Unmanned Store Face Access — Deployment Guide

Preset

A. reCamera Pro at the Door

The reCamera Pro recognises faces, decides whether to unlock, and drives the relay from its GPIO.

Server: A Linux server with Docker (no GPU needed) for the face library, management console and MQTT broker.
Peripherals: A relay module with a dry contact into the door controller's unlock input.

Deploy the Face Library and Console

Starts the face library, MQTT broker and management console on one server.

Prerequisites

A Linux server with Docker and the compose plugin, reachable from the door devices. No GPU needed.
Server clock synchronised by NTP; door devices take their time from it.
Ports 8080 (face library), 8088 (console) and 1883 (MQTT) free on the server.
Set Door Device to reCamera Pro for this preset.
The signing key and admin token are generated automatically; find them under "Auto-generated secrets" at the bottom of this step. Sign in to the console with the admin token.

Troubleshooting

Issue	Solution
`docker compose` not found	Install `docker-compose-plugin` on the server.
`NTP is not synchronised` warning	Run `sudo timedatectl set-ntp true` on the server.
Port 8080 in use	Change Face Library Port, and use the same port in later Face Library URLs.
Port 8088 in use	Free port 8088; the console pages in later steps open on it.
Face library answers 404	Normal before the first enrolment.
Console does not come up	Run `docker logs usa-web` on the server.

Deployment method

Deploy to a Linux server the door devices can reach.

What you will be asked for(filled in the SenseCraft Solution app)

Server IP*
Must be reachable from the door devices.
SSH Username*default ubuntu
SSH Password*
Face Library Port*default 8080
Console Port*default 8088
Match Threshold*default 0.40
Devices must use the same value.
Recognition Service URL (for enrolment)
Where the console computes face features when you enrol someone. If left empty, enrolled people will not be recognised.
Door Device*
3 options
- · reCamera Pro
- · Standard reCamera (2002 / 2002w / 2002 HQ PoE)
- · AI host with an existing camera
Sets the model tag written into every library version. It must match the device at the door, or nobody is recognised. Preset A -> reCamera Pro; presets B and C -> standard reCamera; preset D -> AI host.
Library Signing Key*
Console Admin Token*
Used to sign in to the management console.

1 more with defaults you can keep

Device Control Endpoints (JSON)default []
Standard reCamera devices to show on the console's device page. Leave `[]` for other presets.

Enrol People

Enrol each person with 3 to 8 photos in the console's Person Library.

Prerequisites

The admin token from Step 1.
3 to 8 clear, front-facing photos per person.
Recognition Service URL filled in Step 1; without it enrolled people are not recognised.
Known limitation: people enrolled here are not yet recognised by the reCamera Pro's on-device model. On this preset the step tests enrolment and delivery only.

Troubleshooting

Issue	Solution
Enrolment refused: fewer than three images	Upload at least 3 photos.
Door still refuses a newly enrolled person	Wait 30 s for the device to fetch the new version, then try again.
Rollback refused, naming a person	That person was deleted. Enrol or edit to publish a new version instead.
`model_tag` mismatch on the device	Point Recognition Service URL at the door device's recognition service, redeploy Step 1 and enrol again.

Wire the Relay

Connect the relay to the camera and the door controller.

Wiring

reCamera Pro relay wiring

With a multimeter, confirm which header pin is GPIO 130 and that it outputs 3.3 V.
Camera GPIO 130 → relay SIG, 3.3 V → VCC, GND → GND. To test first, connect an LED with a series resistor between GPIO 130 and GND instead.
Relay COM and NO to the door controller's unlock input (COM and NC for a fail-safe magnetic lock).

Troubleshooting

Issue	Solution
GPIO 130 is used by another program	Use a free GPIO and enter its number in the next step.

Activate and Configure F1 Door Access

Starts F1 Door Access on the camera and writes the door settings; any other app running on the camera is stopped.

