10.1.2

Edit

Install second OCR server

The guide describes the process of installation of another Linux or Windows OCR instance on existing IA Cloud environment.

Note that this is not a OCR scaling procedure.

Prepare

important

Run all commands as installation-user.

To prepare for remore installation of an additional OCR server:

  1. Connect to the INT server via SSH.

  2. To prepare the environment, run the following commands:

    $ cd /opt/workfusion/wf_installer
$ export ANSIBLE_REMOTE_USER="ec2-user"
$ export ANSIBLE_PRIVATE_KEY_FILE="id_rsa"
$ export ANSIBLE_VAULT_PASS=PassToYourVault

    Here,

    • /opt/workfusion/wf_installer: the path to the Workfusion Installer that contains the main installation script install.sh.

    • export ANSIBLE_REMOTE_USER="ec2-user": the ec2-user user is used for the remote access to the OCR Linux machine. Depending on the selected OCR platform:

      • OCR Linux: the user must be specified in file sudoers without password
      • OCR Windows: the user must have permissions to connect remotely, and be in the Administrators group.

    • export ANSIBLE_PRIVATE_KEY_FILE="id_rsa": the id_rsa private key is applied for ec2-user. The public key must be located in the .ssh/authorized_keys file in the home directory of the user on the remote OCR machine.

    • ANSIBLE_VAULT_PASS: the Vault password variable for the ansible installer.

  3. Verify the user:

    $ ls -la id_rsa

  4. Skip this step when installing OCR Linux

    When installing an additional instance of OCR Windows, make sure that the winOCR installer is located in /opt/workfusion/wf_installer/sources/.

    $ curl "link_to_ocrWin_package" -o /opt/workfusion/wf_installer/sources/OCRInstaller-VERSION.zip

    Note: VERSION can be found in the manifest.yml file, as the value of parameter ocrwin: 10.1.0.3.

Since all requests to OCR are passed through a load balancer (LB), one more load balancer endpoint for new OCR is required, for example, new-ocr-lb.domain.local.

tip

To open a file in the edit mode, in the vi/vim editor, press 'i'. To exit the edit mode in vi/vim, click Escape, and then type without quotes ':wq' + Enter.

To exit without changes, click Escape, then type ':q!' + Enter.

Install second OCR server

Linux

To install the second OCR Linux server:

  1. In the hosts.yml file, add the second OCR server's name:

    vi hosts.yml
    • ocr_lb_hostname: new-ocr-lb.domain.local – the hostname must point to the proxy (haproxy) endpoint to make additional Linux OCR separate calls.
    • ocr_hostnames: new-ocr.domain.local

  2. In the config.yml file, change the MS SQL, RabbitMQ, and ocr_platform parameters for the new OCR environment.

    $ vi config.yml

    The following parameters are to be changed or added:

    • ocr_platform: 'linux'
    • ocr_rabbitmq_vhost: 'ocr2'
    • rabbitmq_ocr_user: 'ocr2'
    • rabbitmq_ocr_pass: '********'
    • mssql_ocr_user: 'ocr2'
    • mssql_ocr_pass: '********'
    • mssql_ocr_schema_name: 'ocr2'

    In case config.yml is encrypted, run the following command.

    $ ./install.sh edit_config int

    When the prompt appears, enter the password for Secrets Vault. Note that the entered password is not displayed.

    Use the same commands to update windows_installation_user and windows_installation_pass.

  3. Make changes to add separate configuration in zookeeper for ocr-rest and ocr-worker to ocr-rest2 and ocr-worker2. Change Vault ApplicationID.

