.. _step-by-step: Deploy Step-by-Step from Repository --------------------------------------------------------------- This section will guide you through the FindFace Security step-by-step deployment process. Follow the instructions below minding the sequence. .. rubric:: In this section: .. contents:: :local: .. _install-repo: Install APT Repository ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ First of all, install the FindFace apt repository as follows: #. Download the installer file ``findface-security-and-server-4.4.run``. #. Put the ``.run`` file into some directory on the designated host (for example, ``/home/username``). #. From this directory, make the ``.run`` file executable. .. code:: chmod +x findface-security-and-server-4.4.run #. Execute the ``.run`` file. .. code:: sudo ./findface-security-and-server-4.4.run The installer will ask you a few questions and perform several automated checks to ensure that the host meets the system requirements. Fill out the prompts appropriately once requested. The questions are the following: #. Product to install: ``FindFace Security``. #. Installation type: ``repo: Don't install anything, just set up the APT repository``. #. Neural network models to install if necessary. To select a model(s), deselect all those on the list by entering ``-*`` in the command line first, then select the required model by entering its sequence number (keyword): for example, ``1 3``. Enter done to save your selection and proceed to another step. .. important:: At least one model for face biometry has to be installed. After that, the FindFace apt repository will be automatically installed. .. _prerequisites: Prerequisites ^^^^^^^^^^^^^^^^^^^^^ FindFace Security requires such third-party software as PostgreSQL, Pgbouncer, Redis, etcd, and memcached. Do the following: #. Install the prerequisite packages as such: .. code:: sudo apt update sudo apt install -y postgresql-10 redis-server etcd memcached pgbouncer #. Open the ``memcached`` configuration file. Set the maximum memory to use for items in megabytes: ``-m 1024``. Set the max item size: ``-I 16m``. If one or both of these parameters are absent, simply add them in the file. .. code:: sudo vi /etc/memcached.conf -m 1024 -I 16m #. Give a strong password to the ``ntech`` user (``9T3g1nXy9yx3y8MIGm9fbef3dia8UTc3`` in the example below). Output the credentials to the ``pgbouncer`` user list. .. code:: echo '"ntech" "9T3g1nXy9yx3y8MIGm9fbef3dia8UTc3"' | sudo tee -a /etc/pgbouncer/userlist.txt #. Configure ``pgbouncer``. In ``/etc/pgbouncer/pgbouncer.ini``, add the ``ffsecurity`` database to the ``databases`` section. Configure named parameters, as shown in the example below. Parameters other than those must be commented out. .. code:: sudo vi /etc/pgbouncer/pgbouncer.ini [databases] ffsecurity = dbname=ffsecurity host=localhost port=5432 user=ntech [pgbouncer] logfile = /var/log/postgresql/pgbouncer.log pidfile = /var/run/postgresql/pgbouncer.pid listen_addr = 127.0.0.1 listen_port = 5439 unix_socket_dir = /var/run/postgresql auth_type = plain auth_file = /etc/pgbouncer/userlist.txt pool_mode = transaction server_reset_query = DISCARD ALL max_client_conn = 16384 default_pool_size = 20 syslog = 1 #. Enable the prerequisite services autostart and launch the services: .. code:: sudo systemctl enable postgresql@10-main.service redis-server etcd.service memcached.service pgbouncer.service sudo systemctl start postgresql@10-main.service redis-server etcd.service memcached.service pgbouncer.service .. _licensing: Provide Licensing ^^^^^^^^^^^^^^^^^^^^^^^^ .. seealso:: :ref:`licensing-principles` You receive a license file from your NTechLab manager. If you opt for the on-premise licensing, we will also send you a USB dongle. The FindFace Security licensing is provided as follows: #. Deploy ``findface-ntls``, license server in the FindFace core. .. important:: There must be only one ``findface-ntls`` instance in each ``FindFace Security`` installation. .. tip:: In