Production Deployment (VPS/Cloud)
Relevant source files
The following files were used as context for generating this wiki page:
This document outlines the architecture and procedures for deploying the Smart Absen Face Recognition system to a production environment, such as a Virtual Private Server (VPS) or a cloud instance. The deployment strategy focuses on security, scalability, and ease of access by leveraging a production-grade application server and a secure tunneling service.
The core components for production deployment include a MySQL database, the Gunicorn WSGI server to run the Flask application, and Cloudflare Tunnel to provide a secure, public HTTPS endpoint without requiring complex network configurations like port forwarding. The system is explicitly marked as "Production Ready".
Sources: README.md:100-104, INSTALLATION.md:255-273, STATUS.md:43
Production Architecture
The production architecture is designed to securely expose the locally running application to the internet. A user request is routed through the Cloudflare network, which then securely connects to the cloudflared daemon running on the VPS. This daemon forwards the request to the Gunicorn server, which manages the Flask application workers. The application then communicates with the MySQL database for data operations.
This diagram illustrates the high-level production architecture.
Key Components
| Component | Role | Rationale |
|---|---|---|
| Gunicorn | Production WSGI Server | Manages multiple worker processes to handle concurrent requests, providing better performance and stability than the built-in Flask development server. |
| MySQL 8.0+ | Database Server | A robust, production-grade relational database for storing employee, attendance, and admin data. |
| Cloudflare Tunnel | Secure Access | Creates a secure, outbound-only tunnel to the Cloudflare network, providing a public HTTPS URL without exposing server ports or requiring a static IP. This is crucial for camera access on mobile devices. |
.env file | Configuration | Stores sensitive information like database credentials and secret keys outside of the version-controlled codebase, enhancing security. |
Sources: README.md:100-104, SECURITY.md:5-15, INSTALLATION.md:15, 150-170
Server Prerequisites
Before deploying, the VPS or cloud server must have the following software installed.
| Requirement | Version | How to Check |
|---|---|---|
| Python | 3.8+ | python --version |
| pip | latest | pip --version |
| MySQL Server | 8.0+ | mysql --version |
| Git | latest | git --version |
cloudflared | latest | cloudflared --version |
Sources: INSTALLATION.md:13-22, 262-270
Environment Configuration
For production, all sensitive configurations must be managed through a .env file in the project's root directory. This prevents hardcoding secrets into the source code. The application is designed to read these variables on startup.
Sources: SECURITY.md:5-15, README.md:111-122, STATUS.md:21-26
Production .env Variables
Create a .env file from the provided .env.example and populate it with your production values.
| Variable | Example Value | Description |
|---|---|---|
DB_HOST | localhost | The hostname or IP of the MySQL server. |
DB_USER | smartabsen | The dedicated MySQL user for the application. |
DB_PASSWORD | your-strong-db-password | The password for the MySQL user. |
DB_NAME | absensi_karyawan_db | The name of the application's database. |
SECRET_KEY | a-long-random-hex-string | A secret key for signing session cookies. Generate with python -c "import secrets; print(secrets.token_hex(32))". |
FLASK_ENV | production | Crucial. Sets Flask to run in production mode, disabling the interactive debugger. |
PORT | 5001 | The local port the application will listen on. |
FACE_CONFIDENCE | 0.6 | The confidence threshold for face recognition. |
MAX_FACES | 1 | The maximum number of faces to detect in a single frame. |
Sources: README.md:111-122, SECURITY.md:43-49, INSTALLATION.md:180-184
Deployment Process
The deployment involves setting up the server, configuring the application, and running it using Gunicorn and Cloudflare Tunnel.
1. Application Server (Gunicorn)
The README.md recommends using gunicorn to serve the application. This command starts the application with 4 worker processes, listening on port 5001 on all network interfaces.
gunicorn app:app -w 4 -b 0.0.0.0:5001
Sources: README.md:103
2. Secure Access (Cloudflare Tunnel)
Cloudflare Tunnel is the recommended method for exposing the application to the internet securely. It provides an HTTPS URL, which is a requirement for accessing the device camera from modern browsers, especially on mobile.
The INSTALLATION.md file mentions a script start_with_tunnel.sh which likely automates this process. The flow is as follows:
This flowchart shows how a user request reaches the application via Cloudflare Tunnel.
3. Deployment Steps Summary
- Provision Server: Set up a VPS/Cloud instance (e.g., on Ubuntu) and install all prerequisites listed in the Server Prerequisites section.
- Clone Repository: `git clone https://github.com/Fahri-Hilm/Smart_Absen_Facerecognation-2025-Kelompok4.git%60
- Setup Environment: Create a Python virtual environment and install dependencies with
pip install -r requirements.txt. - Setup Database: Create the MySQL database and a dedicated user. The application will create the necessary tables on its first run.
- Configure
.env: Create the.envfile with production database credentials and setFLASK_ENV=production. - Install Cloudflare Tunnel: Install the
cloudflareddaemon on the server and authenticate it with your Cloudflare account. - Launch Application: Use a process manager like
pm2or a systemd service to run Gunicorn andcloudflaredpersistently. Thestart_with_tunnel.shscript can be used as a reference for the launch commands.
Sources: INSTALLATION.md:25-252, README.md:24-34, 100-104
Conclusion
The project is well-prepared for production deployment, with clear separation of concerns for configuration, application serving, and secure public access. The use of Gunicorn ensures the application can handle concurrent user traffic effectively, while Cloudflare Tunnel simplifies secure HTTPS setup, making the system accessible and functional across all devices without complex network management. The documentation confirms the system is "PRODUCTION READY" and "VERIFIED".
Sources: CLEANUP_REPORT.md:16, 114, STATUS.md:43, 53