Primary Internet (Locked In — Not Subject to Selection)

Lightwire Fixed Wireless Unlimited

The Lightwire plan meets the site bandwidth requirement (5 Mbps sustained upload, 10 Mbps download). The upload margin is thin — worst-case concurrent demand is ~3.5 Mbps against ~5 Mbps typical upload. A peak-hour speed test is required before launch to confirm this holds under real conditions. H.265 encoding is load-bearing for this calculation — any camera that does not support H.265 is disqualified.

Backup Connectivity Options

The following options address backup/failover only. The primary Lightwire plan is not subject to selection.

Option A: 4G Mobile Backup Router (Phase 2 — recommended)

What it provides:

A 4G cellular router connected to the ER706W WAN2 ethernet port. Low-cost backup for alarm heartbeats, brief remote management sessions, and occasional remote camera sub-stream access during a Lightwire outage.

Coverage at Hamurana:

Hamurana is on the northwest shore of Lake Rotorua, approximately 15km from Rotorua city. Spark and One NZ provide 4G coverage to most Rotorua lakeside areas, but signal at Te Waerenga Road specifically is at the edge of rural coverage and requires on-site confirmation before committing to this option.

Recommended hardware:

Recommended hardware: TP-Link MR6400 — matches existing TP-Link/Omada ecosystem, straightforward setup, readily available from NZ retailers.

SIM and plan options:

The backup link carries very low data: alarm heartbeats, brief remote management sessions, and alert notifications. A low-data always-on SIM is the correct product.

Recommended SIM: Spark Business IoT SIM or One NZ equivalent — designed for devices that sit connected 24/7 but use little data, and will not deactivate during quiet periods.

Upload speed on rural 4G: 2–10 Mbps typical. Sufficient for alarm heartbeats and brief remote management sessions. H.265 sub-stream remote view (0.5–1 Mbps) will work at 3+ bars signal.

What falls back to 4G during a Lightwire outage:

• Hik-Connect remote camera live-view — available again within ~30–60 seconds of failover
• DSC HS2032 alarm communicator IP path — maintained via 4G; TL2803GR cellular path is not triggered if 4G WAN2 is up
• Remote management of router configuration

What does NOT use the 4G backup router:

The DSC TL2803GR alarm communicator has its own dedicated cellular SIM for alarm signalling. The backup router SIM and the alarm communicator SIM are separate and independent — the alarm panel's cellular path is unaffected by whether the backup router is functioning or not.

Phase 2 cost:

Combined monthly cost (Lightwire + 4G SIM): ~$159/month.

Pros:

• Very low monthly cost compared to Option B (Starlink)
• Minimal upfront hardware cost (~$180–$220)
• No sky-view obstruction issues
• TP-Link hardware integrates cleanly with existing Omada ecosystem
• No commercial use restrictions on a plain data SIM

Cons:

• Coverage at Hamurana is unconfirmed — must verify on-site before committing
• Upload speeds lower and more variable than Starlink
• Rural 4G may itself be congested at peak hours

Verdict: Recommended for Phase 2, subject to on-site 4G coverage check.

Option B: No Backup — Phase 1 Risk Acceptance (recommended for Phase 1)

What this means:

Accept Lightwire as the sole internet path at launch. If Lightwire goes down, remote visibility is lost until it recovers. No backup hardware is purchased or configured.

Operational impact during a Lightwire outage:

Lightwire reliability context:

99.9% claimed uptime equates to less than 9 hours of unplanned outage per year. Lightwire towers have backup power generation, reducing the risk of extended outages from local power cuts.

Phase 1 cost: $0 additional — Lightwire $139/month only.

