2nd this configuration. My firewall rules block all external camera traffic and Frigate (once configured) is superb at detecting people without false alerts. All recordings are stored locally. It is disturbing just how much traffic smart devices try to send to China and Amazon, even when not subscribed to cloud services.

Home Assistant makes everything ridiculously flexible and is configured to turn on camera sirens if someone is detected at night or while my alarm system is armed, and disable sirens and alerts when doors have been opened or the alarm has just been turned off. The open Wireguard ports appear closed to scanners so I'm also reasonably comfortable with network security.