Server administration

A server is a physical or virtual machine that runs the accsyn app in background Daemon/Service mode.

• A server is primarily designed to serve volumes - download and upload of files with associated file operations. 

• A server can also execute hooks and compute/render job as part of  Workflows.

• The daemon installer can be downloaded from https://accsyn.io/getapp.

Server types

• Storage server; This is default server and all new workspaces must have at least one.  The storage server serves one or more volume and are located on the main("hq") site by default, facilitating file operations. A storage server can also be configured to run compute/render jobs.

• Site server; A server that serves volumes on a site, enabling file synchronisation between physical locations and cloud.

• Compute/render server; A server that is designated to run compute/render jobs, having virtual lane sub-servers with engines assigned.

NOTE: There is also the user server type, which is installed by end users as parts of hosts, facilitating 24/7 unattended delivery and file sharing.

Requirements

You need suitable hardware or virtual machine to run accsyn server on, specifications varies depending on the role server should have:

• Storage; Estimate 1 core/vCPU is needed for one continuous encrypted 1gbps(100MB/s) file transfer. Storage servers also needs to be exposed to the Internet using NAT port forward rules, unless you plan to run all file transfers locally over a LAN/VPN.

• Site servers; Same file transfers requirements as the storage server, and need to reach storage server having either Internet/WAN connectivity or LAN/VPN.

• Compute/render;  Depending on you plan to run CPU or GPU intensive tasks, deploy suitable hardware with the necessary specs.

Preparations

Before you can install a new server, you will need to acquire a new BYOS server license - reach out to accsyn staff at support@accsyn.com or sales@accsyn.com. Free trial are available on request.

Storage server prep

• Set a fixed LAN IP address on the server, unless the firewall supports DNS port forward configuration.

• Allocate a TCP port range for accsyn file transfers, default is 45190-45220 and one or more low ports - typically 80 or 443.

• Configure your firewall to NAT port forward these to the server fixed IP or DNS address on your local network. 

• Turn of any local firewalls on server, or configure them to allow incoming TCP connections on the accsyn ports.

Compute server prep

• Windows; Python 3 available in PATH or at accsyn default location: C:\Python310 | C:\Python311 and so on.

• Unix (Linux/MacOS); Uses default built-in python 3 interpreter, make sure it is in the path.

The python path can also be overridden if you need to point out a dedicated python environment, set the environment variable ACCSYN_PYTHON_EXECUTABLE to point the interpreter executable (full path).

Linux prep

The installer relies on Java being present at the host, as Java is not bundled with installer:

• RHEL/CentOS 7 and earlier; sudo yum install java-1.8.0-openjdk-headless 

• RHEL/CentOS 8 or later: dnf install java-17-openjdk-headless

• Ubuntu: sudo apt-get install -y default-jre-headless

• openSUSE: sudo zypper --non-interactive install java-1_8_0-openjdk-headless

NOTE: Mac and Windows installer comes with Java bundled.

Installation

To create a new server, click INSTALL SERVER button in upper right corner.

First, choose the site server should be at. Default is main site ("hq").

Next choose the type of server:

• Serve one or more volumes at site; Server should act as a Storage server (if at main site) or Site server (if other site chosen), choose which volume(s) to serve.

• Compute/render server; The server should run run compute jobs and/or hooks as part of Workflows.

Click Initiate installation to generate the server ID used with the installer. Installation instructions:

Windows

1. Download the service installer for Windows in the server machine.

2. Make sure you have administrative privileges.

3. Run the service installer executable, approve the UAC prompt.

4. Click next on the introduction screen.

5. Enter the server ID, mind case sensitivity.

6. Finish the installer and launch the daemon at the end.

Mac

1. Download the service installer for Mac in the server machine.

2. Make sure you have administrative privileges.

3. Run the service installer executable, enter you admin password when prompted.

4. Click next on the introduction screen.

5. Enter the server ID, mind case sensitivity.

6. Finish the installer and launch the daemon at the end.

Linux

1. Download the service installer for Linux in the server machine.

2. Open a terminal on the server.

3. Make sure the installer has executable permissions: chmod 755 accsyn-daemon-unix.sh.

4. Run the service installer executable as root: sudo ./accsyn-daemon-unix.sh.

5. Click next on the introduction screen.

6. Enter the server ID, mind case sensitivity.

7. Finish the installer and launch the daemon at the end.

Post actions

In order for the server to function properly, a set of post actions is required:

Windows

• If you are running Windows Defender Firewall, or other software firewall, make sure it allows outgoing traffic on port 443(tcp) from accsyn executables, specifically C:\Program Files\Accsyn\accsyn.exe.

• If you are running Antivirus software, make sure to whitelist the accsyn executables. 

• If it is a Storage server, make sure the firewall accepts incoming TCP connections on the accsyn ports. Also make sure antivirus allows accsyn exectuables to access the disk having the volume to be exposed.

