10.1.4.1

Edit

Install second OCR server

The guide describes the process of installation of another Linux or Windows OCR instance on the existing IA Cloud environment.

Note that this is not an OCR scaling procedure.

Prepare

important

Run all commands as installation-user.

To prepare for remote installation of an additional OCR server:

  1. Connect to the APP server via SSH.

  2. To prepare the environment, run the following commands:

    $ cd /opt/workfusion/wf_installer
$ export ANSIBLE_REMOTE_USER="ec2-user"
$ export ANSIBLE_PRIVATE_KEY_FILE="id_rsa"
$ export ANSIBLE_VAULT_PASS=PassToYourVault

    Here,

    • /opt/workfusion/wf_installer: the path to the Workfusion Installer that contains the main installation script install.sh.

    • export ANSIBLE_REMOTE_USER="ec2-user": the ec2-user user is used for the remote access to the OCR Linux machine. Depending on the selected OCR platform:

      • OCR Linux: specify the user in file sudoers without password.
      • OCR Windows: the user must have permissions to connect remotely, and be in the Administrators group.

    • export ANSIBLE_PRIVATE_KEY_FILE="id_rsa": the id_rsa private key is applied for ec2-user. The public key must be located in the .ssh/authorized_keys file in the home directory of the user on the remote OCR machine.

    • ANSIBLE_VAULT_PASS: the Vault password variable for the Ansible installer.

  3. Verify the user:

    $ ls -la id_rsa

  4. Skip this step when installing OCR Linux

    When installing an additional instance of OCR Windows, make sure that the WinOCR installer is in /opt/workfusion/wf_installer/sources/.

    $ curl "link_to_ocrWin_package" -o /opt/workfusion/wf_installer/sources/OCRInstaller-VERSION.zip

    Note: you can find VERSION in the manifest.yml file, as the value of parameter ocrwin: 10.1.0.3.

Since all requests to OCR are passed through a load balancer (LB), one more load balancer endpoint for new OCR is required, for example, new-ocr-lb.domain.local.

tip

To open a file in the edit mode, in the vi/vim editor, press 'i'. To exit the edit mode in vi/vim, click Escape, and then type without quotes ':wq' + Enter.

To exit without changes, click Escape, then type ':q!' + Enter.

Install second OCR server

Linux

To install the second OCR Linux server:

  1. In the hosts.yml file, add the second OCR server's name:

    vi hosts.yml
    • ocr_lb_hostname: new-ocr-lb.domain.local – the hostname must point to the proxy (haproxy) endpoint to make additional Linux OCR separate calls.
    • ocr_hostnames: new-ocr.domain.local

  2. In the config.yml file, change the MS SQL, RabbitMQ, and ocr_platform parameters for the new OCR environment.

    $ vi config.yml

    The following parameters are to be changed or added:

    • ocr_platform: 'linux'
    • ocr_rabbitmq_vhost: 'ocr2'
    • rabbitmq_ocr_user: 'ocr2'
    • rabbitmq_ocr_pass: '********'
    • mssql_ocr_user: 'ocr2'
    • mssql_ocr_pass: '********'
    • mssql_ocr_schema_name: 'ocr2'

    In case config.yml is encrypted, run the following command.

    $ ./install.sh edit_config int

    When the prompt appears, enter the password for Secrets Vault. Note that the entered password is not displayed.

    Use the same commands to update windows_installation_user and windows_installation_pass.

  3. Make changes to add separate configuration in zookeeper for ocr-rest and ocr-worker to ocr-rest2 and ocr-worker2. Change Vault ApplicationID.

    $ sed -i 's%config/ocr-rest%config/ocr-rest2%g' roles/ocr2/tasks/configure.yml

$ sed -i 's%config/ocr-worker%config/ocr-worker2%g' roles/ocr2/tasks/configure.yml

$ sed -i 's%ocr-rest%ocr-rest2%g' roles/ocr2/templates/properties/bootstrap-ocr-rest.yml.j2

$ sed -i 's%ocr-worker%ocr-worker2%g' roles/ocr2/templates/properties/bootstrap-ocr-worker.yml.j2

$ sed -i 's%"applicationId":"ocr"%"applicationId":"ocr2"%g' roles/wf-sec-storage/templates/connectionProps_ocr.json.j2

    $ vi roles/ocr2/tasks/configure.yml

    The following parameters are be changed:

    • { node: '/config/ocr-rest2/secure.storage.applicationId', value: 'ocr2'}
    • { node: '/config/ocr-worker2/secure.storage.applicationId', value: 'ocr2'}

  4. Skip this step, if the user in the DB was created in advance.

    Temporary disable all other MS SQL user credentials (except for mssql_ocr_user) with the "#" symbol to prevent users and tables recreation.

