Chicken Coop Surveillance
ESP32 & IoTESP32-CAM with Flask web interface and honeypot security system.
Technologies
- ESP32-CAM
- Flask
- Python
- Raspberry Pi
- NGINX
- Network Security
- Solar Power Electronics
What looks like a simple chicken coop camera is actually a fully self-contained IoT surveillance system with a layered security architecture — running entirely off solar power.
Hardware & Power System:
The control box houses an ECO-WORTHY PWM solar charge controller connected to a 12V LiFePO4 (Lithium Iron Phosphate) battery with 96Wh capacity. The ESP32-CAM modules are powered via the 5V USB outlet on the charge controller. A 12V digital timer is also connected to the system and can be used to control external 12V DC devices such as watering pumps or other loads on a programmable schedule — making the box a versatile off-grid control unit beyond just camera power. The entire system is solar powered, making it completely off-grid and maintenance free.
Software & Networking:
The Flask application and NGINX reverse proxy run locally on a Raspberry Pi, which also handles all routing and logging — serving as the central hub of the entire system. The video streams from the ESP32-CAM modules are served through the Flask web application, accessible from outside the local network via port forwarding. NGINX acts as a reverse proxy on port 80, forwarding traffic to the Flask app running internally on port 5004 — concealing the actual application port from the outside world.
Security Architecture
The system implements multiple security layers: Authentication — login required to access the live stream Brute force protection — the page locks after 10 failed login attempts Intrusion logging — every failed login attempt is recorded with timestamp, IP address, User Agent and the attempted password Honeypot endpoint — a fake /admin page mimics a real admin login but silently logs every visit and credential attempt without ever granting access Port 80 by design — deliberately exposed on the standard HTTP port to passively collect real-world bot and scanner behavior
The Honeypot in Action:
The honeypot log captures real intrusion attempts from external IPs — including devices running Linux/Android and macOS — probing the /admin endpoint. Every visit is timestamped and logged with the full User Agent string, building a passive dataset of real-world attack patterns over time. Two camera streams are accessible from the authenticated homepage, with a direct link to view the honeypot logs — all from a mobile-friendly interface.
Hardware & Power System:
The control box houses an ECO-WORTHY PWM solar charge controller connected to a 12V LiFePO4 (Lithium Iron Phosphate) battery with 96Wh capacity. The ESP32-CAM modules are powered via the 5V USB outlet on the charge controller. A 12V digital timer is also connected to the system and can be used to control external 12V DC devices such as watering pumps or other loads on a programmable schedule — making the box a versatile off-grid control unit beyond just camera power. The entire system is solar powered, making it completely off-grid and maintenance free.
Software & Networking:
The Flask application and NGINX reverse proxy run locally on a Raspberry Pi, which also handles all routing and logging — serving as the central hub of the entire system. The video streams from the ESP32-CAM modules are served through the Flask web application, accessible from outside the local network via port forwarding. NGINX acts as a reverse proxy on port 80, forwarding traffic to the Flask app running internally on port 5004 — concealing the actual application port from the outside world.
Security Architecture
The system implements multiple security layers: Authentication — login required to access the live stream Brute force protection — the page locks after 10 failed login attempts Intrusion logging — every failed login attempt is recorded with timestamp, IP address, User Agent and the attempted password Honeypot endpoint — a fake /admin page mimics a real admin login but silently logs every visit and credential attempt without ever granting access Port 80 by design — deliberately exposed on the standard HTTP port to passively collect real-world bot and scanner behavior
The Honeypot in Action:
The honeypot log captures real intrusion attempts from external IPs — including devices running Linux/Android and macOS — probing the /admin endpoint. Every visit is timestamped and logged with the full User Agent string, building a passive dataset of real-world attack patterns over time. Two camera streams are accessible from the authenticated homepage, with a direct link to view the honeypot logs — all from a mobile-friendly interface.
Highlights:
- Real time camera surveillance in an offgrid setting, with access from internet.
- Intrusion attempt logging with fake /admin page.
- Camera stream is hidden behind a reverse proxy.
- Page locks after 10 login attempts to prevent brute force intrusion.
×