One GPU machine on the network, several workstations

The typical layout: one machine with a strong graphics card provides the three services, and the workstations only run the caption program (livecaption) – no graphics card is needed there. Installation is on the Installation page, the first run in the First start guide.

Why one machine

The three services together take 22.3 GB of video memory (measured; the largest item is the translation model with 16.7 GB), so a 24 GB card is tight. Network latency barely hurts: a few milliseconds on a wired local network.

The fourth part is the account service (accountserver): the owner of users, passwords and API keys. It uses no graphics card; it keeps its data in a PostgreSQL database, which the repository's AccountServer\managed-postgres.cmd launcher runs in a Docker container. The services know a single account service address, and it is simplest to put both the account service and its database on the same machine. If the database is on another machine, the connection only works with verified encryption (SSL Mode=VerifyFull) – managed-postgres.ps1 -ListenAddress <address> prepares this.

The server machine

Start order

The order is fixed: account service → translator and voice service → caption server. The caption server sizes its model pool to the free video memory and takes practically all of it: starting first, it would take the other two's room. Without the account service address the services do not start at all, so the account service comes first – and its database before it. The daily launcher (launch-system.cmd) brings up the four background services in this order, each in its own window, and does not start the caption window: on the server machine it is the whole daily start. Whatever runs on another machine (the account service, for example) must be left out with the -NoAccount, -NoTranslator, -NoVoice or -NoCaption switch; the daily launcher starts the account service only if LCP_ACCOUNT_URL points to this machine anyway.

Firewall

The caption server listens on every network interface by default. That alone is not enough: the Windows firewall drops incoming connections by default, and the client only sees "no answer". So at start the server checks whether a rule exists for its port (TCP 5111 by default), and if not, it adds one without asking, with the default setting: for the private and domain networks, never for public ones. This runs in the background and the start does not wait for it; it may need administrator confirmation (UAC) – if you do not see its window, check the taskbar. Remote clients reach the server once the rule exists. If Windows classifies the network as Public, the default rule does not apply to it: mark the network as private, or – on a trusted network only – delete the rule already added (on the Network page of the web interface) and restart the server with the --firewall any switch – the server does not rewrite an existing rule. Another profile can be chosen with --firewall private|domain|both|any, and --firewall skip leaves the firewall alone. If the rule is not created (for example, you decline the confirmation), the server still keeps running, only remote clients cannot reach it.

Encryption

On an unencrypted network the audio, the transcript and the access key travel in the clear. The --tls switch removes that:

.\start-captionserver.ps1 -Tls self-signed

The server then prints the certificate's fingerprint (SHA-256) at start and shows its addresses with the https:// scheme. The launchers of the translator and the voice service know the same -Tls self-signed switch. The daily launcher has no -Tls switch: there the encryption comes from the service's own setting, saved on its web interface. Clients must accept the self-signed certificate once.

The workstations

No service runs on a workstation, so the daily launcher is not needed there: the caption window is started by LiveCaption\start-livecaptionpro.cmd, and it reaches the services at the addresses given on the Servers tab.

The Servers tab

The Servers tab of the settings window keeps all three services in one place, in the same order: the address (http://machine:port, or https:// when encrypted), the API key and the web admin button – the latter is only active when the server runs on this machine. The Check button next to the address asks the server; the result shows on the field's frame, green or red.

With an encrypted server you accept the certificate like this:

1. Press the Check button. If the connection fails on the certificate, a Certificate button appears.
2. The button shows the certificate's issuer, validity and fingerprint.
3. Compare the fingerprint with what the service's machine printed at start (or what the web admin's Network page shows), and only then accept it.

The acceptance goes into the certs\trusted.json file of the shared data root; from then on the program accepts only that one certificate for that address. If the certificate changes later, the connection is refused, and the dialog says that the current one is not the one you accepted.

A key for every workstation

All three services authenticate and this cannot be turned off: each needs a key on the Servers tab. The key is stored encrypted, bound to the user account, so it cannot be carried to another machine: every workstation gets its own key on the account service's web Keys page or in its maintenance mode – see the Accounts, keys and permissions guide.

The account service address

Every half minute the services download the permission snapshot (a copy of the users, keys and rights) from the account service and decide from it. Its address comes from the LCP_ACCOUNT_URL environment variable (set by the AccountServer\setup-account-peers.ps1 script), and it is mandatory: without it the services do not start. On every machine that runs a service it must point to the same single account service. Restart open windows after setting it.

Checking

The --check switch of the batch client measures the whole chain from the workstation without transcribing (name resolution, TCP port, server, model selection) and says which step failed:

captionclient --check --server http://192.168.30.27:5111

The exit code: 0 all fine, 3 FFmpeg, 6 the server. The caption program does the same for all three services with livecaption --check. If something does not come together: Troubleshooting, or ask on the Contact page.