Pros:

• Zero additional cost
• Simplest possible network configuration — no WAN failover rules to configure
• All safety-critical functions remain operational during outages
• ER706W WAN2 port remains available for Phase 2 addition without any hardware change

Cons:

• Remote visibility lost during outages (no camera view, no remote PIN management)
• Physical on-site access required to review NVR footage during a connectivity-coincident security event
• Phase 2 upgrade will require revisiting router WAN failover configuration (minor)

Verdict: Appropriate for Phase 1 given low customer volume and all safety-critical systems operating independently.

Option C: Starlink Residential Standard (not recommended)

Status: Superseded. A previous version of the infrastructure planning considered Starlink as the Phase 2 backup option. This has been removed in favour of Option A (4G mobile backup). The decision is documented in the integration file.

Why not recommended:

• $159/month ongoing cost equals the entire Lightwire primary plan, for a backup link used only during rare Lightwire outages
• $599 upfront hardware cost
• Residential plan terms may not permit commercial use; Starlink Business plan (~$229/month) may be required, pushing combined monthly cost to ~$368/month
• Requires unobstructed sky view from shed location — obstruction check required
• Rural 4G at a fraction of the cost serves the same backup purpose adequately

Verdict: Not recommended. Retain as a fallback only if on-site 4G coverage at the shed proves inadequate.

Cable Run to Shed

Underground OS2 Fibre (Selected — Hardware Purchased)

200m pre-terminated LC-LC OS2 single-mode fibre buried in alkathene conduit across the paddock. No field splicing required — plug-and-play once conduit is in the ground.

Hardware already on hand:

Conduit sourcing:

Recommendation: Two rolls of 25mm blue alkathene — one per 100m of the run. If the trench is being dug anyway, pull a spare draw-wire through a second conduit to enable future cable addition without re-trenching.

Trench depth: Minimum 300mm under paddock. 450mm under any vehicle track or farm machinery crossing.

Installation notes:

• The fibre is pre-terminated LC-LC — do not cut or strip the cable
• Pull using a draw-wire with a cable sock or pulling grip attached to the drum end; do not tape the draw-wire to the connector
• Minimum bend radius: 30mm installed, 15mm during installation — use swept elbows at conduit entry points, not sharp 90-degree fittings
• Label both ends at installation: "OS2 FIBRE — HOUSE TO SHED — DO NOT BEND SHARPLY"
• Test with a ping from the shed router to the house before closing the trench or sealing penetrations

Penetration points:

• Use a 25mm gland or conduit entry fitting at both the house wall penetration and the shed wall penetration
• Seal with expanding foam (fire-rated if passing through a fire-rated wall) and/or silicone
• Label both fibre ends at installation time

Total remaining cost (conduit + labour only — all hardware already purchased):

NZ Supplier Reference for Networking Hardware

Source

Integration design is drawn from knowledge/integration/security-infrastructure.md (version 3, last-updated 2026-04-09). All cross-system constraints below reflect that document.

How Infrastructure Connects to Other Systems

Cameras (Hik-Connect P2P)

The Hikvision NVR and cameras sit on VLAN 10. The NVR registers with Hik-Connect — Hikvision's cloud relay service. Remote live-view and playback are available via the Hik-Connect app or iVMS-4200 desktop client without any port forwarding or static IP address requirement.

The NVR requires outbound internet access to Hik-Connect relay servers (TCP 80, 443, and Hik-Connect-specific ports including 8000, 8200, and 554 for RTSP). The ER706W firewall must allow these outbound connections from VLAN 10 and deny all inbound connections from the internet to the camera VLAN. No direct internet exposure of any camera or the NVR is required or recommended.

If the internet drops, the NVR continues recording locally. Hik-Connect remote view is unavailable until connectivity is restored — this is an explicitly accepted Phase 1 risk.

Bandwidth constraint (load-bearing): H.265 encoding is mandatory on all cameras. The Lightwire upload ceiling (~5 Mbps typical) is only met if all cameras use H.265. H.264 would approximately double the upstream live-view sub-stream demand and risk breaching the ceiling under concurrent use. This is a disqualifying criterion for camera procurement, not a preference.