Mac

• Mac Gatekeeper by default prevents disk access, for accsyn to properly operate you will need to give /bin/bash full disk access (accsyn creates shell wrapper scripts when executing processes): Open System Settings > Privacy & Security > Full disk access.  Click the + sign and add /bin/bash (Hint: press Shift+Cmd+G to goto /bin folder).

• If you are running Antivirus software, make sure to whitelist accsyn executables and /bin/bash.

When up and running, the web installation at accsyn.io will finish up and bring you to the server edit page (see below) where you can finish up the newly installed server.

To edit a server, click on it in the list.

Toolbar

• Disable server; Click this button to disable the server, note that all ongoing processes such as file transfers, compute tasks, hooks will be interrupted.

• Enable server; Enable the server again.

Serving

Displays a list of all volumes served by this server, go to the volume configuration by clicking on it in the list.

Lanes & Engines

The accsyn compute feature is a part of Workflows and enables you to run long running resource intensive computational tasks on your servers, e.g. render jobs in the context of media production.

Compute jobs can only run on lanes, a lan is a virtual sub-server allowing parallellism.

Here all compute lanes on the server are listed, numbered, together with the engines assigned.

Add a new lane

Adjust the Compute lanes setting above, increasing it by one. This will spawn a new lane at the bottom having the next free lane number.

Disable/enable a lane

• Click the checkboxes to enable/disable multiple lanes.

• Right click the lane and choose Enable/Disable from the context meny.

•  Click the lane menu (three dots) button on the right hand side of each lane and choose Enable/Disable.

Assign an engine to a lane

Right click the lane, choose the engine to assign and then choose Available.

De-assign an engine from a lane

Right click the lane, choose the assigned engine and then choose Unavailable.

Temporarily disable/enable an engine on a lane

Right click the lane, choose the assigned engine and then choose Enable/Disable.

NOTE: Compute/render servers require additional BYOS licenses.

Attributes

• Site; The site server is at can be changed as long as it is not serving any volumes. De-configure any volumes @  https://accsyn.io/admin/volumes/ to enable site change. 

• Description; Set the optional description server should have.

Settings

• Ports; Configure the accsyn ports this server should listen to during file transfers with the high speed encrypted built accsyn protocol (ASC) and web browser transfers (HTTPS). Storage servers needs this port 

• WAN IP; The WAN IP this server is reachable at. By default accsyn backend detects the WAN IP and reports this to clients out there, override this with a custom IP here.

• Compute lanes; The number of lanes, e.g. virtual compute servers, that this server should have. Allows for parallellism, executing different resource consuming engines/apps at the same time.

• Client config; Advanced client configurations - IP overrides.

IP Overrides

By default, accsyn routes traffic using the detected WAN IP:s of each endpoint (see WAN IP setting above). If a client fails to connect to connect to the WAN IP, it automatically tries the server's LAN IP addresses, this usually solves problems where both client and server are behind the same router.

To permanently add a route between server and client, add an IP override here. An IP override defines which IP address a client should be able to reach the server at, overriding the default WAN connection behaviour.

Enable IP overrides; Enable or disable this feature, keeping the config.

List of IP overrides; Use the delete/trashcan icon button to remove an override.

Add override:

• Client; The client that override applies to.

• Local IP: The IP that server should have when communicating with client.

• Remote IP: (Optional) The IP that client has.

Metadata

Define metadata for this server, will be appended to upstream metadata and provided to jobs with Workflows - API calls, engine execution, hooks execution, and so on. 

Guidelines how to manage the accsyn daemon running on the server.

Log file location

• Windows: C:\ProgramData\accsyn\log 

• Mac & Linux: /var/log/accsyn

Stopping and starting the server

Windows

Alternative 1 - using GUI tool

• Open Services (run services.msc)

• Locate accsynDaemon service.

• Right click and run stop |  start.

Alternative 2 - using a command prompt

• Open windows command prompt (run cmd.exe)

• To stop the daemon: scstop accsyndaemon

• To start the daemon: scstart accsyndaemon

Mac

• Open a terminal, with a user that has admin rights on the system

• To stop the daemon: sudo launchctl start com.accsyn.daemon

• To start the daemon: sudo launchctl start com.accsyn.daemon

Linux

• Open a terminal, with a user that has admin rights on the system

• To stop the daemon: sudo systemctl stop accsyndaemon

• To start the daemon: sudo systemctl start accsyndaemon

NOTE: This might vary on different Linux distros

Running server as a different user

By default, the accsyn daemon will run as an elevated user (local system account on Windows, root on Mac/Linux). This can be changed during installation before first run.

If you need to change this afterwards,  you need to re-configure the daemon and set permissions accordingly:

Windows

• Open Services (run services.msc)

• Locate accsynDaemon and and stop the services

• Change the ownership of the local configuration & log folder to the new user (C:\ProgramData\accsyn)

• Repeat for C:\Windows\TEMP\.accsyn if exists.

