5. Edge, camera VPN and ingest

This page connects the outside world to Sentinel ID: officers' browsers and phones, partner systems, and over 4 million solar-powered cameras on mobile data.

Traffic types

From	Path	Lands on
Control-room browsers, field phones	https://sentinel.agency.gov	Load balancers → application servers
Partner systems (licensing, insurers, borders)	https://api.sentinel.agency.gov with an API key, from known IP ranges	Load balancers → application servers
Solar camera sites	Encrypted tunnel over 4G → camera VPN concentrators	Ingest servers
Community (volunteer) cameras	https://ingest.sentinel.agency.gov with their own key	Load balancers → ingest servers

Camera VPN concentrators

Each solar site's 4G router keeps an IPsec (IKEv2) or WireGuard tunnel to the concentrators in the edge zone. Cameras therefore never need a public address and are never reachable from the internet.

• Authenticate routers with per-site certificates (or per-site WireGuard keys) issued by the internal CA. Revoke a site by revoking its certificate.
• Assign each site a fixed tunnel address, so ingest servers can log it.
• Run at least four concentrators per million sites behind the load balancers' virtual IP, with dead-peer detection so sites move to a healthy concentrator automatically.
• Ask the mobile operators for a private APN: camera SIMs then reach only your concentrators, not the internet.

Ingest servers

Ingest servers are application servers that the load balancers route camera traffic to (/api/v1/cameras/ingest and /api/v1/sightings). Install them exactly as in Application tier, with the same configuration.

For millions of cameras:

• Read plates on the camera. Configure the ANPR cameras (or the edge box on the pole) to send the plate text with a small crop to POST /api/v1/sightings (plate, lat, lng, capturedAt, cameraId). Sending full images for server-side reading (/cameras/ingest) is for low-volume cameras and community cameras.
• One API key per camera, created when the camera is registered, with only the sightings:write permission.
• Scale out by adding ingest servers. Each takes about 5,000 reads a second when plates are read on the camera; start with about 20 and add more with each rollout wave.

Community (volunteer) cameras

1. The owner registers the camera (owner, address, location, camera type) and accepts the programme terms.
2. An administrator checks it (visit or video call), approves it, and registers it under Cameras with its location. Registration creates the camera's own API key.
3. The camera sends snapshots to https://ingest.sentinel.agency.gov/api/v1/cameras/ingest with its key in the X-API-Key header (or ?key= for cameras that can only call a URL).
4. Suspend or delete the camera to revoke its key immediately.

Volunteer cameras can only send. They never search, view records or receive alerts.

Load-balancer rules for cameras

frontend ingest_public
  bind :443 ssl crt /etc/haproxy/certs/ingest.pem
  # cameras send small requests; reject anything else early
  http-request deny if !{ path_beg /api/v1/cameras/ingest /api/v1/sightings }
  http-request deny if { req.body_size gt 2000000 }
  stick-table type ip size 1m expire 60s store http_req_rate(10s)
  http-request track-sc0 src
  http-request deny deny_status 429 if { sc_http_req_rate(0) gt 200 }
  default_backend ingest

Field phones

Field phones reach the application servers through the public address over TLS. Every phone must be approved under Field devices before it can sign in, and sign-ins are bound to the phone. For voice calls between phones on mobile data, add a TURN server (for example coturn, installed as a system service) in the edge zone and enter it under Settings › Calls.

Next: Security hardening.