endpoints.

What it does

onvif-protect-bridge wraps any RTSP stream and makes it look like a real ONVIF camera to Protect. Each camera runs in its own Docker container with a unique MAC address (via macvlan), so Protect sees them as genuine separate devices — not aliases of the same host.

Inside each container:

• mediamtx restreams the upstream RTSP source
• A lightweight ONVIF server (Hono/TypeScript) handles GetCapabilities, GetProfiles, GetStreamUri, and the rest
• WS-Discovery UDP listener that answers Protect's multicast probes for auto-discovery

Setup is dead simple: clone the repo, edit .env with your RTSP URLs, run docker compose up -d. Protect finds them within a minute.

The problem it solves

If you've got:

• An old DVR with cameras that don't expose proper ONVIF
• Third-party IP cameras that are partially ONVIF-compliant but Protect rejects
• Any RTSP source you want Protect to see as a real camera
• Like me, an amazon special that's a bit thin on the features

This tries to bridge that gap.

Inspiration

This was heavily inspired by daniela-hase/onvif-server. It's a rewrite in TypeScript with per-container macvlan isolation and mediamtx bundled inside, so the ONVIF and RTSP endpoints share the same IP (I ran into a problem where protect wouldn't accept it from the same IP). I know there are a few others out there but this one, straight into a docker container worked best for me alongside something like portainer.

What's missing / where I could use help

• Only the ONVIF actions Protect actually calls are implemented. More complete support would make it work with other platforms
• No snapshot proxy yet (GetSnapshotUri is stubbed out)
  • Could be done with ffmpeg?
• Tested on x86 Linux;
• No HTTPS or ONVIF auth support (using `admin` as the username and password for now)

Happy to talk through the macvlan approach or the ONVIF SOAP implementation. Would genuinely love feedback on whether the architecture makes sense or if there's something simpler I'm missing.