    $ sed -i 's%config/ocr-rest%config/ocr-rest2%g' roles/ocr2/tasks/configure.yml

$ sed -i 's%config/ocr-worker%config/ocr-worker2%g' roles/ocr2/tasks/configure.yml

$ sed -i 's%ocr-rest%ocr-rest2%g' roles/ocr2/templates/properties/bootstrap-ocr-rest.yml.j2

$ sed -i 's%ocr-worker%ocr-worker2%g' roles/ocr2/templates/properties/bootstrap-ocr-worker.yml.j2

$ sed -i 's%"applicationId":"ocr"%"applicationId":"ocr2"%g' roles/wf-sec-storage/templates/connectionProps_ocr.json.j2

    $ vi roles/ocr2/tasks/configure.yml

    The following parameters are be changed:

    • { node: '/config/ocr-rest2/secure.storage.applicationId', value: 'ocr2'}
    • { node: '/config/ocr-worker2/secure.storage.applicationId', value: 'ocr2'}

  4. Skip this step, if the user in the DB was created in advance.

    Temporary disable all other MS SQL user credentials (except for mssql_ocr_user) with the "#" symbol to prevent users and tables recreation.

    $ vi roles/mssql-win/tasks/create-users.yml

    For example:

        with_items:
#      - {user: '{{ mssql_ct_user }}',   schema: '{{ mssql_ct_schema_name }}' }
#      - {user: '{{ mssql_ds_user }}',   schema: '{{ mssql_ds_schema_name }}' }
#      - {user: '{{ mssql_ws_user }}',   schema: '{{ mssql_ws_schema_name }}' }
#      - {user: '{{ mssql_sqc_user }}',  schema: '{{ mssql_sqc_schema_name }}'}
#      - {user: '{{ mssql_rpa_user }}',  schema: '{{ mssql_rpa_schema_name }}'}
    - {user: '{{ mssql_ocr_user }}',  schema: '{{ mssql_ocr_schema_name }}'}
#      - {user: '{{ mssql_pm_user }}',   schema: '{{ mssql_pm_schema_name }}' }
#      - {user: '{{ mssql_dm_user }}',   schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_rapi_user }}', schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_automl_mms_user }}', schema: '{{ mssql_automl_mms_schema_name }}' }

    $ vi roles/mssql-win/tasks/create-logins.yml

    For example:

        with_items:
#      - {user: '{{ mssql_dba_user }}',  pass: '{{ mssql_dba_pass }}' }
#      - {user: '{{ mssql_ct_user }}',   pass: '{{ mssql_ct_pass }}'  }
#      - {user: '{{ mssql_ds_user }}',   pass: '{{ mssql_ds_pass }}'  }
#      - {user: '{{ mssql_ws_user }}',   pass: '{{ mssql_ws_pass }}'  }
#      - {user: '{{ mssql_sqc_user }}',  pass: '{{ mssql_sqc_pass }}' }
#      - {user: '{{ mssql_rpa_user }}',  pass: '{{ mssql_rpa_pass }}' }
    - {user: '{{ mssql_ocr_user }}',  pass: '{{ mssql_ocr_pass }}' }
#      - {user: '{{ mssql_pm_user }}',   pass: '{{ mssql_pm_pass }}'  }
#      - {user: '{{ mssql_dm_user }}',   pass: '{{ mssql_dm_pass }}'  }
#      - {user: '{{ mssql_rapi_user }}', pass: '{{ mssql_rapi_pass }}'}
#      - {user: '{{ mssql_automl_mms_user }}', pass: '{{ mssql_automl_mms_pass }}'}

  5. Skip this step, if proxy or haproxy were cofigured manually.

    In case of usage haproxy as a load balancer (LB) and it is configured by ansible playbook, you should make changes to haproxy ansible role and get hostname from point 5 of Prepare in that document.

    Make the following changes in hosts.yml

    ### OCR services
ocr_lb_hostname2: ocr-lb.domain.local
ocr_lb_hostname: new-ocr-lb.domain.local

# Workfusion servers hostnames
lb_hostname: lb-hostname.domain.local
...

    $ vi roles/haproxy/templates/haproxy.conf.j2

    ...
    acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}
    acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}:{{ lb_port_ssl }}
    acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}
    acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}:{{ lb_port_ssl }}
...
    use_backend backend_ocr_https             if acl_host_ocr
    use_backend backend_ocr_new_https         if acl_host_ocr_new
...
# OCR New
backend backend_ocr_new_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocr_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

# OCR
backend backend_ocr_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocrwin_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

  6. Run the following commands.

    $ ./install.sh configure rabbitmq

    Note: these commands must only be run, if step 6 is completed.