Prerequisites

Install F1 Door Access (0.1.5 or later) on the camera first:

Log in to the camera's web console and open the App Center.
Find F1 Door Access, choose Install, and wait for it to finish.

The server IP, port, match threshold and signing key are filled in from Step 1. Enter the door name, GPIO number, relay contact and the door state on power loss.

Troubleshooting

Issue	Solution
The app is reported as not installed	Install F1 Door Access from the App Center as described above.
`unknown parameter`	F1 Door Access is older than 0.1.5. Update it in the App Center and deploy again.
Activation times out	The first activation right after install is slow; retry once.
`npu.direct is busy`	Stop the other running app in the App Center, then deploy again.
The door opens once at power-up	The relay contact is set the wrong way; correct it and deploy again.

Check the Library Reached the Device

Check on the console's Devices page that the door device uses the version you just published.

Prerequisites

The door device is powered on and online.
At least one person enrolled.

Troubleshooting

Issue	Solution
`desired_version` behind the server's `current`	Wait 30 s and reload the page.
`active_version` behind `desired_version`	Read `last_error`. Usually the match threshold differs from Step 1; redeploy the device step with the same value.
`signature.verified` is `null`	Normal. Signature failures appear in `last_error`.
`clock.valid` is `false`	Normal on devices without NTP.
A person listed under `only_on_device`	Someone enrolled on the device directly; the next version overwrites it.
The page is empty	No device has reported yet. Check the door device is online.

Verify the Door

Test the door: an enrolled person opens it, a photo does not, remote unlock works.

Prerequisites

The door controller connected and at least one person enrolled.
A printed photo of that person.
The admin token from Step 1.

Troubleshooting

Issue	Solution
A photo opens the door	Take the door out of service and check the recognition service `/health` reports liveness `loaded`.
Receipt says `executed` but the relay does not click	Check the relay wiring and the pin set on the device.
Relay clicks twice per approach	Increase the debounce window on the device, then test again.
Audit verification fails	Keep the log file and check whether two processes write to it.
Events stop but the door still opens	The camera unlocks locally; check its connection to the MQTT broker on port 1883.

After Deployment

Stand in front of the camera as an enrolled person: the relay clicks once and the console shows an allowed event.
Step back and forward right away: the console shows debounced and the relay does not click again.
Hold up the printed photo: the console shows liveness_failed and the relay does not click.
On the console's Devices page, click unlock: the relay clicks once and the receipt shows executed.
Delete a person: within 30 s the door no longer opens for them, and rolling back to a version that still contains them is refused.
Before real use: switch the MQTT broker to TLS with per-device accounts, and put the console behind HTTPS.

Preset

B. reCamera PoE

A reCamera 2002 HQ PoE recognises faces, decides whether to unlock, and drives the relay from its own baseboard header. The unlock path does not go over the network.

Server: A Linux server with Docker (no GPU needed) for the face library, management console and MQTT broker.
Camera: reCamera 2002 HQ PoE, powered over PoE.
Peripherals: A Grove Relay (SKU 103020005, SPST-NO, 3.3-5 V trigger) on baseboard header D1, with a dry contact into the door controller's unlock input. For a normally-closed controller input, use the Grove SPDT Relay 30A (SKU 103020012) instead.

Deploy the Face Library and Console

Starts the face library, MQTT broker and management console on one server.

Prerequisites

A Linux server with Docker and the compose plugin, reachable from the door devices. No GPU needed.
Server clock synchronised by NTP; door devices take their time from it.
Ports 8080 (face library), 8088 (console) and 1883 (MQTT) free on the server.
Set Door Device to standard reCamera for this preset.
The signing key and admin token are generated automatically; find them under "Auto-generated secrets" at the bottom of this step. Sign in to the console with the admin token.