    $ vi roles/mssql-win/tasks/create-users.yml

    For example:

        with_items:
#      - {user: '{{ mssql_ct_user }}',   schema: '{{ mssql_ct_schema_name }}' }
#      - {user: '{{ mssql_ds_user }}',   schema: '{{ mssql_ds_schema_name }}' }
#      - {user: '{{ mssql_ws_user }}',   schema: '{{ mssql_ws_schema_name }}' }
#      - {user: '{{ mssql_sqc_user }}',  schema: '{{ mssql_sqc_schema_name }}'}
#      - {user: '{{ mssql_rpa_user }}',  schema: '{{ mssql_rpa_schema_name }}'}
    - {user: '{{ mssql_ocr_user }}',  schema: '{{ mssql_ocr_schema_name }}'}
#      - {user: '{{ mssql_pm_user }}',   schema: '{{ mssql_pm_schema_name }}' }
#      - {user: '{{ mssql_dm_user }}',   schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_rapi_user }}', schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_automl_mms_user }}', schema: '{{ mssql_automl_mms_schema_name }}' }

    $ vi roles/mssql-win/tasks/create-logins.yml

    For example:

        with_items:
#      - {user: '{{ mssql_dba_user }}',  pass: '{{ mssql_dba_pass }}' }
#      - {user: '{{ mssql_ct_user }}',   pass: '{{ mssql_ct_pass }}'  }
#      - {user: '{{ mssql_ds_user }}',   pass: '{{ mssql_ds_pass }}'  }
#      - {user: '{{ mssql_ws_user }}',   pass: '{{ mssql_ws_pass }}'  }
#      - {user: '{{ mssql_sqc_user }}',  pass: '{{ mssql_sqc_pass }}' }
#      - {user: '{{ mssql_rpa_user }}',  pass: '{{ mssql_rpa_pass }}' }
    - {user: '{{ mssql_ocr_user }}',  pass: '{{ mssql_ocr_pass }}' }
#      - {user: '{{ mssql_pm_user }}',   pass: '{{ mssql_pm_pass }}'  }
#      - {user: '{{ mssql_dm_user }}',   pass: '{{ mssql_dm_pass }}'  }
#      - {user: '{{ mssql_rapi_user }}', pass: '{{ mssql_rapi_pass }}'}
#      - {user: '{{ mssql_automl_mms_user }}', pass: '{{ mssql_automl_mms_pass }}'}

  5. Skip this step, if proxy or haproxy were cofigured manually.

    In case of usage haproxy as a load balancer (LB) and it is configured by an Ansible playbook, you should make changes to haproxy ansible role and get hostname from point 5 of Prepare in that document.

    Make the following changes in hosts.yml

    ### OCR services
ocr_lb_hostname2: ocr-lb.domain.local
ocr_lb_hostname: new-ocr-lb.domain.local

# Workfusion servers hostnames
lb_hostname: lb-hostname.domain.local
...

    $ vi roles/haproxy/templates/haproxy.conf.j2

    ...
    acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}
    acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}:{{ lb_port_ssl }}
    acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}
    acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}:{{ lb_port_ssl }}
...
    use_backend backend_ocr_https             if acl_host_ocr
    use_backend backend_ocr_new_https         if acl_host_ocr_new
...
# OCR New
backend backend_ocr_new_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocr_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

# OCR
backend backend_ocr_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocrwin_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

  6. Run the following commands.

    $ ./install.sh configure rabbitmq

    Note: these commands must only be run, if step 6 is completed.

    $ ./install.sh preinstall mssql -e 'mssql_external=false'

$ ./install.sh install mssql

    Note: run this command, only if step 7 has been done.