    $ ./install.sh preinstall mssql -e 'mssql_external=false'

$ ./install.sh install mssql

    Note: that command should be run, only if step 7 has been done.

    $ ./install.sh preinstall lb

$ ./install.sh install lb

  7. Perform the following operations, according to the chosen OCR platform:

    Verify that SSH connection to Linux server is successful.

    $ ./install.sh preinstall ocr

$ ./install.sh install ocr

$ ./install.sh check ocr

    Check that everything (except for the license) is fine, wait for one minute after the service start, and then in your browser open the https://new-ocr-lb.domain.local/api/v1/health-check.

Windows

To install the second OCR Windows server:

  1. In the hosts.yml file, add the second OCR server's name:

    vi hosts.yml
    • ocr_lb_hostname: new-ocr-lb.domain.local – the hostname must point to the proxy (haproxy) endpoint to make additional Windows OCR separate calls.
    • ocrwin_hostnames: new-ocrwin.domain.local

  2. In the config.yml file, change the MS SQL, RabbitMQ, and ocr_platform parameters for the new OCR environment.

    $ vi config.yml

    The following parameters are to be changed or added:

    • ocr_platform: 'windows'
    • ocr_rabbitmq_vhost: 'ocr2'
    • rabbitmq_ocr_user: 'ocr2'
    • rabbitmq_ocr_pass: '********'
    • mssql_ocr_user: 'ocr2'
    • mssql_ocr_pass: '********'
    • mssql_ocr_schema_name: 'ocr2'

    In case config.yml is encrypted, run the following command.

    $ ./install.sh edit_config int

    When the prompt appears, enter the password for Secrets Vault. Note that the entered password is not displayed.

    Use the same commands to update windows_installation_user and windows_installation_pass.

  3. Make changes to add separate configuration in zookeeper for ocr-rest and ocr-worker to ocr-rest2 and ocr-worker2. Change Vault ApplicationID.

    1. Create the ocr_agent_creds.txt file:

      $ vi ocr_agent_creds.txt

    2. Insert the following parameters:

      pm.security.user.name=USERNAME2
pm.security.user.password=PASSWORD2

    3. Run the following command:

      $ sudo /opt/workfusion/wf-sec-storage/loader.sh ocr $(pwd)/ocr_agent_creds.txt

    4. Run the following commands:

      $ sed -i 's%config/ocr-rest%config/ocr-rest2%g' roles/ocr-config-win/tasks/configure.yml

$ sed -i 's%config/ocr-worker%config/ocr-worker2%g' roles/ocr-config-win/tasks/configure.yml

$ sed -i 's%"applicationId":"ocr"%"applicationId":"ocr2"%g' roles/wf-sec-storage/templates/connectionProps_ocr.json.j2

$ vi playbooks/ocrwin.yml

    5. In playbooks/ocrwin.yml, after roles, place the following line line " - role: wf-sec-storage", as shown below:

      - name: Configure secure properties and run db migrations for OCRWin server
hosts: "int"
roles:
- role: wf-sec-storage
- role: ocr-config-win

    6. Change configure.yml:

      $ vi roles/ocr-config-win/tasks/configure.yml

      The following parameters are be changed:

      - { node: '/config/ocr-rest2/secure.storage.applicationId', value: 'ocr2'}
- { node: '/config/ocr-worker2/secure.storage.applicationId', value: 'ocr2'}

    7. Change ocr_conf.ini.j2:

      $ vi roles/ocr-win/templates/ocr_conf.ini.j2

      The following parameters are be changed:

      [spring]
spring.application.name.rest=ocr-rest2
spring.application.name.worker=ocr-worker2
spring.cloud.zookeeper.enabled=true
spring.cloud.zookeeper.connect-string={{ zookeeper_endpoints }}

  4. Skip this step, if the user in the DB was created in advance.

    Temporary disable all other MS SQL user credentials (except for mssql_ocr_user) with the "#" symbol to prevent users and tables recreation.