Troubleshooting

Issue	Solution
`docker compose` not found	Install `docker-compose-plugin` on the server.
`NTP is not synchronised` warning	Run `sudo timedatectl set-ntp true` on the server.
Port 8080 in use	Change Face Library Port, and use the same port in later Face Library URLs.
Port 8088 in use	Free port 8088; the console pages in later steps open on it.
Face library answers 404	Normal before the first enrolment.
Console does not come up	Run `docker logs usa-web` on the server.

Deployment method

Deploy to a Linux server the door devices can reach.

What you will be asked for(filled in the SenseCraft Solution app)

Server IP*
Must be reachable from the door devices.
SSH Username*default ubuntu
SSH Password*
Face Library Port*default 8080
Console Port*default 8088
Match Threshold*default 0.40
Devices must use the same value.
Recognition Service URL (for enrolment)
Where the console computes face features when you enrol someone. If left empty, enrolled people will not be recognised.
Door Device*
3 options
- · reCamera Pro
- · Standard reCamera (2002 / 2002w / 2002 HQ PoE)
- · AI host with an existing camera
Sets the model tag written into every library version. It must match the device at the door, or nobody is recognised. Preset A -> reCamera Pro; presets B and C -> standard reCamera; preset D -> AI host.
Library Signing Key*
Console Admin Token*
Used to sign in to the management console.

1 more with defaults you can keep

Device Control Endpoints (JSON)default []
Standard reCamera devices to show on the console's device page. Leave `[]` for other presets.

Enrol People

Enrol each person with 3 to 8 photos in the console's Person Library.

Prerequisites

The admin token from Step 1.
3 to 8 clear, front-facing photos per person.
Recognition Service URL filled in Step 1; without it enrolled people are not recognised.

Troubleshooting

Issue	Solution
Enrolment refused: fewer than three images	Upload at least 3 photos.
Door still refuses a newly enrolled person	Wait 30 s for the device to fetch the new version, then try again.
Rollback refused, naming a person	That person was deleted. Enrol or edit to publish a new version instead.
`model_tag` mismatch on the device	Point Recognition Service URL at the door device's recognition service, redeploy Step 1 and enrol again.

Install F1 Access on the Camera

Installs the door access app on the reCamera PoE and writes its face library settings.

Prerequisites

The camera on USB-C (IP 192.168.42.1) or on your network, and the recamera SSH password.
The camera can reach http://<server IP>:8080.
About 20 MB free on /userdata.
Parts: a Grove Relay (SKU 103020005), its 4-wire Grove cable, jumper wires (the header is not a Grove socket, so the far end of the cable breaks out into single wires), a 3.3-5 V supply, and a multimeter.

Wiring

reCamera 2002 HQ PoE relay wiring

Identify the header pins (vendor wiki): GND, GPIO488, GPIO487, TX, GPIO490, RX. The three IO ports are D1 = GPIO490, CLK = GPIO487, SMD = GPIO488; this solution uses D1.
The header has no supply pin, so the relay's VCC comes from elsewhere - see "Powering the relay" below. A GPIO drives 3.3 V logic levels while the Grove Relay draws 100 mA, so the GPIO carries SIG only. This route needs no XIAO.
The levels are undocumented. Measure GPIO490's high level with a multimeter before connecting the relay.
Connect three wires, leaving the relay's NC wire unconnected: header GPIO490 → relay SIG, 5 V → VCC, header GND → GND (the supply's ground lands here too).
Test with an LED first. Put an LED with a series resistor between GPIO490 and GND, deploy, and check that it lights once for the configured pulse width. Then swap in the relay.
Confirm one click per pulse. If the relay does not click, go back to step 3 and re-check the level.
Connect the door controller. Relay COM and NO go to its unlock input; neither terminal carries any voltage of ours. A lock that opens on power loss needs a normally-closed contact, which the Grove Relay does not have — use the Grove SPDT Relay 30A (SKU 103020012) and wire COM and NC.
In the form, fill Device ID and Actuator ID. Face Library URL, Match Threshold and the signing key are carried over from Step 1; change the URL only if the camera reaches the server at a different address. Then deploy.