Alarms (DSC HS2032 + TL2803GR with Cellular Fallback)

The DSC TL2803GR alarm communicator sits on VLAN 20 (management). It uses the internet path (IP primary) to send heartbeats and alarm events to the DSC cloud and the monitoring centre. If the IP path drops, the TL2803GR automatically fails over to its own cellular SIM for alarm signalling — this is a mandatory requirement, not a nice-to-have.

Important: The required communicator is the DSC TL2803GR (IP + cellular dual-path). The TL280E (IP-only) is excluded for the Grade 3 dual-path target. This must be confirmed at procurement before the alarm system is installed.

The ER706W router being on UPS is important here: during a brief power outage at the shed, keeping the router online delays the point at which the alarm communicator loses its IP path and triggers cellular fallback. This reduces unnecessary cellular-path alarm traffic during short power cuts.

The DSC TL2803GR alarm communicator's cellular SIM is entirely independent of any Phase 2 4G backup router SIM. They are separate devices on separate networks — the alarm panel's cellular path is unaffected by whether the backup router is functioning or not.

Access Control (EasyGate Phase 1 — No Network Dependency)

The EasyGate wireless keypad (433.92 MHz RF, HCS101 rolling code) operates entirely independently of the network. It has no data interface, no API, no audit log, and no network connectivity. Customer gate access is not affected by any internet or network outage.

In Phase 1, the gate camera (on VLAN 10, NVR-recorded) and a manual PIN register are the sole access records. The gate camera specification is therefore load-bearing for consent evidence purposes — it must capture vehicle registration plates and driver identity clearly enough to substitute for a digital access log.

In Phase 2, a wired Wiegand or OSDP reader wired to an access control panel (e.g. Inner Range Inception or DS-K2602) will be added. The access control panel will sit on VLAN 20. Remote management — adding or removing customer PIN codes — requires an internet connection. During a Lightwire outage, remote PIN management is unavailable. The gate must continue operating on locally stored credentials regardless of internet state.

VLAN Topology

The ER706W supports VLAN segmentation and inter-VLAN firewall rules. The recommended topology separates camera traffic from management and alarm traffic.

Lightwire (house) -> MC210CS media converter -> OS2 fibre -> ER706W SFP WAN port (shed)

  ER706W LAN -> TL-SG116P PoE switch (VLAN 10: cameras)
    TL-SG116P -> Hikvision NVR
    TL-SG116P -> IP cameras (PoE)

  ER706W LAN -> DSC TL2803GR alarm communicator (VLAN 20: management)
  ER706W LAN -> access control panel (VLAN 20: management, Phase 2)
  ER706W WiFi -> operator use on-site (VLAN 20: management)

VLAN 10 — Camera network:

• Members: NVR, IP cameras
• Outbound allowed: Hik-Connect relay servers (TCP 80, 443, 8000, 8200, 554)
• Inbound from internet: denied — no port forwarding to any camera or NVR
• Inbound from VLAN 20: denied
• Lateral movement between cameras: denied (cameras must not reach each other's management interfaces)
• NVR to camera access: allowed (required for NVR to pull streams)

VLAN 20 — Management network:

• Members: DSC TL2803GR communicator, access control panel (Phase 2), operator devices on-site
• Outbound allowed: DSC Connect cloud servers, access control cloud service, general internet for management
• Inbound from VLAN 10: denied

Router hardening (required before deployment):

• Change default admin password on ER706W
• Change default passwords on TL-SG116P switch
• Change default passwords on all cameras and NVR
• Disable UPnP on ER706W
• Disable remote management on ER706W web UI (use Omada cloud controller instead)
• Enable firewall logging on ER706W for incident investigation

WAN Failover Configuration (Phase 2)

When a 4G backup router is added in Phase 2, the ER706W should be configured as follows:

• WAN1: Lightwire (OS2 fibre via MC210CS into ER706W SFP WAN port)
• WAN2: 4G router LAN ethernet into ER706W WAN2 ethernet port
• Mode: Failover only — NOT load balancing. Camera and alarm traffic must not be split across both WAN links simultaneously.
• Health check: Configure ER706W to ping 8.8.8.8 and 1.1.1.1 on both WAN links. Failover triggers automatically when WAN1 health check fails.

