Guide to Typical Multi-Host Deployment

This section is all about deploying FindFace in a multi-host environment.

Tip

If after having read this section, you still have questions, do not hesitate to contact our experts by support@ntechlab.com.

The reasons for deploying FindFace in a multi-host environment are the following:

The necessity to distribute the video processing high load.
The necessity to distribute the feature vector extraction high load.
Large number of objects to search through, that requires implementation of a distributed object database.

Before you start the deployment, outline your system architecture, depending on its load and allotted resources (see Requirements). The most common distributed scheme is as follows:

One principal server with the following components: findface-ntls, findface-security, findface-sf-api, findface-video-manager, findface-upload, findface-video-worker, findface-extraction-api, findface-tarantool-server, and third-parties.
Several additional video processing servers with installed findface-video-worker.
(If needed) Several additional extraction servers with installed findface-extraction-api.
(If needed) Additional database servers with multiple Tarantool shards.

This section describes the most common distributed deployment. In high load systems, it may also be necessary to distribute the API processing (findface-sf-api and findface-video-manager) across several additional servers. This procedure requires a high level of expertise and some extra coding. Please do not hesitate to contact our experts for help (support@ntechlab.com).

To deploy FindFace in a multi-host environment, follow the steps below:

Deploy Principal Server 

To deploy the principal server as part of a distributed architecture, do the following:

On the designated physical server, install FindFace from installer as follows:
- Product to install: FindFace Multi.
- Installation type: Single server, multiple video workers. In this case, FindFace will be installed and configured to interact with additional remote findface-video-worker instances.
- Type of the findface-video-worker acceleration (on the principal server): CPU or GPU, subject to your hardware configuration.
- Type of the findface-extraction-api acceleration (on the principal server): CPU or GPU, subject to your hardware configuration.
After the installation is complete, the following output will be shown on the console:
```
#############################################################################
#                       Installation is complete                            #
#############################################################################
- upload your license to http://192.168.0.5/#/license/
- user interface: http://192.168.0.5/
  superuser:      admin
  password:       admin
  documentation:  http://192.168.0.5/doc/
```
Upload the FindFace license file via the main web interface http://<Host_IP_address>/#/license. To access the web interface, use the provided superuser credentials.

Important

Do not disclose the superuser (Super Administrator) credentials to others. To administer the system, create a new user with the administrator privileges. Whatever the role, Super Administrator cannot be deprived of its rights.

Allow the licensable services to access the findface-ntls license server from any IP address, To do so, open the /etc/findface-ntls.cfg configuration file and set listen = 0.0.0.0:3133. Restart findface-ntls.service.

sudo vi /etc/findface-ntls.cfg

## Address to accept incoming client connections (IP:PORT)
## type:string env:CFG_LISTEN longopt:--listen
listen = 0.0.0.0:3133

sudo systemctl restart findface-ntls.service

Allow accessing the findface-video-manager service from any IP address. To do so, open the /etc/findface-video-manager.conf configuration file and set listen: 0.0.0.0:18810 and rpc:listen: 0.0.0.0:18811. Restart the findface-video-manager service.
```
sudo vi /etc/findface-video-manager.conf

listen: 0.0.0.0:18810
...
rpc:
  listen: 0.0.0.0:18811
```
```
sudo systemctl restart findface-video-manager.service
```

Deploy Video Processing Servers 

On an additional video processing server, install only a findface-video-worker instance following the step-by-step instructions. Answer the installer questions as follows:

Product to install: FindFace Video Worker.
Type of the findface-video-worker acceleration: CPU or GPU, subject to your hardware configuration.
FindFace IP address: IP address of the principal server.

After that, the installation process will automatically begin. The answers will be saved to a file /tmp/<findface-installer-*>.json. Use this file to install FindFace Video Worker on other hosts without having to answer the questions again, by executing:

sudo ./findface-multi-1.2-and-server-5.2.run -f /tmp/<findface-installer-*>.json
Note

If findface-ntls and/or findface-video-manager are installed on a different host than that with findface-security, specify their IP addresses in the /etc/findface-video-worker-gpu.ini (/etc/findface-video-worker-cpu.ini) configuration file after the installation.
sudo vi /etc/findface-video-worker-cpu.ini
sudo vi /etc/findface-video-worker-gpu.ini
In the ntls-addr parameter, specify the findface-ntls host IP address.
ntls-addr=127.0.0.1:3133
In the mgr-static parameter, specify the findface-video-manager host IP address, which provides findface-video-worker with settings and the video stream list.
mgr-static=127.0.0.1:18811

Deploy Extraction Servers 

On an additional extraction server, install only a findface-extraction-api instance from the console installer. Answer the installer questions as follows:

Product to install: FindFace Multi.
Installation type: Fully customized installation.
FindFace components to install: findface-extraction-api and findface-data. To make a selection, first, deselect all the listed components by entering -* in the command line, then select findface-extraction-api and findface-data by entering their sequence number (keyword). Enter done to save your selection and proceed to another step.
Type of findface-extraction-api acceleration: CPU or GPU.
Modification of the /etc/findface-extraction-api.ini configuration file: specify the IP address of the findface-ntls server.
Neural network models to install: CPU or GPU model for face biometrics (mandatory). Be sure to choose the right acceleration type for each model, matching the acceleration type of findface-extraction-api: CPU or GPU. Be aware that findface-extraction-api on CPU can work only with CPU-models, while findface-extraction-api on GPU supports both CPU- and GPU-models.

