Deploy Step-by-Step from Repository

This section will guide you through the FindFace Security step-by-step deployment process. Follow the instructions below minding the sequence.

In this section:

Install APT Repository

First of all, install the FindFace apt repository as follows:

  1. Download the installer file

  2. Put the .run file into some directory on the designated host (for example, /home/username).

  3. From this directory, make the .run file executable.

    chmod +x
  4. Execute the .run file.

    sudo ./

    The installer will ask you a few questions and perform several automated checks to ensure that the host meets the system requirements. Fill out the prompts appropriately once requested. The questions are the following:

    1. Product to install: FindFace Security.
    2. Installation type: repo: Don't install anything, just set up the APT repository.

    After that, the FindFace apt repository will be automatically installed.


As this installation type doesn’t provide installation of neural network models essential for the findface-extraction-api functioning, be sure to manually install them on the host(s) with findface-extraction-api.


FindFace Security requires such third-party software as PostgreSQL, Redis, etcd, and memcached. Do the following:

  1. Install the prerequisite packages as such:

    sudo apt update
    sudo apt install -y postgresql-9.5 redis-server etcd memcached
  2. Open the memcached configuration file. Set the maximum memory to use for items in megabytes: -m 512. Set the max item size: -I 16m. If one or both of these parameters are absent, simply add them in the file.

    sudo vi /etc/memcached.conf
    -m 512
    -I 16m
  3. Enable the prerequisite services autostart and launch the services:

    sudo systemctl enable postgresql@9.5-main.service redis-server etcd.service memcached.service
    sudo systemctl start postgresql@9.5-main.service redis-server etcd.service memcached.service

Provide Licensing

You receive a license file from your NTechLab manager. If you opt for the on-premise licensing, we will also send you a USB dongle.

The FindFace Security licensing is provided as follows:

  1. Deploy findface-ntls, license server in the FindFace core.


    There must be only one findface-ntls instance in each FindFace Security installation.


    In the findface-ntls configuration file, you can change the license folder and specify your proxy server IP address if necessary. You can also change the findface-ntls web interface remote access settings. See findface-ntls for details.

    sudo apt update
    sudo apt install -y findface-ntls
    sudo systemctl enable findface-ntls.service && sudo systemctl start findface-ntls.service
  2. Upload the license file via the findface-ntls web interface in one of the following ways:

    • Navigate to the findface-ntls web interface http://<NTLS_IP_address>:3185/#/. Upload the license file.


      Later on, use the FindFace Security main web interface to consult your license information, and upgrade or extend your license (Settings -> License).

    • Directly put the license file into the license folder (by default, /ntech/license, can be changed in the /etc/findface-ntls.cfg configuration file).

  3. For the on-premise licensing, insert the USB dongle into a USB port.

  4. If the licensable components are installed on remote hosts, specify the IP address of the findface-ntls host in their configuration files. See findface-extraction-api, findface-tarantool-server, Video face detection: findface-video-manager and findface-video-worker for details.

Deploy Main Database

In FindFace Security, the main system database is based on PostgreSQL. To deploy the main database, do the following:

  1. Using the PostgreSQL console, create a new user ntech and a database ffsecurity in PostgreSQL.

    sudo -u postgres psql
    postgres=# CREATE ROLE ntech WITH LOGIN;
    postgres=# CREATE DATABASE ffsecurity WITH OWNER ntech ENCODING 'UTF-8' LC_COLLATE='en_US.UTF-8' LC_CTYPE='en_US.UTF-8' TEMPLATE template0;


    To quit from the PostgreSQL console, type \q and press Enter.

  2. Allow authentication in PostgreSQL by UID of a socket client. Restart PostgreSQL.

    echo 'local all ntech peer' | sudo tee -a /etc/postgresql/9.5/main/pg_hba.conf
    sudo systemctl restart postgresql@9.5-main.service

Deploy FindFace Core

To deploy the FindFace core, do the following:


You can find the description of the FindFace core components and their configuration parameters in Architecture and Components in Depth.

  1. Install the FindFace core components:

    sudo apt update
    sudo apt install -y findface-tarantool-server findface-extraction-api findface-sf-api findface-upload findface-video-manager findface-video-worker


    To install the GPU-accelerated findface-extraction-api component, use findface-extraction-api-gpu instead of findface-extraction-api in the command.