Powering the relay. Either works:

External 5 V - a 5 V USB charger, or the door side's existing 12 V stepped down to 5 V, with its ground tied to the header GND. Nothing on the board is touched.

Soldered to the board - the B3 PoE baseboard (v1.2) has 5 V and GND pads, marked in the photo below; solder two wires there. PoE power is limited (2 A fuse on the board, 1.2 A nominal on the main rail) and the relay's 100 mA fits in that headroom. Confirm both pads with a multimeter before soldering.

5 V and GND pads on the reCamera B3 PoE baseboard

Troubleshooting

Issue	Solution
The stock face-recognition app is still on the camera	Remove `face-recognition` on the camera, then deploy again.
`agent.log` ends with `thresholds are not single-sourced`	Deploy this step again; do not hand-edit `/userdata/f1-access/face-recognition.conf`.
No library version ever activates	Check the camera reaches Face Library URL; if Match Threshold was changed away from the Step 1 value, set it back and deploy again.
The door opens once at start-up	The active level is wrong. Fix it before connecting the door controller.
The relay never clicks	Check D1 is on the header pin you wired, and that `[gpio] enabled = true` in `/userdata/f1-access/face-recognition.conf`.

Check the Library Reached the Device

Check on the console's Devices page that the door device uses the version you just published.

Prerequisites

The camera is powered on and online.
At least one person enrolled.
The camera listed in Device Control Endpoints in Step 1.

Troubleshooting

Issue	Solution
`desired_version` behind the server's `current`	Wait 30 s and reload the page.
`active_version` behind `desired_version`	Read `last_error`. Usually the match threshold differs from Step 1; redeploy the device step with the same value.
`signature.verified` is `null`	Normal. Signature failures appear in `last_error`.
`clock.valid` is `false`	Normal on devices without NTP.
A person listed under `only_on_device`	Someone enrolled on the device directly; the next version overwrites it.
The page is empty	Fill Device Control Endpoints in Step 1 and redeploy it.

Verify the Door

Test the door: an enrolled person opens it, a photo does not, remote unlock works.

Prerequisites

The door controller connected and at least one person enrolled.
A printed photo of that person.
The admin token from Step 1.

Troubleshooting

Issue	Solution
A photo opens the door	Take the door out of service and check the recognition service `/health` reports liveness `loaded`.
Receipt says `executed` but the relay does not click	Check the header D1 wiring and the relay's trigger level.
Relay clicks twice per approach	Increase the debounce window on the device, then test again.
Audit verification fails	Keep the log file and check whether two processes write to it.
No events in the console	Check the camera can reach the server on port 1883.

After Deployment

Stand in front of the camera as an enrolled person: the relay clicks once and the console shows an allowed event.
Step back and forward right away: the console shows debounced and the relay does not click again.
Hold up the printed photo: the console shows liveness_failed and the relay does not click.
On the console's Devices page, click unlock: the relay clicks once and the receipt shows executed.
Delete a person: within 30 s the door no longer opens for them, and rolling back to a version that still contains them is refused.
Unplug the server and stand in front of the camera: the door still opens.
Before real use: switch the MQTT broker to TLS with per-device accounts, and put the console behind HTTPS.

Preset

C. Standard reCamera (2002 / 2002w)

A reCamera 2002 or 2002w recognises faces and decides whether to unlock. The camera has no usable header, so the unlock goes over MQTT to a relay node.

Server: A Linux server with Docker (no GPU needed) for the face library, management console and MQTT broker.
Camera: reCamera 2002 or 2002w.
Relay node: An R1000 or XIAO ESP32-S3 on the same MQTT broker, with a relay module whose dry contact goes into the door controller's unlock input. The door does not open while the broker is down.

Deploy the Face Library and Console

Starts the face library, MQTT broker and management console on one server.

