System requirements
Server configuration
| Item | Requirement |
|---|---|
| Devices per server | There is no physical limit on the number of Devices per server. The specification here is capable of providing a response time of 2 seconds or less for every user when access requests are made simultaneously by 70 Devices with Salto Space and Salto XS4 Face co-located. Consideration needs to be given to the number of concurrent access requests that can be expected. Increasing processor core count and clock speed will provide more concurrent requests if needed. In this context simultaneously means within a 10 second window. |
| Network interfaces | This must be a wired connection. |
| CPUs | Min. 3.2 GHz 8 Cores |
| Architecture | Intel/AMD x64 must support AVX2 instruction set Supported processors: AMD Ryzen 7 and 9, Threadripper Intel Core i9, Core i7 This is only a guide, you should confirm that the processor of your selected hardware (or virtualisation driver) supports AVX2 instructions. |
| TPM | A TPM 2.0 (Trusted Platform Module) is required. It must be compliant with the TPM 2.0 specification and be enabled in BIOS/UEFI for physical servers. |
| Memory | 32 GB |
| Storage | Mirrored SSD - 480 GB We strongly recommend that physical storage is encrypted. |
| Firewall | The Server requires the following inbound traffic to be allowed from the Devices on the following ports:UDP/123 - NTP. The Server uses Cloudflare Time Services for time synchronization.TCP/443 - HTTPS |
Network configuration
| Item | Requirement |
|---|---|
| Network Type | A dedicated, isolated Access Control VLAN for all XS4 Face Devices (may be shared with other Salto network devices) |
| IP Subnet | Must be large enough to support all locks, camera units, and servers/controllers. Must not use 172.31.255.0/24 |
| Traffic Rules | No inbound or oubound traffic allowed within the VLAN except to the Server. Devices must remain isolated from external networks. |
| Server Outbound Ports | UDP/123 (NTP), TCP/80 (HTTP), TCP/443 (HTTPS/TLS), TCP/8883 (MQTT/mTLS). Only the Server requires outbound access. |
| Allowed External Hosts | Must allow outbound traffic from the Server to every host in Outbound destinations. |
| DHCP | Required to assign IPs to Devices. The Server must have a reserved, fixed IP address that cannot change once Devices are commissioned. |
| DNS | Required for the Server only. Devices do not use DNS and receive the Server IP during commissioning. |
| Physical Network | Cat 5e or Cat 6 cabling with Gigabit switches. Wired connections only. |
Outbound destinations
The Server needs outbound access to these destinations during installation and for as long as it runs. Devices don't need outbound access.
| Destination | Port | Used for |
|---|---|---|
time.cloudflare.com | UDP/123 (NTP) | Time synchronization |
*.xs4face.app | TCP/443 (HTTPS) | Cloud API and XS4 Face Console |
prod-westeurope-facentry.westeurope-1.ts.eventgrid.azure.net | TCP/8883 (MQTT over TLS) | MQTT messaging. The Server keeps this connection open at all times. |
prod-westeurope-facentry.westeurope-1.eventgrid.azure.net | TCP/443 (HTTPS) | MQTT messaging. The Server installation checks that it can reach this host, and stops if it can't. |
zrqlyb08zwo87fkeomp0on.azurecr.io | TCP/443 (HTTPS) | Container images |
*.blob.core.windows.net | TCP/443 (HTTPS) | Container image layers. For more information, see Image layer storage. |
ryi9o1o3ua7cvd070yh3ot.blob.core.windows.net | TCP/443 (HTTPS) | Server files and licenses |
enrollmentapiweu38d07.blob.core.windows.net | TCP/443 (HTTPS) | Enrollment photos |
archive.ubuntu.comsecurity.ubuntu.com | TCP/80 (HTTP) | OS updates: Ubuntu packages and security updates |
download.docker.com | TCP/443 (HTTPS) | Docker packages and updates |
get.docker.com | TCP/443 (HTTPS) | Docker installation script, used when the Server is built |
The Server uses the Ubuntu and Docker repositories while it runs, not only during installation.
It installs Ubuntu security updates automatically, and uses the repositories for later package installs and Docker updates.
If you configure the Server to use a regional Ubuntu mirror, such as gb.archive.ubuntu.com, allow that mirror instead of archive.ubuntu.com.
A wildcard such as *.xs4face.app means the domain and all of its subdomains.
If your firewall filters traffic by DNS name, configure each wildcard rule to match the domain and all of its subdomains.
Image layer storage
When the Server downloads a container image, the container registry redirects the download of the image layers to Azure Blob Storage on a different host, so allowing the registry host isn't enough.
The registry has replicas in several Azure regions, and the Server downloads the layers from the storage account behind the nearest replica.
Azure assigns the name of this storage account and can change it, so allow *.blob.core.windows.net.
This rule also covers the other blob.core.windows.net hosts in the table.
The table lists those hosts so that you can find them if your firewall allows individual hosts.
Azure virtual machines
Beta
When you install an XS4 Face Server in Microsoft Azure with the Azure installation, the XS4 Face Console offers two types of virtual machine:
| Azure VM Type | Virtual machine sizes |
|---|---|
| Confidential Compute (default) | Confidential virtual machines from the DCes v6, DCas v6 and DCas v5 series, with 8 to 128 vCPUs. The default size is Standard_DC8es_v6. |
| Trusted Launch | Virtual machines from the Dls v7, Das v7 and Das v6 series, with 8 to 128 vCPUs, and from the Fas v7, Fas v6 and Fs v2 series. |
Select a size with at least 8 vCPUs and 32 GB of memory, as described in Server configuration. Make sure that your Azure subscription has enough quota in your Azure region for the size that you select. The XS4 Face Server needs a fixed private IP address in an existing virtual network and subnet.
