> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ndumed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy, configure and back up NduMed

> For operators: NduMed's required configuration and secrets, email and storage settings, the Help link setting, health checks, and per-hospital encrypted backups and restores.

NduMed ships as a single Docker image backed by one PostgreSQL 16 database, with each hospital in its own schema. This page lists what an operator must configure and how backups work. Keep every secret in your hosting provider's secret store, never in the repository.

## Required secrets

Production refuses to start if any of these are missing.

| Variable | Purpose |
| - | - |
| `DB_URL`, `DB_USER`, `DB_PASSWORD` | PostgreSQL connection (JDBC URL) |
| `HMS_AUTH_JWT_SECRET` | Signs session tokens; at least 32 characters |
| `HMS_AUTH_MFA_SECRET_KEY` | Encrypts two-step verification secrets; base64 of 32 bytes |
| `HMS_PATIENT_DATAPROTECTION_ENCRYPTIONKEY` | Encrypts sensitive patient fields; base64 of 32 bytes |
| `HMS_PATIENT_DATAPROTECTION_LOOKUPKEY` | Keyed lookups on encrypted fields; base64 of 32 bytes |

> [!CAUTION]
>
> Never lose or change the encryption keys without a re-encryption plan. Without them, encrypted patient fields and every user's two-step verification become unrecoverable. Back the keys up separately from the database.

## Platform access

| Variable | Purpose |
| - | - |
| `TENANT_BASE_DOMAIN` | Base domain; hospitals live at `<slug>.<base domain>` |
| `PLATFORM_API_KEY` | Key for the [platform API](https://docs.ndumed.co/platform/api.md); no default |
| `PLATFORM_CONSOLE_USERNAME`, `PLATFORM_CONSOLE_PASSWORD_HASH` | Operator console sign-in (bcrypt hash); no default |
| `PLATFORM_INVITE_VALIDITY` | First-administrator invitation lifetime (default 72h) |

## Email

`MAIL_HOST`, `MAIL_PORT`, `MAIL_USERNAME`, `MAIL_PASSWORD`, `MAIL_FROM`, `MAIL_SMTP_AUTH`, `MAIL_SMTP_STARTTLS`. Email powers account setup, password resets, reminders, critical lab alerts and stock digests.

## Help link

`HMS_HELP_URL` sets where the **Help** link in every signed-in page's top bar points. The default is `https://docs.ndumed.co`. Set it to an empty value to hide the link.

## File storage

Patient documents are stored on the local filesystem under `HMS_STORAGE_LOCAL_DIR`. Mount a persistent disk there; otherwise uploaded documents are lost on every redeploy. `HMS_STORAGE_MAX_SIZE` (default 10 MB) and `HMS_STORAGE_ALLOWED_TYPES` control uploads.

## Optional features

* **AI scribe**: needs the speech-to-text and AI API keys (`HMS_SCRIBE_*`) and the module enabled per hospital.
* **ICD-11 sync**: needs the WHO ICD API settings (`HMS_ICD_*`).

## Health checks

| Endpoint | Use |
| - | - |
| `/actuator/health/liveness` | Process is up |
| `/actuator/health/readiness` | Ready for traffic, including the database |

## Backups

`scripts/backup-tenants.sh` writes one GPG-encrypted (AES-256) dump per hospital plus the platform registry, keeps 30 days (`BACKUP_RETENTION_DAYS`), and copies off-site when `BACKUP_OFFSITE_BUCKET` is set. Provide `BACKUP_GPG_PASSPHRASE` or `BACKUP_GPG_KEYFILE`.

> [!WARNING]
>
> The backup script is not scheduled automatically. Schedule it (for example nightly with cron) on your host, and test restores regularly with `scripts/restore-tenant.sh <slug> <file>` into a scratch database.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.