Prerequisites

A Linux server with Docker and the compose plugin, reachable from the door devices. No GPU needed.
Server clock synchronised by NTP; door devices take their time from it.
Ports 8080 (face library), 8088 (console) and 1883 (MQTT) free on the server.
Set Door Device to standard reCamera for this preset.
The signing key and admin token are generated automatically; find them under "Auto-generated secrets" at the bottom of this step. Sign in to the console with the admin token.

Troubleshooting

Issue	Solution
`docker compose` not found	Install `docker-compose-plugin` on the server.
`NTP is not synchronised` warning	Run `sudo timedatectl set-ntp true` on the server.
Port 8080 in use	Change Face Library Port, and use the same port in later Face Library URLs.
Port 8088 in use	Free port 8088; the console pages in later steps open on it.
Face library answers 404	Normal before the first enrolment.
Console does not come up	Run `docker logs usa-web` on the server.

Deployment method

Deploy to a Linux server the door devices can reach.

What you will be asked for(filled in the SenseCraft Solution app)

Server IP*
Must be reachable from the door devices.
SSH Username*default ubuntu
SSH Password*
Face Library Port*default 8080
Console Port*default 8088
Match Threshold*default 0.40
Devices must use the same value.
Recognition Service URL (for enrolment)
Where the console computes face features when you enrol someone. If left empty, enrolled people will not be recognised.
Door Device*
3 options
- · reCamera Pro
- · Standard reCamera (2002 / 2002w / 2002 HQ PoE)
- · AI host with an existing camera
Sets the model tag written into every library version. It must match the device at the door, or nobody is recognised. Preset A -> reCamera Pro; presets B and C -> standard reCamera; preset D -> AI host.
Library Signing Key*
Console Admin Token*
Used to sign in to the management console.

1 more with defaults you can keep

Device Control Endpoints (JSON)default []
Standard reCamera devices to show on the console's device page. Leave `[]` for other presets.

Enrol People

Enrol each person with 3 to 8 photos in the console's Person Library.

Prerequisites

The admin token from Step 1.
3 to 8 clear, front-facing photos per person.
Recognition Service URL filled in Step 1; without it enrolled people are not recognised.

Troubleshooting

Issue	Solution
Enrolment refused: fewer than three images	Upload at least 3 photos.
Door still refuses a newly enrolled person	Wait 30 s for the device to fetch the new version, then try again.
Rollback refused, naming a person	That person was deleted. Enrol or edit to publish a new version instead.
`model_tag` mismatch on the device	Point Recognition Service URL at the door device's recognition service, redeploy Step 1 and enrol again.

Install F1 Access on the Camera

Installs the door access app on the reCamera and writes its face library settings.

Prerequisites

The camera on USB-C (IP 192.168.42.1) or on your network, and the recamera SSH password.
The camera can reach http://<server IP>:8080.
About 20 MB free on /userdata.
An R1000 or XIAO ESP32-S3 relay node connected to the same MQTT broker, and the Relay ID set on it.

Wiring

XIAO ESP32-S3 relay wiring

The camera has no usable header. Wire the relay to the relay node: XIAO ESP32-S3 relay firmware GPIO → relay SIG, 3V3 → VCC, GND → GND; on an R1000, wire the relay to the output behind its Modbus Point ID.
Connect relay COM and NO to the door controller's unlock input (use COM and NC for a lock that opens on power loss).
In the form, fill Device ID and set Actuator ID to the Relay ID configured on the relay node. Face Library URL, Match Threshold and the signing key are carried over from Step 1; change the URL only if the camera reaches the server at a different address. Then deploy.

Troubleshooting

Issue	Solution
The stock face-recognition app is still on the camera	Remove `face-recognition` on the camera, then deploy again.
`agent.log` ends with `thresholds are not single-sourced`	Deploy this step again; do not hand-edit `/userdata/f1-access/face-recognition.conf`.
No library version ever activates	Check the camera reaches Face Library URL; if Match Threshold was changed away from the Step 1 value, set it back and deploy again.
`mqtt.host` mismatch	Set `[mqtt] host = localhost` in `/userdata/f1-access/face-recognition.conf`.
Unlock sent but the relay does not click	Check the relay node is connected to the broker and its Relay ID matches Actuator ID.