Tip

See Neural Network Models for details.

After that, the installation process will automatically begin. The answers will be saved to a file /tmp/<findface-installer-*>.json. Use this file to install findface-extraction-api on other hosts without having to answer the questions again.

sudo ./findface-multi-1.2-and-server-5.2.run -f /tmp/<findface-installer-*>.json

After all the extraction servers are deployed, distribute load across them by using a load balancer.

Distribute Load across Extraction Servers 

To distribute load across several extraction servers, you need to set up load balancing. The following step-by-step instructions demonstrate how to set up nginx load balancing in a round-robin fashion for 3 findface-extraction-api instances located on different physical hosts: one on the FindFace principal server (192.168.0.5), and 2 on additional remote servers (192.168.0.6, 192.168.0.7). Should you have more extraction servers in your system, load-balance them by analogy.

Tip

You can use any load balancer according to your preference. Please refer to the relevant official documentation for guidance.

To set up load balancing, do the following:

Designate the FindFace principal server (recommended) or any other server with nginx as a gateway to all the extraction servers.

Important

You will have to specify the gateway server IP address when configuring the FindFace network.
Tip

You can install nginx as such:
```
sudo apt update
sudo apt install nginx
```
On the gateway server, create a new nginx configuration file.
```
sudo vi /etc/nginx/sites-available/extapi
```

Insert the following entry into the just created configuration file. In the upstream directive (upstream extapibackends), substitute the exemplary IP addresses with the actual IP addresses of the extraction servers. In the server directive, specify the gateway server listening port as listen. You will have to enter this port when configuring the FindFace network.

upstream extapibackends {
        server 192.168.0.5:18666; ## ``findface-extraction-api`` on principal server
        server 192.168.0.6:18666; ## 1st additional extraction server
        server 192.168.0.7:18666; ## 2nd additional extraction server
}
server {
        listen 18667;
        server_name extapi;
        client_max_body_size 64m;
        location / {
                proxy_pass http://extapibackends;
                proxy_next_upstream error;
        }
        access_log /var/log/nginx/extapi.access_log;
        error_log /var/log/nginx/extapi.error_log;
}

Enable the load balancer in nginx.

sudo ln -s /etc/nginx/sites-available/extapi /etc/nginx/sites-enabled/

Restart nginx.
```
sudo service nginx restart
```
On the principal server and each additional extraction server, open the /etc/findface-extraction-api.ini configuration file. Substitute localhost in the listen parameter with the relevant server address that you have specified in upstream extapibackends (/etc/nginx/sites-available/extapi) before. In our example, the address of the 1st additional extraction server has to be substituted as such:
```
sudo vi /etc/findface-extraction-api.ini

listen: 192.168.0.6:18666
```
Restart the findface-extraction-api on the principal server and each additional extraction server.
```
sudo systemctl restart findface-extraction-api.service
```

The load balancing is now successfully set up. Be sure to specify the actual gateway server IP address and listening port, when configuring the FindFace network.

Deploy Additional Database Servers 

The findface-tarantool-server component connects the Tarantool-based feature vector database and the findface-sf-api component, transferring search results from the database to findface-sf-api for further processing.

To increase search speed, you can allocate several additional servers to the feature vector database and create multiple findface-tarantool-server shards on each additional server. The concurrent functioning of multiple shards will lead to a remarkable increase in performance, as each shard can handle up to approximately 10,000,000 feature vectors.

To deploy additional database servers, do the following:

Install the findface-tarantool-server component on the first designated server. Answer the installer questions as follows:
- Product to install: FindFace Multi.
- Installation type: Fully customized installation.
- FindFace components to install: findface-tarantool-server. To make a selection, first, deselect all the listed components by entering -* in the command line, then select findface-tarantool-server by entering its sequence number (keyword). Enter done to save your selection and proceed to another step.
After that, the installation process will automatically begin.