the ``findface-ntls`` configuration file, you can change the license folder and specify your proxy server IP address if necessary. You can also change the ``findface-ntls`` web interface remote access settings. See :ref:`ntls-config` for details. .. code:: sudo apt update sudo apt install -y findface-ntls sudo systemctl enable findface-ntls.service && sudo systemctl start findface-ntls.service #. Upload the license file via the ``findface-ntls`` web interface in one of the following ways: * Navigate to the ``findface-ntls`` web interface ``http://:3185/#/``. Upload the license file. .. tip:: Later on, use the FindFace Security main web interface to consult your license information, and upgrade or extend your license (:menuselection:`Settings -> License`). * Directly put the license file into the license folder (by default, ``/opt/ntech/license``, can be changed in the ``/etc/findface-ntls.cfg`` configuration file). #. For the on-premise licensing, insert the USB dongle into a USB port. #. If the licensable components are installed on remote hosts, specify the IP address of the ``findface-ntls`` host in their configuration files. See :ref:`extraction-api-config`, :ref:`tarantool-server-config`, :ref:`video-config` for details. .. seealso:: :ref:`licensing-principles` Deploy Main Database ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ In FindFace Security, the main system database is based on PostgreSQL. To deploy the main database, do the following: #. Open the ``pgbouncer`` list of users ``/etc/pgbouncer/userlist.txt``. Copy the ``ntech`` user's password (``9T3g1nXy9yx3y8MIGm9fbef3dia8UTc3`` in the example below). .. code:: sudo cat /etc/pgbouncer/userlist.txt "ntech" "9T3g1nXy9yx3y8MIGm9fbef3dia8UTc3" #. Using the :program:`PostgreSQL` console, create a new user ``ntech`` with the copied password, and databases ``ffsecurity`` and ``ffcounter`` in PostgreSQL. .. code:: sudo -u postgres psql postgres=# CREATE ROLE ntech WITH LOGIN PASSWORD '9T3g1nXy9yx3y8MIGm9fbef3dia8UTc3'; postgres=# CREATE DATABASE ffsecurity WITH OWNER ntech ENCODING 'UTF-8' LC_COLLATE='en_US.UTF-8' LC_CTYPE='en_US.UTF-8' TEMPLATE template0; postgres=# CREATE DATABASE ffcounter WITH OWNER ntech ENCODING 'UTF-8' LC_COLLATE='C.UTF-8' LC_CTYPE='C.UTF-8' TEMPLATE template0; .. tip:: To quit from the :program:`PostgreSQL` console, type ``\q`` and press :kbd:`Enter`. #. Allow authentication by UID of a socket client in :program:`PostgreSQL`. Restart :program:`PostgreSQL`. .. code:: echo 'local all ntech peer' | sudo tee -a /etc/postgresql/10/main/pg_hba.conf sudo systemctl restart postgresql@10-main.service .. _findface-extraction-api: Deploy FindFace Core ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ To deploy the FindFace core, do the following: .. tip:: You can find the description of the FindFace core components and their configuration parameters in :ref:`architecture` and :ref:`components`. #. For FindFace Security on GPU, :ref:`install NVIDIA drivers `. #. Install the FindFace core components: .. code:: sudo apt update sudo apt install -y findface-tarantool-server findface-extraction-api findface-sf-api findface-upload findface-video-manager findface-video-worker-cpu .. note:: To install the GPU-accelerated ``findface-extraction-api`` component, use ``findface-extraction-api-gpu`` instead of ``findface-extraction-api`` in the command. .. note:: To install the GPU-accelerated ``findface-video-worker`` component, use ``findface-video-worker-gpu`` instead of ``findface-video-worker-cpu`` in the command. If you have several video cards on your server, see :ref:`video-cards`. .. important:: Be sure to :ref:`manually install ` neural network models on the host(s) with ``findface-extraction-api``. #. In the ``findface-sf-api`` configuration file, enable the ``allow-return-facen`` parameter. .. code:: sudo vi /etc/findface-sf-api.ini ... limits: ... allow-return-facen: true ... #. In the ``findface-extraction-api`` configuration file, enable recognition models