Starlink superseded: A previous version of this document (v2, 2026-04-01) referenced Starlink Residential Standard as the Phase 2 backup connectivity option. This has been corrected — Phase 2 backup is a 4G mobile router. Starlink is retained in the options document only as a fallback if on-site 4G coverage proves inadequate.

UPS Requirements

The UPS must keep the NVR recording and maintain the alarm communicator IP path during brief power outages.

Systems on UPS:

Systems NOT on UPS (independent power sources):

• DSC HS2032 alarm panel: carries its own internal sealed lead-acid battery rated for 4+ hours standby — explicitly excluded from UPS load
• EasyGate pin pad: runs on its own CR2016/CR2032 batteries — entirely independent of mains

Minimum UPS specification:

• Type: Line-interactive with automatic voltage regulation (AVR) — handles voltage sags common on rural power networks without switching to battery unnecessarily
• Output waveform: Pure sine wave (required for NVR HDD motors and networking hardware)
• VA rating: 1000 VA / 600W minimum
• Runtime at ~150W load (full Phase 2): approximately 25–35 minutes
• Runtime at ~80W load (Phase 1 camera count): approximately 45–60 minutes
• Recommended: 1500 VA / 900W if budget allows — extends runtime to ~40–55 minutes at full load, more appropriate for a rural site where power outages may be prolonged

Cross-System Interactions and Constraints

1. H.265 is a disqualifying camera procurement criterion, not a preference

The Lightwire upload ceiling (~5 Mbps) is only met with H.265-encoded camera sub-streams. Security integration confirms H.265 is mandatory. Any camera that does not support H.265 is disqualified from procurement — H.264 would break the bandwidth model.

2. EasyGate has no electronic log — gate camera is load-bearing for consent evidence

The EasyGate has no data output. In Phase 1, gate camera footage plus a manual PIN register are the sole gate access records. The gate camera must capture vehicle registration plates and driver identity at 1080p minimum, 25fps. This requirement is confirmed by both security integration and privacy/consent evidence requirements.

3. Internet failure and power failure are independent failure modes

Internet failure: NVR continues local recording; TL2803GR fails over to cellular; EasyGate continues on batteries. Power failure: NVR, PoE switch, and router lose mains; UPS bridges the gap; DSC HS2032 continues on its internal battery; EasyGate continues on batteries. No single point of failure locks out customers or disables security recording.

4. TL2803GR communicator — confirmed required platform

The compound requirements specify TL2803GR (IP + cellular dual-path) as mandatory for the Grade 3 target. TL280E (IP-only) is excluded. The ER706W being on UPS delays IP path loss during brief power cuts, reducing unnecessary cellular fallback events. If TL280E has been ordered in error, it must be exchanged before installation.

5. BWoF — infrastructure systems do not trigger it

The ER706W, TL-SG116P switch, NVR, cameras, and cabling are not Specified Systems under the Building (Specified Systems) Regulations 2005. BWoF is not triggered by any Phase 1 or Phase 2 infrastructure component. See compliance area documentation for the fire/security alarm BWoF boundary.

6. ONVIF Profile T required — impacts camera VLAN design

All cameras must support ONVIF Profile T (not Profile S alone, which is deprecated from March 2027). This is enforced at procurement. The VLAN 10 firewall rules must allow the ONVIF Profile T and RTSP ports required for NVR integration.

Source

Requirements drawn from knowledge/integration/security-infrastructure.md (version 3, last-updated 2026-04-09) and the compound bandwidth, VLAN, UPS, and offline-operation requirements documented there. A dedicated knowledge/tech/infrastructure-requirements.md Tier 1 file has not been read separately — the compound requirements document synthesises all infrastructure constraints from the underlying regulatory and technical source files.