Check the Library Reached the Device

Check on the console's Devices page that the door device uses the version you just published.

Prerequisites

The camera is powered on and online.
At least one person enrolled.
The camera listed in Device Control Endpoints in Step 1.

Troubleshooting

Issue	Solution
`desired_version` behind the server's `current`	Wait 30 s and reload the page.
`active_version` behind `desired_version`	Read `last_error`. Usually the match threshold differs from Step 1; redeploy the device step with the same value.
`signature.verified` is `null`	Normal. Signature failures appear in `last_error`.
`clock.valid` is `false`	Normal on devices without NTP.
A person listed under `only_on_device`	Someone enrolled on the device directly; the next version overwrites it.
The page is empty	Fill Device Control Endpoints in Step 1 and redeploy it.

Verify the Door

Test the door: an enrolled person opens it, a photo does not, remote unlock works.

Prerequisites

The door controller connected and at least one person enrolled.
A printed photo of that person.
The admin token from Step 1.

Troubleshooting

Issue	Solution
A photo opens the door	Take the door out of service and check the recognition service `/health` reports liveness `loaded`.
Receipt says `executed` but the relay does not click	Check the relay wiring and the pin set on the relay node.
Relay clicks twice per approach	Increase the debounce window on the device, then test again.
Audit verification fails	Keep the log file and check whether two processes write to it.
No events in the console	Check the camera can reach the server on port 1883.

After Deployment

Stand in front of the camera as an enrolled person: the relay clicks once and the console shows an allowed event.
Step back and forward right away: the console shows debounced and the relay does not click again.
Hold up the printed photo: the console shows liveness_failed and the relay does not click.
On the console's Devices page, click unlock: the relay clicks once and the receipt shows executed.
Delete a person: within 30 s the door no longer opens for them, and rolling back to a version that still contains them is refused.
Before real use: switch the MQTT broker to TLS with per-device accounts, and put the console behind HTTPS.

Preset

D. AI Host with Your Existing Cameras

The AI host pulls the stream from the existing RTSP camera at the door, recognises faces and decides whether to unlock.

Server: A Linux server with Docker (no GPU needed) for the face library, management console and MQTT broker.
Camera: The existing RTSP camera at the door.
Peripherals: A relay module with a dry contact into the door controller's unlock input.

Deploy the Face Library and Console

Starts the face library, MQTT broker and management console on one server.

Prerequisites

A Linux server with Docker and the compose plugin, reachable from the door devices. No GPU needed.
Server clock synchronised by NTP; door devices take their time from it.
Ports 8080 (face library), 8088 (console) and 1883 (MQTT) free on the server.
Set Door Device to AI host for this preset.
The signing key and admin token are generated automatically; find them under "Auto-generated secrets" at the bottom of this step. Sign in to the console with the admin token.

Troubleshooting

Issue	Solution
`docker compose` not found	Install `docker-compose-plugin` on the server.
`NTP is not synchronised` warning	Run `sudo timedatectl set-ntp true` on the server.
Port 8080 in use	Change Face Library Port, and use the same port in later Face Library URLs.
Port 8088 in use	Free port 8088; the console pages in later steps open on it.
Face library answers 404	Normal before the first enrolment.
Console does not come up	Run `docker logs usa-web` on the server.

Deployment method

Deploy to a Linux server the door devices can reach.