    $ vi roles/mssql-win/tasks/create-users.yml

    For example:

        with_items:
#      - {user: '{{ mssql_ct_user }}',   schema: '{{ mssql_ct_schema_name }}' }
#      - {user: '{{ mssql_ds_user }}',   schema: '{{ mssql_ds_schema_name }}' }
#      - {user: '{{ mssql_ws_user }}',   schema: '{{ mssql_ws_schema_name }}' }
#      - {user: '{{ mssql_sqc_user }}',  schema: '{{ mssql_sqc_schema_name }}'}
#      - {user: '{{ mssql_rpa_user }}',  schema: '{{ mssql_rpa_schema_name }}'}
    - {user: '{{ mssql_ocr_user }}',  schema: '{{ mssql_ocr_schema_name }}'}
#      - {user: '{{ mssql_pm_user }}',   schema: '{{ mssql_pm_schema_name }}' }
#      - {user: '{{ mssql_dm_user }}',   schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_rapi_user }}', schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_automl_mms_user }}', schema: '{{ mssql_automl_mms_schema_name }}' }

    $ vi roles/mssql-win/tasks/create-logins.yml

    For example:

        with_items:
#      - {user: '{{ mssql_dba_user }}',  pass: '{{ mssql_dba_pass }}' }
#      - {user: '{{ mssql_ct_user }}',   pass: '{{ mssql_ct_pass }}'  }
#      - {user: '{{ mssql_ds_user }}',   pass: '{{ mssql_ds_pass }}'  }
#      - {user: '{{ mssql_ws_user }}',   pass: '{{ mssql_ws_pass }}'  }
#      - {user: '{{ mssql_sqc_user }}',  pass: '{{ mssql_sqc_pass }}' }
#      - {user: '{{ mssql_rpa_user }}',  pass: '{{ mssql_rpa_pass }}' }
    - {user: '{{ mssql_ocr_user }}',  pass: '{{ mssql_ocr_pass }}' }
#      - {user: '{{ mssql_pm_user }}',   pass: '{{ mssql_pm_pass }}'  }
#      - {user: '{{ mssql_dm_user }}',   pass: '{{ mssql_dm_pass }}'  }
#      - {user: '{{ mssql_rapi_user }}', pass: '{{ mssql_rapi_pass }}'}
#      - {user: '{{ mssql_automl_mms_user }}', pass: '{{ mssql_automl_mms_pass }}'}

  5. Skip this step, if proxy or haproxy were cofigured manually.

    In case of usage haproxy as a load balancer (LB) and it is configured by ansible playbook, you should make changes to haproxy ansible role and get hostname from point 5 of Prepare in that document.

    Make the following changes in hosts.yml

    ### OCR services
ocr_lb_hostname2: ocr-lb.domain.local
ocr_lb_hostname: new-ocr-lb.domain.local

# Workfusion servers hostnames
lb_hostname: lb-hostname.domain.local
...

    $ vi roles/haproxy/templates/haproxy.conf.j2

    ...
acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}
acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}:{{ lb_port_ssl }}
acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}
acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}:{{ lb_port_ssl }}
...
    use_backend backend_ocr_https             if acl_host_ocr
    use_backend backend_ocr_new_https         if acl_host_ocr_new
...
# OCR
backend backend_ocr_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocr_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

# OCR New
backend backend_ocr_new_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocrwin_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

  6. Run the following commands.

    $ ./install.sh configure rabbitmq

    Note: these commands must only be run, if step 6 is completed.

    $ ./install.sh preinstall mssql -e 'mssql_external=false'

$ ./install.sh install mssql

    Note: that command should be run, only if step 7 has been done.

    $ ./install.sh preinstall lb

$ ./install.sh install lb

  7. Perform the following operations, according to the chosen OCR platform:

    Verify that SSH connection to Linux server is successful.

    $ ./install.sh preinstall ocrwin

$ ./install.sh install ocrwin

$ ./install.sh check ocrwin

    Check that everything (except for the license) is fine, wait for one minute after the service start, and then in your browser open the https://new-ocr-lb.domain.local/api/v1/health-check.

← PreviousInstall Analytics Windows Server →