for face features such as gender, age, emotions, glasses, beard, and face mask, subject to your needs. Be sure to choose the right acceleration type for each model, matching the acceleration type of ``findface-extraction-api``: CPU or GPU. Be aware that ``findface-extraction-api`` on CPU can work only with CPU-models, while ``findface-extraction-api`` on GPU supports both CPU- and GPU-models. See :ref:`face-features` for details. .. code:: sudo vi /etc/findface-extraction-api.ini models: age: faceattr/age.v1.cpu.fnk emotions: faceattr/emotions.v1.cpu.fnk face: face/ifruit_320.cpu.fnk gender: faceattr/gender.v2.cpu.fnk beard: faceattr/beard.v0.cpu.fnk glasses3: faceattr/glasses3.v0.cpu.fnk medmask3: faceattr/medmask3.v2.cpu.fnk The following models are available: +------------------+--------------+--------------------------------------------------------------------------------+ | Face feature | Acceleration | Configuration file parameter | +==================+==============+================================================================================+ | face | CPU | ``face: face/ifruit_320.cpu.fnk`` ``face: face/ifruit_160.cpu.fnk`` | | (biometry) +--------------+--------------------------------------------------------------------------------+ | | GPU | ``face: face/ifruit_320.gpu.fnk`` ``face: face/ifruit_160.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ | age | CPU | ``age: faceattr/age.v1.cpu.fnk`` | | +--------------+--------------------------------------------------------------------------------+ | | GPU | ``age: faceattr/age.v1.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ | gender | CPU | ``gender: faceattr/gender.v2.cpu.fnk`` | | +--------------+--------------------------------------------------------------------------------+ | | GPU | ``gender: faceattr/gender.v2.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ | emotions | CPU | ``emotions: faceattr/emotions.v1.cpu.fnk`` | | +--------------+--------------------------------------------------------------------------------+ | | GPU | ``emotions: faceattr/emotions.v1.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ | glasses | CPU | ``glasses3: faceattr/glasses3.v0.cpu.fnk`` | | +--------------+--------------------------------------------------------------------------------+ | | GPU | ``glasses3: faceattr/glasses3.v0.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ | beard | CPU | ``beard: faceattr/beard.v0.cpu.fnk`` | | +--------------+--------------------------------------------------------------------------------+ | | GPU | ``beard: faceattr/beard.v0.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ | face mask | CPU | ``medmask3: faceattr/medmask3.v2.cpu.fnk`` | | +--------------+--------------------------------------------------------------------------------+ | | GPU | ``medmask3: faceattr/medmask3.v2.gpu.fnk`` | +------------------+--------------+--------------------------------------------------------------------------------+ .. tip:: To disable a recognition model, simply pass an empty value to a relevant parameter. Do not remove the parameter itself as in this case the system will be searching for the default model. .. code:: models: gender: "" age: "" emotions: "" #. Open the ``/etc/findface-video-worker-cpu.ini`` (``/etc/findface-video-worker-gpu.ini``) configuration file. In the ``mgr-static`` parameter, specify the ``findface-video-manager`` host IP address, which provides ``findface-video-worker`` with settings and the video stream list. In the ``capacity`` parameter, specify the maximum number of video streams to be processed by ``findface-video-worker``. In the ``streamer`` section, specify the IP address and port to access the :ref:`video wall `. The streamer ``port`` must be set to ``18999``. .. code:: sudo vi /etc/findface-video-worker-cpu.ini sudo vi /etc/findface-video-worker-gpu.ini mgr-static=127.0.0.1:18811 capacity=10 [streamer] #------------------------------ ## streamer/shots webserver port, 0=disabled ## type:number