Deploy, configure and back up NduMed

For operators: NduMed’s required configuration and secrets, email and storage settings, the Help link setting, health checks, and per-hospital encrypted backups and restores.

NduMed ships as a single Docker image backed by one PostgreSQL 16 database, with each hospital in its own schema. This page lists what an operator must configure and how backups work. Keep every secret in your hosting provider’s secret store, never in the repository.

Required secrets

Production refuses to start if any of these are missing.

Variable	Purpose
DB_URL, DB_USER, DB_PASSWORD	PostgreSQL connection (JDBC URL)
HMS_AUTH_JWT_SECRET	Signs session tokens; at least 32 characters
HMS_AUTH_MFA_SECRET_KEY	Encrypts two-step verification secrets; base64 of 32 bytes
HMS_PATIENT_DATAPROTECTION_ENCRYPTIONKEY	Encrypts sensitive patient fields; base64 of 32 bytes
HMS_PATIENT_DATAPROTECTION_LOOKUPKEY	Keyed lookups on encrypted fields; base64 of 32 bytes

Never lose or change the encryption keys without a re-encryption plan. Without them, encrypted patient fields and every user’s two-step verification become unrecoverable. Back the keys up separately from the database.

Platform access

Variable	Purpose
TENANT_BASE_DOMAIN	Base domain; hospitals live at <slug>.<base domain>
PLATFORM_API_KEY	Key for the platform API; no default
PLATFORM_CONSOLE_USERNAME, PLATFORM_CONSOLE_PASSWORD_HASH	Operator console sign-in (bcrypt hash); no default
PLATFORM_INVITE_VALIDITY	First-administrator invitation lifetime (default 72h)

Email

MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD, MAIL_FROM, MAIL_SMTP_AUTH, MAIL_SMTP_STARTTLS. Email powers account setup, password resets, reminders, critical lab alerts and stock digests.

Help link

HMS_HELP_URL sets where the Help link in every signed-in page’s top bar points. The default is https://docs.ndumed.co. Set it to an empty value to hide the link.

File storage

Patient documents are stored on the local filesystem under HMS_STORAGE_LOCAL_DIR. Mount a persistent disk there; otherwise uploaded documents are lost on every redeploy. HMS_STORAGE_MAX_SIZE (default 10 MB) and HMS_STORAGE_ALLOWED_TYPES control uploads.

Optional features

• AI scribe: needs the speech-to-text and AI API keys (HMS_SCRIBE_*) and the module enabled per hospital.
• ICD-11 sync: needs the WHO ICD API settings (HMS_ICD_*).

Health checks

Endpoint	Use
/actuator/health/liveness	Process is up
/actuator/health/readiness	Ready for traffic, including the database

Backups

scripts/backup-tenants.sh writes one GPG-encrypted (AES-256) dump per hospital plus the platform registry, keeps 30 days (BACKUP_RETENTION_DAYS), and copies off-site when BACKUP_OFFSITE_BUCKET is set. Provide BACKUP_GPG_PASSPHRASE or BACKUP_GPG_KEYFILE.

The backup script is not scheduled automatically. Schedule it (for example nightly with cron) on your host, and test restores regularly with scripts/restore-tenant.sh <slug> <file> into a scratch database.