    $ ./install.sh preinstall lb

$ ./install.sh install lb

  7. Perform the following operations, according to the chosen OCR platform:

    Verify that SSH connection to the Linux server is successful.

    $ ./install.sh preinstall ocr

$ ./install.sh install ocr

$ ./install.sh check ocr

    Check that everything (except for the license) is fine, wait for one minute after the service start, and then in your browser open the https://new-ocr-lb.domain.local/api/v1/health-check.

Windows

To install the second OCR Windows server:

  1. In the hosts.yml file, add the second OCR server's name:

    vi hosts.yml
    • ocr_lb_hostname: new-ocr-lb.domain.local – the hostname must point to the proxy (haproxy) endpoint to make additional Windows OCR separate calls.
    • ocrwin_hostnames: new-ocrwin.domain.local

  2. In the config.yml file, change the MS SQL, RabbitMQ, and ocr_platform parameters for the new OCR environment.

    $ vi config.yml

    The following parameters are to be changed or added:

    • ocr_platform: 'windows'
    • ocr_rabbitmq_vhost: 'ocr2'
    • rabbitmq_ocr_user: 'ocr2'
    • rabbitmq_ocr_pass: '********'
    • mssql_ocr_user: 'ocr2'
    • mssql_ocr_pass: '********'
    • mssql_ocr_schema_name: 'ocr2'

    In case config.yml is encrypted, run the following command.

    $ ./install.sh edit_config int

    When the prompt appears, enter the password for Secrets Vault. Note that the entered password is not displayed.

    Use the same commands to update windows_installation_user and windows_installation_pass.

  3. Make changes to add separate configuration in zookeeper for ocr-rest and ocr-worker to ocr-rest2 and ocr-worker2. Change Vault ApplicationID.

    1. Create the ocr_agent_creds.txt file:

      $ vi ocr_agent_creds.txt

    2. Insert the following parameters:

      pm.security.user.name=USERNAME2
pm.security.user.password=PASSWORD2

    3. Run the following command:

      $ sudo /opt/workfusion/wf-sec-storage/loader.sh ocr $(pwd)/ocr_agent_creds.txt

    4. Run the following commands:

      $ sed -i 's%config/ocr-rest%config/ocr-rest2%g' roles/ocr-config-win/tasks/configure.yml

$ sed -i 's%config/ocr-worker%config/ocr-worker2%g' roles/ocr-config-win/tasks/configure.yml

$ sed -i 's%"applicationId":"ocr"%"applicationId":"ocr2"%g' roles/wf-sec-storage/templates/connectionProps_ocr.json.j2

$ vi playbooks/ocrwin.yml

    5. In playbooks/ocrwin.yml, after roles, place the following line line " - role: wf-sec-storage", as shown below:

      - name: Configure secure properties and run db migrations for OCRWin server
hosts: "int"
roles:
- role: wf-sec-storage
- role: ocr-config-win

    6. Change configure.yml:

       $ vi roles/ocr-config-win/tasks/configure.yml

      The following parameters are be changed:

      - { node: '/config/ocr-rest2/secure.storage.applicationId', value: 'ocr2'}
- { node: '/config/ocr-worker2/secure.storage.applicationId', value: 'ocr2'}

    7. Change ocr_conf.ini.j2:

      $ vi roles/ocr-win/templates/ocr_conf.ini.j2

      The following parameters are be changed:

      [spring]
spring.application.name.rest=ocr-rest2
spring.application.name.worker=ocr-worker2
spring.cloud.zookeeper.enabled=true
spring.cloud.zookeeper.connect-string={{ zookeeper_endpoints }}

  4. Skip this step, if the user in the DB was created in advance.

    Temporary disable all other MS SQL user credentials (except for mssql_ocr_user) with the "#" symbol to prevent users and tables recreation.