As a result of the installation, the findface-tarantool-server shards will be automatically installed in the amount of N = min(max(min(mem_mb // 2000, cpu_cores), 1), 16 * cpu_cores). I.e., it is equal to the RAM size in MB divided by 2000, or the number of CPU physical cores (but at least one shard), or the number of CPU physical cores multiplied by 16 if the first obtained value is greater.
Use the created /tmp/<findface-installer-*>.json file to install findface-tarantool-server on other servers without answering the questions again. To do so, execute:
```
sudo ./findface-multi-1.2-and-server-5.2.run -f /tmp/<findface-installer-*>.json
```
Be sure to specify the IP addresses and ports of the shards later on when configuring the FindFace network. To learn the port numbers, execute on each database server:
```
sudo cat /etc/tarantool/instances.enabled/*shard* | grep -E ".start|(listen =)"`
```
You will get the following result:
```
    listen = '127.0.0.1:33001',
FindFace.start("127.0.0.1", 8101, {
    listen = '127.0.0.1:33002',
FindFace.start("127.0.0.1", 8102, {
```
You can find the port number in the FindFace.start section, for example, 8101, 8102, etc.

Configure Network 

After all the FindFace components are deployed, configure their interaction over the network. Do the following:

Open the /etc/findface-sf-api.ini configuration file:

sudo vi /etc/findface-sf-api.ini

Specify the following parameters:

Parameter	Description
`extraction-api` -> `extraction-api`	IP address and listening port of the gateway extraction server with set up load balancing.
`storage-api` -> `shards` -> `master`	IP address and port of the `findface-tarantool-server` master shard. Specify each shard by analogy.
`upload_url`	WebDAV NginX path to send original images, thumbnails and normalized object images to the `findface-upload` service.

...
extraction-api:
  extraction-api: http://192.168.0.5:18667

...
webdav:
  upload-url: http://127.0.0.1:3333/uploads/

...
storage-api:
  ...
  shards:
  - master: http://192.168.0.10:8101/v2/
    slave: ''
  - master: http://192.168.0.10:8102/v2/
    slave: ''
  - master: http://192.168.0.11:8101/v2/
    slave: ''
  - master: http://192.168.0.11:8102/v2/
    slave: ''
  - master: http://192.168.0.12:8101/v2/
    slave: ''
  - master: http://192.168.0.12:8102/v2/
    slave: ''

Open the /etc/findface-security/config.py configuration file.

sudo vi /etc/findface-security/config.py

Specify the following parameters:

Parameter	Description
`EXTERNAL_ADDRESS`	(Optional) IP address or URL that can be used to access the FindFace web interface. Once this parameter not specified, the system auto-detects it as the external IP address. To access FindFace, you can use both the auto-detected and specified IP addresses.
`VIDEO_DETECTOR_TOKEN`	To authorize the video object detection module, come up with a token and specify it here.
`VIDEO_MANAGER_ADDRESS`	IP address of the `findface-video-manager` host.
`NTLS_HTTP_URL`	IP address of the `findface-ntls` host.
`ROUTER_URL`	External IP address of the `findface-security` host that will receive detected objects from the `findface-video-worker` instance(s).
`SF_API_ADDRESS`	IP address of the `findface-sf-api` host.

sudo vi /etc/findface-security/config.py

...
# SERVICE_EXTERNAL_ADDRESS prioritized for webhooks and genetec
SERVICE_EXTERNAL_ADDRESS = 'http://localhost'
EXTERNAL_ADDRESS = 'http://127.0.0.1'


...
FFSECURITY = {
    'VIDEO_DETECTOR_TOKEN': '7ce2679adfc4d74edcf508bea4d67208',
    ...
    'VIDEO_MANAGER_ADDRESS': 'http://127.0.0.1:18810',
    ...
    'NTLS_HTTP_URL': 'http://127.0.0.1:3185',
    'ROUTER_URL': 'http://192.168.0.5',
    ...
    'SF_API_ADDRESS': 'http://127.0.0.1:18411',
    ...
}

The FindFace components interaction is now set up.

Important

To preserve the FindFace compatibility with the installation environment, we highly recommend you to disable the Ubuntu automatic update. In this case, you will be able to update your OS manually, fully controlling which packages to update.

To disable the Ubuntu automatic update, execute the following commands:

sudo apt-get remove unattended-upgrades
sudo systemctl stop apt-daily.timer
sudo systemctl disable apt-daily.timer
sudo systemctl disable apt-daily.service
sudo systemctl daemon-reload

Important

The FindFace services log a large amount of data, which can eventually lead to disc overload. To prevent this from happening, we advise you to disable rsyslog due to its suboptimal log rotation scheme and use the appropriately configured systemd-journal service instead. See Service Logs for the step-by-step instructions.

Guide to Typical Multi-Host Deployment

Deploy Principal Server

Deploy Video Processing Servers

Deploy Extraction Servers

Distribute Load across Extraction Servers

Deploy Additional Database Servers

Configure Network