Hardware Already Purchased

All of the following items are on-hand and ready for the Easter 2026 installation:

Still to procure before Easter 2026: alkathene conduit (2 x 100m rolls, 25mm) from Farmlands or RD1 Rotorua.

Bandwidth Requirements

The site uses a local NVR architecture. Cameras record to on-site storage; internet bandwidth is consumed only by remote live-view sessions and motion-event clip uploads.

H.265 is a mandatory disqualifying criterion for camera selection. H.264 would approximately double the live-view sub-stream bandwidth and could push concurrent upload demand above the Lightwire upload ceiling.

Upload consumption model:

Minimum plan requirement: 5 Mbps sustained upload, 10 Mbps download minimum. The Lightwire Unlimited plan meets this under typical conditions. Upload is not speed-guaranteed — a peak-hour speed test is required before launch.

Why continuous cloud upload is not used: Continuous upload of 4 cameras at 4MP H.265 would require approximately 6 Mbps upload, exceeding the Lightwire ceiling. NVR local-recording architecture avoids this entirely.

VLAN Separation Requirement

Two separate network segments are required. Mixing camera traffic with alarm and management traffic is not acceptable.

Inter-VLAN traffic must be blocked at the ER706W. Cameras must not be able to initiate connections to management devices. No port forwarding to any camera or NVR — Hik-Connect P2P relay eliminates this requirement.

Offline Operation Requirements

These requirements are mandatory and not relaxable at any phase.

UPS Specification

Required protection: The NVR, PoE switch (to keep cameras recording via PoE), and router (to maintain alarm IP path) must remain powered during brief outages.

Systems that must be on UPS:

Systems explicitly excluded from UPS load:

• DSC HS2032 alarm panel: carries its own internal sealed lead-acid battery (4+ hours standby); independent of UPS
• EasyGate pin pad: runs on its own CR2016/CR2032 batteries; independent of mains entirely

Minimum specification:

• Type: Line-interactive with AVR (not standby/offline — AVR required for rural voltage sags)
• Output waveform: Pure sine wave (required for NVR HDD motors)
• VA rating: 1000 VA / 600W minimum
• Runtime at ~150W (full Phase 2 load): approximately 25–35 minutes
• Runtime at ~80W (Phase 1 camera count): approximately 45–60 minutes
• Recommended: 1500 VA / 900W if budget allows — extends runtime to ~40–55 minutes at full load; rural power outages at this location may exceed urban norms

Power Circuit Requirements

A dedicated 10A general-purpose circuit is required at the shed for the IT and security equipment. This circuit must not be shared with roller door opener motors — motor load switching introduces voltage spikes that can damage sensitive electronics.

A licensed electrician must install this circuit in compliance with AS/NZS 3000:2018 (Wiring Rules). The OS2 fibre from the house is inherently electrically isolated (no metallic signal conductors), which eliminates ground loop risk between the house and shed.

Cabling Requirements

House-to-shed inter-building link:

200m OS2 LC-LC single-mode fibre buried in alkathene conduit. Minimum burial depth 300mm under paddock, 450mm under vehicle tracks. Leave a draw-wire in the conduit after installation for future cable addition.

Intra-shed camera cabling:

Cat6 UTP or FTP (shielded preferred in metal shed environment) for PoE camera runs. Conduit must be run to every planned camera position at initial installation — retrofitting conduit after fit-out is significantly more expensive. Runs are well under 100m per camera; no powered extenders required.

PoE standard: 802.3af (15.4W per port) is sufficient for Hikvision 4MP cameras (6–9W draw). The TL-SG116P supports 802.3at (PoE+, 30W per port), providing headroom for higher-draw hardware in future.

Standards and Compliance

Key Protocol Requirements