env:CFG_STREAMER_PORT longopt:--streamer-port port = 18999 ## streamer url - how to access this worker on streamer_port ## type:string env:CFG_STREAMER_URL longopt:--streamer-url url = 127.0.0.1:18999 #. Enable the FindFace core services autostart and launch the services. .. code:: sudo systemctl enable findface-extraction-api findface-sf-api findface-video-manager findface-video-worker-cpu sudo systemctl start findface-extraction-api findface-sf-api findface-video-manager findface-video-worker-cpu .. note: The same commands for ``findface-video-worker-gpu`` are as such: .. code:: sudo systemctl enable findface-video-worker-gpu sudo systemctl start findface-video-worker-gpu Deploy FindFace Security Application Module and Biometric Database ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ To deploy the FindFace Security application module, do the following: #. Install the ``findface-security``, ``findface-security-ui``, and ``findface-counter`` components. Enable the ``findface-counter`` autostart and launch the service. .. code:: sudo apt update sudo apt install -y findface-security findface-security-ui findface-counter sudo systemctl enable findface-counter && sudo systemctl start findface-counter #. Migrate the database architecture from FindFace Security to :program:`PostgreSQL`, create user groups with :ref:`predefined ` rights and the first user with administrator rights (a.k.a. Super Administrator). .. important:: Super Administrator cannot be deprived of its rights, whatever the role. .. code:: sudo findface-security migrate sudo findface-security create_groups sudo findface-security create_default_user #. Create a structure of the Tarantool-based biometric database. .. code:: sudo findface-security make_tnt_schema | sudo tee /etc/findface-security/tnt_schema.lua #. Open the ``/etc/tarantool/instances.available/FindFace.lua`` configuration file. Check whether it contains the ``dofile`` command, ``meta_indexes`` and ``meta_scheme`` definitions, as in the example below. .. code:: sudo vi /etc/tarantool/instances.available/FindFace.lua dofile("/etc/findface-security/tnt_schema.lua") -- host:port to bind, HTTP API FindFace = require("FindFace") FindFace.start("127.0.0.1", 8101, { license_ntls_server="127.0.0.1:3133", meta_indexes=meta_indexes, meta_scheme = meta_scheme }) #. Enable the ``findface-tarantool-server`` service autostart and launch the service. .. code:: sudo systemctl enable tarantool@FindFace.service && sudo systemctl start tarantool@FindFace.service #. Open the ``/etc/findface-security/config.py`` configuration file. Specify the following parameters: * ``SERVICE_EXTERNAL_ADDRESS``: FindFace Security IP address or URL prioritized for the Genetec integration and webhooks. Once this parameter not specified, the system uses ``EXTERNAL_ADDRESS`` for these purposes. To use Genetec and webhooks, be sure to specify at least one of those parameters: ``SERVICE_EXTERNAL_ADDRESS``, ``EXTERNAL_ADDRESS``. * ``EXTERNAL_ADDRESS``: (Optional) IP address or URL that can be used to access the FindFace Security web interface. Once this parameter not specified, the system auto-detects it as the external IP address. To access FindFace Security, you can use both the auto-detected and specified IP addresses. * ``VIDEO_DETECTOR_TOKEN``: to authorize the video face detection module, come up with a token and specify it here. * ``VIDEO_MANAGER_ADDRESS``: IP address of the ``findface-video-manager`` host. * ``NTLS_HTTP_URL``: IP address of the ``findface-ntls`` host. * ``ROUTER_URL``: IP address of the ``findface-security`` host that will receive detected faces from the ``findface-video-worker`` instance(s). Specify either external or internal IP address, subject to the network through which ``findface-video-worker`` interacts with ``findface-security``. Change the default port, subject to the :ref:`redirect settings ` from HTTP to HTTPS, or omit it leaving only the IP address. * ``SF_API_ADDRESS``: IP address of the ``findface-sf-api`` host. * ``DATABASES`` (section): fill it in as such: ``'PORT': 5439, 'USER': 'ntech', 'PASSWORD': ''`` (see :ref:`prerequisites`). .. tip:: If necessary, ensure data security by enabling :ref:`SSL `. .. tip:: If necessary, set ``’IGNORE_UNMATCHED’: True`` to disable logging events for faces which have no match in the dossiers (negative verification result). Enable this option if the system has to process a large number of faces. The face similarity threshold for verification is defined by the ``CONFIDENCE_THRESHOLD`` parameter. .. tip:: It is NOT recommended to change the ``MINIMUM_DOSSIER_QUALITY`` default value. This parameter determines the minimum quality of a face in a dossier photo. Photos containing faces of worse quality will be rejected when uploading to a dossier. Upright faces in frontal position are considered the best quality. .. important:: If you enabled recognition models in the ``findface-extraction-api`` configuration file, add the following line in the ``FFSECURITY`` section: 'EVENTS_FEATURES': ['gender', 'age', 'emotions', 'beard', 'glasses', 'medmask'], subject to the list of enabled models. This line must be placed between ``SF_API_ADDRESS`` and ``LIVENESS_THRESHOLD`` as shown in the example below. See :ref:`face-features` for details. .. code:: sudo vi /etc/findface-security/config.py # ============================================================================== # FindFace Security configuration file # ============================================================================== # # This config file is written in Python's syntax and interpreted at FindFace Security # service startup. You have to restart the service in order to apply changes. # # If you have any questions or suggestions, please contact us at support@ntechlab.com # ============================================================================== # GENERAL SETTINGS # ============================================================================== # enables additional logs DEBUG = False # media files directory MEDIA_ROOT = "/var/lib/findface-security/uploads" # static files directory STATIC_ROOT = "/var/lib/findface-security/static" # language code LANGUAGE_CODE = 'en-us' # time zone TIME_ZONE = 'UTC' # Database is used by FindFace Security to store cameras, # camera groups, watchlists and so on. Only PostgreSQL is supported. DATABASES = { 'default': { 'ENGINE': 'django.db.backends.postgresql', 'DISABLE_SERVER_SIDE_CURSORS': True, 'NAME': 'ffsecurity', 'PORT': 5439, 'USER': 'ntech', 'PASSWORD': 'g3PNKWnh6EABpxiYqWp9Lsw9hmPLwknQ' } } # Signature key for session encryption # Use pwgen -sncy 50 1|tr "'" "." to generate your own unique key SECRET_KEY = '2d294d1fbc7c0bf76e26e718b5f2eacf' # ============================================================================== # FINDFACE SECURITY SETTINGS # ============================================================================== # SERVICE_EXTERNAL_ADDRESS is prioritized for FFSecurity webhooks and Genetec plugin. # EXTERNAL_ADDRESS is used instead if SERVICE_EXTERNAL_ADDRESS is not provided. # You must provide either SERVICE_EXTERNAL_ADDRESS or EXTERNAL_ADDRESS in order # to be able to work with FFSecurity webhooks and Genetec plugin. SERVICE_EXTERNAL_ADDRESS = 'http://172.20.77.117' # EXTERNAL_ADDRESS is used to access objects created inside FFSecurity via external links. EXTERNAL_ADDRESS = '' # - Base FFSecurity settings - # enable permissions system ENABLE_ACL = True FFSECURITY = { # findface-video-worker authorization token 'VIDEO_DETECTOR_TOKEN': '0b600a94fe39c73e681a5f0da917efd0', # base face matching confidence threshold 'CONFIDENCE_THRESHOLD': 0.739, # episodes specific matching threshold that is used to join faces in an episode 'EPISODES_THRESHOLD': 0.689, # minimum face quality sufficient to add it to a dossier 'MINIMUM_DOSSIER_QUALITY': 0.45, # do not save unmatched events (GDPR support) 'IGNORE_UNMATCHED': False, # blur all unmatched faces on the full frame of the matched event (GDPR support) 