Architecture
The System
Everything below runs in your building. Pioneer designs and configures the software layer; a certified low-voltage / physical security install partner handles cameras, cable, readers, and strikes.
Why local matters
Cloud school platforms get breached constantly. 82% of K–12 schools experienced cyber threats in 2024; ransomware recovery averages about $2.28M; PowerSchool-class incidents have exposed 60M+ student records. SSNs, health files, and IEPs do not belong on a forever-rented cloud edge.
Cloud camera dashboards add another risk: if an attacker reaches the feed, they can see where people are in the building in real time. Pioneer’s stack below is local-first — video on a segmented VLAN in your building, not a public cloud login. Fewer remote doors into the surveillance path.
Mac Mini
The local brain. Hosts the application stack (via containers) for video, access automation, DNS filtering, VPN endpoints, monitoring, and backups. Quiet, efficient, and designed to live in a network closet — not a cloud region.
Protectli + OPNsense
A dedicated appliance runs OPNsense as the traffic authority between the internet and your segmented campus network. Policies decide which VLANs can talk, what leaves the building, and how remote access is gated.
Frigate NVR
On-premises network video recording with AI-assisted detection. Streams stay local. No per-camera cloud subscription. Events and retention live on hardware you control.
Listed door hardware + local automation
Door schedules and badge events run locally. A certified install partner mounts readers, strikes, and listed controllers; Pioneer configures access and alerts. Exterior / life-safety doors stay on listed hardware — not hobby boards as the system of record.
Emergency command modes
Full lockdown orchestration and fire-panel (FACP) integration need district policy plus AHJ / fire authority buy-in — so they are not required on the first install. Phase 1 is cameras, access, network, and Care. When you are ready, modes stay distinct (lockdown ≠ fire) and egress stays exit-out, not open-entry-in. See Emergency modes.
AdGuard
Local DNS filtering to block malicious and inappropriate destinations across VLANs — the category role often filled by cloud DNS products.
WireGuard
Modern, lean VPN for authorized administrators. Replaces the “pay per seat forever” VPN license model with a configuration you own.
Suricata
IDS/IPS integrated with the OPNsense edge. Watches traffic for attack patterns in real time and supports the segmented design.
Grafana
Dashboards and alerts for system health, uptime, and operational signals — so facilities and IT see the same picture.
Seven VLANs
Management, cameras, access control, staff, student/guest, servers, and IoT — each isolated by policy. Cameras and door controllers do not share a flat free-for-all with student devices.
Encrypted backups
Encrypted backup routines for configurations and critical data so a failed disk or closet incident does not erase the school’s security posture.
Role clarity: Pioneer is not the low-voltage contractor. Physical cameras, cabling, readers, and strikes are installed by a certified partner. Pioneer owns design, software configuration, grant filing from your brief, and the client relationship.