• Open service properties and go to Log on tab

• Change to This account

• Enter the username and password, finish by clicking OK. 

The user will be granted Log on as a service rights, which is required.

Mac

• Open a terminal and switch to root: sudo -s

• Stop and unload accsyndaemon: sudo launchctl stop com.accsyn.daemon && sudo launchctl unload /Library/LaunchDaemons/com.accsyn.daemon.plist

• Edit /Library/LaunchDaemons/com.accsyn.daemon.plist and add the UserName key, see example below.

• Change ownership to new user for /var/log/accsyn, /Library/Preferences/com.accsyn and /var/tmp/.accsyn (if exists).

• Load and start daemon again: sudo launchctl load /Library/LaunchDaemons/com.accsyn.daemon.plist

Example launchdaemon plist for configuring  accsyn to be run as user "anna":

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

    <key>Label</key>

    <string>com.accsyn.daemon</string>

    <key>ProgramArguments</key>

    <array>

        <string>/Applications/Accsyn/accsyndaemon</string>

        <string>start-launchd</string>

    </array>

    <key>KeepAlive</key>

    <false/>

    <key>RunAtLoad</key>

    <true/>

    <key>UserName</key>

    <string>anna</string>

</dict>

Linux

• Open a terminal and switch to root: sudo -s

• Stop accsyndaemon: systemctl stop accsyndaemon

• Edit /etc/systemd/system/accsyndaemon.service and add the user, see example below.

• Change ownership to new user for /var/log/accsyn, /var/lib/accsyn and /tmp/.accsyn (if exists).

• Start daemon again: systemctl start accsyndaemon

Example systemd config file for having accsyn to be run as user "anna":

[Unit]

Description=AccsynDaemon

Before=multi-user.target graphical.target

After=network-online.target remote-fs.target time-sync.target

Wants=network-online.target

[Service]

Type=simple

ExecStart="/usr/local/accsyn/accsyndaemon" start-launchd

User=anna

SuccessExitStatus=0 143

KillMode=process

[Install]

WantedBy=multi-user.target graphical.target

Enabling low port file transfers

To be able to have server bind to a port < 1024, permission needs to be granted in the operating system. Launch a terminal as root and run:

setcap 'cap_net_bind_service=+ep' /usr/lib/jvm/jre/bin/java

Note: the Java path might be different based on your Linux distribution, find out the executable path by running "ps aux" while accsyn daemon is running.

 Combined with running as a standard non privileged user account, Java can refuse to start with this error:

/usr/lib/jvm/jre/bin/java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory

If so is the case, add libjli location as a trusted runtime loader path by creating /etc/ld.so.conf.d/java.conf with the content:  

[JRE_HOME]/lib/amd64/jli

Then restart the machine to have configuration take effect.

Background watchdog

accsyn also installs a watchdog that checks daemon every 5 min and restarts it if has not responded. The watchdog also restarts the daemon upon a remotely initiated update, if daemon is configured to run as a different user than the default.

 To disable this behaviour, set environment variable ACCSYN_DISABLE_WATCHDOG=1. You can also uninstall the watchdog using the CLI (as root/elevated): accsyn daemon check_uninstall

Update server

Major updates to accsyn, that requires all servers/clients to be re-installed and might break backward compatibility, is called a major version upgrade. For example going from version 3.x to 4.x. This is upgrade action will be planned together with you as the domain admins, with the builtin safety that clients will be warned and enforced to upgrade directly when launching the desktop app. 

Note: Before doing an upgrade, older versions will be saved and can be restored if upgrade fails.

Minor updates and bug fixes are deployed regularly and announced by E-mail after they complete, including changelog and links to updated installers, for example updating from v3.2 to v3.3.

IMPORTANT NOTE: We constantly update accsyn backend and make sure it is compatible with the servers and clients deployed within your organisation, and if we perform a major upgrade with breaking changes we give heads up far in advance enabling you to plan a upgrade date with our support team - to minimize downtime and production outage.

To update the server, perform the same routes as when updating the desktop app in general.

1. Make sure no critical file transfers or compute tasks are executing on the server.

2. Download the corresponding daemon installer from https://accsyn.io/getapp

3. Run the installer and start the daemon, se platform specific instructions above.

4. Perform some basic tests to make sure server is functioning as expected.

Backend/cloud database and backups

The accsyn underlaying database is backed up every hour and can be restored on request. A backup of the database is also taken prior to upgrade and will be restored if an update is rolled back.

Note: No passwords or other user personal data is stored in the database/cloud instance. accsyn utilises Auth0 which is GDPR compliant.

To delete a volume, open the server's menu (three dots icon) on the right hand side and choose Delete.

NOTES: 

• A server must be shut down and be offline in order to be deleted.

• The default server, e.g. the server serving the default volume, cannot be deleted. You must first configure another server to serve the default volume, or change default volume.

• This cannot be undone.

Server will stop serve volumes, not data will be touched on physical storage on deletion.