'BLUR_UNMATCHED_FACES': False, # full frame jpeg quality when `BLUR_UNMATCHED_FACES` is enabled 'BLURRED_FULLFRAME_JPEG_QUALITY': 85, # matched events older than EVENTS_MAX_MATCHED_AGE will be automatically # deleted (every night at 1:17 am by default) 'EVENTS_MAX_MATCHED_AGE': 0, # same as above but for unmatched events 'EVENTS_MAX_UNMATCHED_AGE': 30, # same as EVENTS_MAX_MATCHED_AGE but for matched full frame images only (thumbnails won't be deleted) 'EVENTS_MAX_FULLFRAME_UNMATCHED_AGE': 30, # same as above but for unmatched full frame images only (thumbnails won't be deleted) 'EVENTS_MAX_FULLFRAME_MATCHED_AGE': 30, # same as above but for counter records 'COUNTER_RECORDS_MAX_AGE': 30, # same as above but for person events (if no person events left in person, it is deleted too) 'PERSON_EVENTS_MAX_AGE': 90, # when closing episode, delete all events except the best episode event 'EPISODE_KEEP_ONLY_BEST_EVENT': False, # NTLS licence server url 'NTLS_HTTP_URL': 'http://127.0.0.1:3185', # findface-video-worker face posting address, # it must be set to either FFSecurity EXTERNAL_ADDRESS (by default) # or findface-facerouter url (in some specific cases) 'ROUTER_URL': 'http://127.0.0.1', # send serialized dossiers, dossier-lists, camera and camera groups in webhooks 'VERBOSE_WEBHOOKS': False, # jpeg quality used when saving thumbnails 'THUMBNAIL_JPEG_QUALITY': 75, # FFServer services urls 'VIDEO_MANAGER_ADDRESS': 'http://127.0.0.1:18810', 'SF_API_ADDRESS': 'http://127.0.0.1:18411', 'FFCOUNTER_ADDRESS': 'http://127.0.0.1:18300', # upload video archives to this path, it differs from media root and # you have to change alias in corresponding nginx location also (/videos/) 'VIDEO_ARCHIVE_UPLOAD_PATH': '/var/lib/findface-security/uploads/videos/', # additional events features. # make sure that corresponding extractors # are licensed and enabled at findface-extraction-api config file. # available features are: gender, age, emotions, beard, glasses, medmask. 'EVENTS_FEATURES': [], # feature specific confidence thresholds 'LIVENESS_THRESHOLD': 0.75, 'EMOTIONS_THRESHOLD': 0.25, 'BEARD_THRESHOLD': 0.7, # counters full frame saving options: # `always` - save always # `detect` - save only if faces or silhouettes have been detected # `never` - never save full frames 'COUNTERS_SAVE_FULLFRAME': 'always', 'COUNTERS_FULLFRAME_JPEG_QUALITY': 75, 'COUNTERS_THUMBNAIL_JPEG_QUALITY': 75, # max camera frames_dropped percent 'MAX_CAMERA_DROPPED_FRAMES': {'yellow': 0.1, 'red': 0.3}, # max camera faces_failed percent 'MAX_CAMERA_FAILED_FACES': {'yellow': 0.1, 'red': 0.3}, # -- Persons configuration -- # rrule (recurrence rule) for scheduling persons clusterization # WARNING: all scheduling works with UTC time and NOT aware of any timezone 'PERSONS_CLUSTERIZATION_SCHEDULE': 'RRULE:FREQ=DAILY;INTERVAL=1;WKST=MO;BYHOUR=0;BYMINUTE=0', # face to person matching confidence threshold 'PERSONS_CONFIDENCE_THRESHOLD': 0.739, # minimum required face quality for person creation 'PERSON_EVENT_MIN_QUALITY': 0.45, # minimum required number events in episode for person creation 'PERSON_EVENT_MIN_EPISODE_EVENTS': 1, # maximum concurrent video manager jobs for video archives processing 'MAX_VIDEO_ARCHIVE_JOBS': 3, # reports image saving options 'REPORT_THUMBNAIL_JPEG_QUALITY': 75, 'REPORT_THUMBNAIL_MAX_HEIGHT': 100, 'REPORT_FULLFRAME_JPEG_QUALITY': 75, 'REPORT_FULLFRAME_MAX_HEIGHT': 250, # -- Optional parameters -- # Edit CUSTOM_FIELDS->dossier_meta section to customize dossier content. # Below is an example for integration FindFace Security with Sigur. # Edit CUSTOM_FIELDS->dossier_face section to customize dossier face content. # Below is an example with every field type possible. # 'CUSTOM_FIELDS': { # 'dossier_meta': { # 'items': [ # { # 'name': 'personid', # 'default': '', # 'label': 'PersonID', # 'display': ['list', 'form'], # 'description': 'Sigur person ID' # }, # { # 'name': 'firstname', # 'default': '', # 'label': 'First Name', # 'display': ['list', 'form'], # 'description': 'Sigur first