What you will be asked for(filled in the SenseCraft Solution app)

Server IP*
Must be reachable from the door devices.
SSH Username*default ubuntu
SSH Password*
Face Library Port*default 8080
Console Port*default 8088
Match Threshold*default 0.40
Devices must use the same value.
Recognition Service URL (for enrolment)
Where the console computes face features when you enrol someone. If left empty, enrolled people will not be recognised.
Door Device*
3 options
- · reCamera Pro
- · Standard reCamera (2002 / 2002w / 2002 HQ PoE)
- · AI host with an existing camera
Sets the model tag written into every library version. It must match the device at the door, or nobody is recognised. Preset A -> reCamera Pro; presets B and C -> standard reCamera; preset D -> AI host.
Library Signing Key*
Console Admin Token*
Used to sign in to the management console.

1 more with defaults you can keep

Device Control Endpoints (JSON)default []
Standard reCamera devices to show on the console's device page. Leave `[]` for other presets.

Enrol People

Enrol each person with 3 to 8 photos in the console's Person Library.

Prerequisites

The admin token from Step 1.
3 to 8 clear, front-facing photos per person.
Recognition Service URL filled in Step 1; without it enrolled people are not recognised.

Troubleshooting

Issue	Solution
Enrolment refused: fewer than three images	Upload at least 3 photos.
Door still refuses a newly enrolled person	Wait 30 s for the device to fetch the new version, then try again.
Rollback refused, naming a person	That person was deleted. Enrol or edit to publish a new version instead.
`model_tag` mismatch on the device	Point Recognition Service URL at the door device's recognition service, redeploy Step 1 and enrol again.

Deploy the Access Node

Starts recognition and the access node on the host. Pick the target that matches your host and relay wiring.

Prerequisites

Docker and the compose plugin on the host.
The camera's RTSP URL, tested from the host itself.
Access to sensecraft-statics.seeed.cc to download about 32 MB of model files.
At least 15 GB free disk. The first start takes about 4 minutes (measured on a reComputer J40).
The door lock type: opens on power loss (fail-safe) or stays locked (fail-secure).

Troubleshooting

Issue	Solution
`access-node` restarts and the log shows `config error:`	Run `docker compose exec access-node access-node check-config` to see the rejected field.
`access-node` stays `unhealthy`	Run `docker compose exec access-node access-node healthcheck` to see which part is down.
`LIVENESS IS NOT LOADED`	Check the model download finished, then deploy again.
RTSP plays on your laptop but not on the host	Check the host's route to the camera and the RTSP credentials.
Plaintext library URL refused	Deploy Step 1 first so the signing key exists, then deploy this step again.
The door opens once at start-up	Active Level is inverted. Change it before connecting the door controller.

Remote deviceDevice

The relay connects to the J20's DO output. Set GPIO Interface = sysfs and enter the DO's sysfs number.

Wiring

AI host relay wiring

With a multimeter, confirm which sysfs number drives which DO terminal (DO1–DO4 are expected at 463/464/465/462) and the DO output type.
Wire the DO terminal → relay SIG, and power the relay's VCC and GND.
Connect relay COM and NO to the door controller's unlock input (use COM and NC for a lock that opens on power loss).
In the form, set GPIO Interface sysfs, DO sysfs GPIO Number, Active Level, Relay Contact and Fail Mode.

What you will be asked for(filled in the SenseCraft Solution app)