    $ vi roles/mssql-win/tasks/create-users.yml

    For example:

        with_items:
#      - {user: '{{ mssql_ct_user }}',   schema: '{{ mssql_ct_schema_name }}' }
#      - {user: '{{ mssql_ds_user }}',   schema: '{{ mssql_ds_schema_name }}' }
#      - {user: '{{ mssql_ws_user }}',   schema: '{{ mssql_ws_schema_name }}' }
#      - {user: '{{ mssql_sqc_user }}',  schema: '{{ mssql_sqc_schema_name }}'}
#      - {user: '{{ mssql_rpa_user }}',  schema: '{{ mssql_rpa_schema_name }}'}
    - {user: '{{ mssql_ocr_user }}',  schema: '{{ mssql_ocr_schema_name }}'}
#      - {user: '{{ mssql_pm_user }}',   schema: '{{ mssql_pm_schema_name }}' }
#      - {user: '{{ mssql_dm_user }}',   schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_rapi_user }}', schema: '{{ mssql_dm_schema_name }}' }
#      - {user: '{{ mssql_automl_mms_user }}', schema: '{{ mssql_automl_mms_schema_name }}' }

    $ vi roles/mssql-win/tasks/create-logins.yml

    For example:

        with_items:
#      - {user: '{{ mssql_dba_user }}',  pass: '{{ mssql_dba_pass }}' }
#      - {user: '{{ mssql_ct_user }}',   pass: '{{ mssql_ct_pass }}'  }
#      - {user: '{{ mssql_ds_user }}',   pass: '{{ mssql_ds_pass }}'  }
#      - {user: '{{ mssql_ws_user }}',   pass: '{{ mssql_ws_pass }}'  }
#      - {user: '{{ mssql_sqc_user }}',  pass: '{{ mssql_sqc_pass }}' }
#      - {user: '{{ mssql_rpa_user }}',  pass: '{{ mssql_rpa_pass }}' }
    - {user: '{{ mssql_ocr_user }}',  pass: '{{ mssql_ocr_pass }}' }
#      - {user: '{{ mssql_pm_user }}',   pass: '{{ mssql_pm_pass }}'  }
#      - {user: '{{ mssql_dm_user }}',   pass: '{{ mssql_dm_pass }}'  }
#      - {user: '{{ mssql_rapi_user }}', pass: '{{ mssql_rapi_pass }}'}
#      - {user: '{{ mssql_automl_mms_user }}', pass: '{{ mssql_automl_mms_pass }}'}

  5. Skip this step, if proxy or haproxy were cofigured manually.

    In case of usage haproxy as a load balancer (LB) and it is configured by ansible playbook, you should make changes to haproxy ansible role and get hostname from point 5 of Prepare in that document.

    Make the following changes in hosts.yml

    ### OCR services
ocr_lb_hostname2: ocr-lb.domain.local
ocr_lb_hostname: new-ocr-lb.domain.local

# Workfusion servers hostnames
lb_hostname: lb-hostname.domain.local
...

    $ vi roles/haproxy/templates/haproxy.conf.j2

    ...
acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}
acl acl_host_ocr         hdr(host)  -i {{ ocr_lb_hostname2 }}:{{ lb_port_ssl }}
acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}
acl acl_host_ocr_new     hdr(host)  -i {{ ocr_lb_hostname }}:{{ lb_port_ssl }}
...
    use_backend backend_ocr_https             if acl_host_ocr
    use_backend backend_ocr_new_https         if acl_host_ocr_new
...
# OCR
backend backend_ocr_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocr_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

# OCR New
backend backend_ocr_new_https
mode http
option httpchk GET /health HTTP/1.1\r\nHost:\ {{ ocr_lb_hostname }}
http-check expect status 200
{% for host in ocrwin_hostnames_list %}
server {{ host }} {{ host }}:{{ nginx_port_ssl }} ssl verify none check check-ssl port {{ nginx_port_ssl }} inter 15000 rise 2 fall 3
{% endfor %}

  6. Run the following commands.

    $ ./install.sh configure rabbitmq

    Note: run these commands only if step 6 is completed.

    $ ./install.sh preinstall mssql -e 'mssql_external=false'

$ ./install.sh install mssql

    Note: run the command only if step 7 has been done.

    $ ./install.sh preinstall lb

$ ./install.sh install lb

  7. Perform the following operations, according to the chosen OCR platform:

    Verify that SSH connection to the Linux server is successful.

    $ ./install.sh preinstall ocrwin

$ ./install.sh install ocrwin

$ ./install.sh check ocrwin

    Check that everything (except for the license) is fine, wait for one minute after the service start, and then in your browser open the https://new-ocr-lb.domain.local/api/v1/health-check.

← PreviousInstall Analytics Windows Server →