    To install the GPU-accelerated findface-video-worker component, use findface-video-worker-gpu instead of findface-video-worker in the command.

  2. Open the findface-extraction-api configuration file (CPU or GPU service). Enable the quality_estimator to be able to estimate the face quality in a dossier.


    The minimum face quality in a dossier photo is set as MINIMUM_DOSSIER_QUALITY in /etc/ffsecurity/

    sudo vi /etc/findface-extraction-api.ini
    quality_estimator: true
  3. In the findface-extraction-api configuration file, enable recognition models for face features such as gender, age, emotions, glasses3, and/or beard, subject to your needs. Be sure to choose the right acceleration type for each model, matching the acceleration type of findface-extraction-api: CPU or GPU. Be aware that findface-extraction-api on CPU can work only with CPU-models, while findface-extraction-api on GPU supports both CPU- and GPU-models. See Face Features Recognition for details.

      age: faceattr/age.v1.cpu.fnk
      emotions: faceattr/emotions.v1.cpu.fnk
      face: face/elderberry_576.cpu.fnk
      gender: faceattr/gender.v2.cpu.fnk
      beard: faceattr/beard.v0.cpu.fnk
      glasses3: faceattr/glasses3.v0.cpu.fnk

    The following models are available:

    Face feature Acceleration Configuration file parameter
    face (biometry) CPU face: face/elderberry_576.cpu.fnk
    GPU face: face/elderberry_576.gpu.fnk
    age CPU age: faceattr/age.v1.cpu.fnk
    GPU age: faceattr/age.v1.gpu.fnk
    gender CPU gender: faceattr/gender.v2.cpu.fnk
    GPU gender: faceattr/gender.v2.gpu.fnk
    emotions CPU emotions: faceattr/emotions.v1.cpu.fnk
    GPU emotions: faceattr/emotions.v1.gpu.fnk
    glasses3 CPU glasses3: faceattr/glasses3.v0.cpu.fnk
    GPU glasses3: faceattr/glasses3.v0.gpu.fnk
    beard CPU beard: faceattr/beard.v0.cpu.fnk
    GPU beard: faceattr/beard.v0.gpu.fnk


    To disable a recognition model, simply pass an empty value to a relevant parameter. Do not remove the parameter itself as in this case the system will be searching for the default model.

      gender: ""
      age: ""
      emotions: ""
  4. Open the /etc/findface-video-worker.ini (/etc/findface-video-worker-gpu.ini) configuration file. In the mgr-static parameter, specify the findface-video-manager host IP address, which provides findface-video-worker with settings and the video stream list. In the capacity parameter, specify the maximum number of video streams to be processed by findface-video-worker.

    sudo vi /etc/findface-video-worker.ini
    sudo vi /etc/findface-video-worker-gpu.ini
  5. Enable the FindFace core services autostart and launch the services.

    sudo systemctl enable findface-extraction-api findface-sf-api findface-video-manager findface-video-worker
    sudo systemctl start findface-extraction-api findface-sf-api findface-video-manager findface-video-worker

Deploy FindFace Security Application Module and Biometric Database

To deploy the FindFace Security application module, do the following:

  1. Install the findface-security and ffsecurity-ui components.

    sudo apt update
    sudo apt install -y ffsecurity ffsecurity-ui
  2. Migrate the database architecture from FindFace Security to PostgreSQL, create user groups with predefined rights and the first user with administrator rights (a.k.a. Super Administrator).


    Super Administrator cannot be deprived of its rights, whatever the role.

    sudo findface-security migrate
    sudo findface-security create_groups
    sudo findface-security createsuperuser --username admin --email root@localhost
  3. Create a structure of the Tarantool-based biometric database.

    sudo findface-security make_tnt_schema | sudo tee /etc/ffsecurity/tnt-schema.lua
  4. Import the meta_scheme variable from the tnt-schema.lua file. Open the /etc/tarantool/instances.enabled/FindFace.lua configuration file. Before the FindFace.start section, add a line dofile("/etc/ffsecurity/tnt-schema.lua"). In the FindFace.start parameters, define meta_scheme=meta_scheme.

    sudo vi /etc/tarantool/instances.enabled/FindFace.lua
    FindFace.start("", 8101, {
        meta_scheme = meta_scheme
  5. Enable the findface-tarantool-server service autostart and launch the service.