name' # }, # { # 'name': 'lastname', # 'default': '', # 'label': 'Last Name', # 'display': ['list', 'form'], # 'description': 'Sigur last name' # }, # { # 'name': 'version', # 'default': '', # 'label': 'Version', # 'display': ['list', 'form'], # 'description': 'Sigur photo version' # } # ], # 'filters': [ # { # 'name': 'personid', # 'label': 'Sigur person ID filter', # 'field': 'personid' # } # ] # }, # 'dossier_face': { # 'items': [ # { # "field_name": "tag_name_1", # "type": "string", # "default": "change_me" # }, # { # "field_name": "tag_name_2", # "type": "uint", # "default": 123 # }, # { # "field_name": "tag_name_3", # "type": "bool", # "default": True # }, # ] # } # }, # maximum event age in seconds than could be added to an episode. # 'EPISODE_SEARCH_INTERVAL': 60, # If none of these events matched, new episode is created. # maximum episode duration (episode is closed after) # 'EPISODE_MAX_DURATION': 300, # if no new event added to an episode during this timeout, episode will be closed. # 'EPISODE_EVENT_TIMEOUT': 30, # maximum created thumbnail width # 'THUMBNAIL_MAX_WIDTH': 320, # url of the backend which is used for social network search. # contact support for additional information. # 'SOCIAL_BACKEND': None, # additional social backend headers. # 'SOCIAL_HEADERS': {}, # unacknowledged events notification interval # 'UNACKNOWLEDGED_NOTIFY_INTERVAL': 1, # set to True to run all media requests (photos, attachments) through the # django application for acl checks. # enabling this setting slightly increases security but # has severe negative effects on performance. # you will also have to mark /uploads/ location as 'internal' in nginx config # # 'OVERPROTECT_MEDIA': False, } # - FindFace Security user interface configuration dictionary - FFSECURITY_UI_CONFIG = { "event": { "features": { "f_gender_class": ["male", "female"], "age": { "f_age_gte": "", "f_age_lte": "" }, "f_emotions_class": ["angry", "disgust", "fear", "happy", "sad", "surprise", "neutral"], "f_glasses_class": ["none", "eye", "sun"], "f_beard_class": ["none", "beard"], "f_liveness_class": ["real", "fake"], "f_medmask_class": ["none", "incorrect", "correct"], } }, # Adjustable confidence threshold presets for face matching. # Please consult with our support before changing. "confidence_display": [ {"confidence": 0.00, "color": "#000000", "label": {"ru": "Очень низкий", "en": "Very Low"}}, {"confidence": 0.65, "color": "#FF0300", "label": {"ru": "Низкий", "en": "Low"}}, {"confidence": 0.70, "color": "#FFB700", "label": {"ru": "Пониженный", "en": "Slightly Low"}}, {"confidence": 0.72, "color": "#B8FA00", "label": {"ru": "Нормальный", "en": "Moderate"}}, {"confidence": 0.75, "color": "#7EFF2B", "label": {"ru": "Повышенный", "en": "Slightly High"}}, {"confidence": 0.80, "color": "#4DFF60", "label": {"ru": "Высокий", "en": "High"}}, {"confidence": 0.85, "color": "#1DFF96", "label": {"ru": "Очень высокий", "en": "Very High"}}, ] } # -- ASGI-server configuration -- # consult support before changing these settings. # per worker thread pool size. ASGI_THREADS = 32 UVICORN_SETTINGS = { # worker processes count, 'auto' sets it to logical cpu count 'workers': 'auto', 'host': 'localhost', 'port': 8002, # websocket worker processes count, # 'auto' sets it to logical cpu count, but not more than 8. 'ws-workers': 'auto', 'ws-host': 'localhost', 'ws-port': 8003, } # disable unused services to increase # overall system performance in some cases. SERVICES = { "ffsecurity": { "episodes": True, "webhooks": True, # use queue manager to prevent drops of video archive events "video_archive_events_manager": True, "persons": False, } } # -- Other settings -- # The number of threads in the night clusterization. # Not recommended values are greater than the number of cores in the processor. # Consult with support before changing this value. NUMPY_OMP_NUM_THREADS = 'auto' # ============================================================================== # FINDFACE SECURITY PLUGINS # ============================================================================== # Uncomment lines below to enable plugins. Please consult documentation for # a plugin specific settings. # =============== Axxon ================ # INSTALLED_APPS.append('ffsecurity_axxon') # AXXON = [ # { # 'name': 'server_name', # 'api': 'http://example.com/', # 'rtsp': 'rtsp://example.com:554/', # 'user': 'user', # 'password': 'password', # } # ] # FFSECURITY_UI_CONFIG['dossier'] = { # 'video': True, # } # =============== Genetec ================ # INSTALLED_APPS.append('ffsecurity_genetec') # ================ Sova ================== # INSTALLED_APPS.append('ffsecurity_sova') # ================ Sigur ================= # keep in mind, that SIGUR plugin also uses CUSTOM_FIELDS and THUMBNAIL_MAX_WIDTH settings # INSTALLED_APPS.append('ffsecurity_sigur') # SIGUR = { # 'LOGIN': 'admin', # 'PASSWORD': 'admin', # 'MF_SELECTOR': 'biggest', # what to do with several faces in sigur person photo; allowed ['biggest', 'reject'] # 'ONLY_RT_EVENTS': True, # only events with bs_type == realtime, # 'EVENT_DELAY': 0.004 # minimum time between two events of same person in seconds. If interval between two events with same person is less, than this value, second event will be dropped # } # ======= CryptoPRO authentication ======= # INSTALLED_APPS.append('ffsecurity_cproauth') # REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] = [ # 'ffsecurity.auth.TokenAuthentication', # 'ffsecurity_cproauth.auth.CryptoProOrTokenAuthentication' # ] # ========== DossierLists sync =========== # INSTALLED_APPS.append('ffsecurity_sync') # token must be identical on master and slave # use pwgen -s 64 1 # SYNC_TOKEN = 'change_me' # SYNC_TIME = { # # 24 hour format # 'hour': 3, # 'minute': 0, # } # ============== Puppeteer =============== # INSTALLED_APPS.append('ffsecurity_puppeteer') # PUPPETEER_CONFIG = { # 'UNSAVED_RESULTS_DELETION_TIMEOUT': 3600, # maximum lifetime of search results not saved involuntarily # 'REMOTE_MONITORING_SYNC_INTERVAL': 600, # monitoring data synchronization interval, seconds # 'ENABLE_DAILY_SEARCH': True, # daily search activation (default False) # 'DAILY_SEARCH_PUSH_HOUR': 2, # daily search dossiers synchronization hour # 'DAILY_SEARCH_PULL_HOUR': 6, # hour in which results of daily search will be obtained # 'puppets': [ # { # 'id': 'first_puppet', # puppet ID # 'url': 'http://1.1.1.1:8010/', # puppet URL # 'token': 'first_puppet_token', # use pwgen -s 64 1 (should match the token in puppet) # 'facen_model': 'ifruit_320' # face model in puppet # }, # { # 'id': 'second_puppet', # 'url': 'http://1.1.1.1:8010/', # 'token': 'second_puppet_token', # # # if remote installation has a different face model than the one used in FFSecurity - # # you need to specify its name and ExtractionAPI URL where the corresponding face model is specified # 'facen_model': 'grapefruit_480', # 'extractor': 'http://127.0.0.1:18667', # }, # ] # } #. Generate a signature key for the session encryption (used by Django) by executing: pwgen -sncy 50 1|tr "'" ".". Specify this key as ``SECRET_KEY``. #. Start the services. .. code:: sudo systemctl enable findface-security sudo systemctl start findface-security #. Disable the default nginx server and add the ``findface-security`` server to the list of enabled servers. Restart nginx. .. code:: sudo rm /etc/nginx/sites-enabled/default sudo ln -s /etc/nginx/sites-available/ffsecurity-nginx.conf /etc/nginx/sites-enabled/ sudo nginx -s reload .. important:: To preserve the FindFace Security compatibility with the installation environment, we highly recommend you to disable the Ubuntu automatic update. In this case, you will be able to update your OS manually, fully controlling which packages to update. To disable the Ubuntu automatic update, execute the following commands: .. code:: sudo apt-get remove unattended-upgrades sudo systemctl stop apt-daily.timer sudo systemctl disable apt-daily.timer sudo systemctl disable apt-daily.service sudo systemctl daemon-reload