J20 IP*
SSH Username*default recomputer
SSH Password*
Door / Device Name*default door-front
Goes into the MQTT topics and into every audit record. Name it after the door, so several doors on one broker stay separable.
Door ID (command topic)*default front
Remote unlock commands address this ID.
Camera RTSP URL*
Test this URL from the host before deploying.
Recognition Image (digest-pinned)*default sensecraft-missionpack.seeed.cn/solution/face-rec-api@sha256:0b0f37e2b170194f3e5b0577b6cd18ef6565143b7e637bd5d0ffb383aec0d5a1
Keep the default unless you run your own build.
Access Node Image*default sensecraft-missionpack.seeed.cn/solution/unmanned-store-access-node:0.1.1
Keep the default unless you run your own build.
GPIO Interface*default sysfs
2 options
- · sysfs — /sys/class/gpio (J20, and other 4.9/5.10 kernels)
- · libgpiod — /dev/gpiochipN (J30/J40, JetPack 6 / Tegra 5.15)
sysfs for J20; libgpiod for J30 / J40.
GPIO Chip*default gpiochip0
libgpiod only. gpiochip0 on reComputer J30 / J40.
GPIO Line Offset
libgpiod only. Line offset from the pin table in the guide (pin 31 = 106). Do not use a line `gpioinfo` marks as used.
DO sysfs GPIO Number
sysfs only. DO1–DO4 are expected at 463/464/465/462; confirm with a multimeter.
Active Level*
2 options
- · Active high — 1 triggers
- · Active low — 0 triggers
Which level triggers the relay. Get this wrong and the door pulses at boot, when the pin is initialised.
Unlock Pulse (ms)*default 1500
How long the relay stays closed, 500–5000 ms.
Relay Contact*
2 options
- · COM + NC — for fail-safe magnetic locks (unlock on power loss)
- · COM + NO — for fail-secure strikes (stay locked on power loss)
NC for a lock that opens on power loss, NO for one that stays locked.
Fail Mode*
2 options
- · fail_safe — door opens on power loss (egress-critical)
- · fail_secure — door stays locked on power loss
What the installation is supposed to do when it loses power. It must match the lock you actually bought and the contact you actually wired.
Match Threshold*default 0.62
Starting value; adjust after testing on the installed camera.
Face Library URL*
Library Signing Key*
Library Poll Interval (s)*default 30
Activation latency for a new library version is essentially this number plus the download. Lowering it costs requests, not correctness.
MQTT Broker Host*
MQTT Port*default 1883
MQTT TLS*default false
2 options
- · Off — bench only
- · On — with a broker that has certificates and per-device ACLs
The bundled broker has no TLS; use Off with it.

Troubleshooting

Issue	Solution
`gpio N is ALREADY EXPORTED`	Another program uses that output. Choose another DO or stop that program.

Check the Library Reached the Device

Check on the console's Devices page that the door device uses the version you just published.

Prerequisites

The door device is powered on and online.
At least one person enrolled.

Troubleshooting

Issue	Solution
`desired_version` behind the server's `current`	Wait 30 s and reload the page.
`active_version` behind `desired_version`	Read `last_error`. Usually the match threshold differs from Step 1; redeploy the device step with the same value.
`signature.verified` is `null`	Normal. Signature failures appear in `last_error`.
`clock.valid` is `false`	Normal on devices without NTP.
A person listed under `only_on_device`	Someone enrolled on the device directly; the next version overwrites it.
The page is empty	No device has reported yet. Check the door device is online.

Verify the Door

Test the door: an enrolled person opens it, a photo does not, remote unlock works.

Prerequisites

The door controller connected and at least one person enrolled.
A printed photo of that person.
The admin token from Step 1.

Troubleshooting

Issue	Solution
A photo opens the door	Take the door out of service and check the recognition service `/health` reports liveness `loaded`.
Receipt says `executed` but the relay does not click	Check the relay wiring and the pin set on the device.
Relay clicks twice per approach	Increase the debounce window on the device, then test again.
Audit verification fails	Keep the log file and check whether two processes write to it.
Container restarts in a loop	Run `docker logs usa-access-node` to see the rejected setting.

After Deployment

Stand in front of the camera as an enrolled person: the relay clicks once and the console shows an allowed event.
Step back and forward right away: the console shows debounced and the relay does not click again.
Hold up the printed photo: the console shows liveness_failed and the relay does not click.
On the console's Devices page, click unlock: the relay clicks once and the receipt shows executed.
Delete a person: within 30 s the door no longer opens for them, and rolling back to a version that still contains them is refused.
Before real use: switch the MQTT broker to TLS with per-device accounts, and put the console behind HTTPS.