    sudo systemctl enable tarantool@FindFace.service && sudo systemctl start tarantool@FindFace.service
  6. Open the /etc/ffsecurity/ configuration file. Specify the following parameters:

    • EXTERNAL_ADDRESS: external IP address or URL that will be used to access the FindFace Security web interface.
    • VIDEO_DETECTOR_TOKEN: to authorize the video face detection module, come up with a token and specify it here.
    • VIDEO_MANAGER_ADDRESS: IP address of the findface-video-manager host.
    • NTLS_HTTP_URL: IP address of the findface-ntls host.
    • ROUTER_URL: IP address of the findface-security host that will receive detected faces from the findface-video-worker instance(s). Specify either external or internal IP address, subject to the network through which findface-video-worker interacts with findface-security.
    • SF_API_ADDRESS: IP address of the findface-sf-api host.


    If necessary, ensure data security by enabling SSL.


    If necessary, set ’IGNORE_UNMATCHED’: True to disable logging events for faces which have no match in the dossiers (negative verification result). Enable this option if the system has to process a large number of faces. The face similarity threshold for verification is defined by the CONFIDENCE_THRESHOLD parameter.


    It is recommended to change the MINIMUM_DOSSIER_QUALITY default value. This parameter determines the minimum quality of a face in a dossier photo. Photos containing faces of worse quality will be rejected when uploading to a dossier. Upright faces in frontal position are considered the best quality. They result in values around 0, mostly negative (such as -0.00067401276, for example). Inverted faces and large face angles are estimated with negative values some -5 and less. By default, ’MINIMUM_DOSSIER_QUALITY’: -2 which is the average quality.


    If you enabled recognition models in the findface-extraction-api configuration file, add the following line in the FFSECURITY section: ‘EVENTS_FEATURES’: [‘gender’, ‘age’, ‘emotions’, ‘beard’, ‘glasses’], subject to the list of enabled models. This line must be placed between SF_API_ADDRESS and LIVENESS_THRESHOLD as shown in the example below. See Face Features Recognition for details.

    sudo vi /etc/ffsecurity/
    MEDIA_ROOT = "/var/lib/ffsecurity/uploads"
    STATIC_ROOT = "/var/lib/ffsecurity/static"
    DEBUG = False
    LANGUAGE_CODE = 'en-us'
       'default': {
           'ENGINE': 'django.db.backends.postgresql',
           'NAME': 'ffsecurity',
    # use pwgen -sncy 50 1|tr "'" "." to generate your own unique key
    SECRET_KEY = 'c8b533847bbf7142102de1349d33a1f6'
       'VIDEO_DETECTOR_TOKEN': '381b0f4a20495227d04185ab02f5085f',
       'IGNORE_UNMATCHED': False,
       'EXTRACTION_API': '',
       'EVENTS_MAX_AGE': 30,
       'NTLS_HTTP_URL': '',
       'ROUTER_URL': '',
       'SF_API_ADDRESS': '',
       'EVENTS_FEATURES': ['gender', 'age', 'emotions', 'beard', 'glasses'],
       'LIVENESS_THRESHOLD': 0.945,
       'BEARD_THRESHOLD': 0.7,
       'workers': 4,
       'host': 'localhost',
       'port': 8002,
       "event": {
           "features": {
               "f_gender_class": ["male", "female"],
               "age": {
                   "f_age_gte": "",
                   "f_age_lte": ""
               "f_emotions_class": ["angry", "disgust", "fear", "happy", "sad", "surprise"],
               "f_glasses_class": ["none", "eye", "sun"],
               "f_beard_class": ["none", "beard"],
               "f_liveness_class": ["real", "fake"],
    # integration plugins
    INSTALLED_APPS.append('ffsecurity_genetec')  # remove or comment out this line to disable genetec integration
  7. Generate a signature key for the session encryption (used by Django) by executing: pwgen -sncy 50 1|tr “’” “.”. Specify this key as SECRET_KEY.

  8. Start the services.

    sudo systemctl enable findface-security
    sudo systemctl start findface-security
  9. Disable the default nginx server and add the findface-security server to the list of enabled servers. Restart nginx.

    sudo rm /etc/nginx/sites-enabled/default
    sudo ln -s /etc/nginx/sites-available/ffsecurity-nginx.conf /etc/nginx/sites-enabled/
    sudo nginx -s reload