Skip to main content
NduMed ships as a single Docker image backed by one PostgreSQL 16 database, with each hospital in its own schema. This page lists what an operator must configure and how backups work. Keep every secret in your hosting provider’s secret store, never in the repository.

Required secrets

Production refuses to start if any of these are missing.
Never lose or change the encryption keys without a re-encryption plan. Without them, encrypted patient fields and every user’s two-step verification become unrecoverable. Back the keys up separately from the database.

Platform access

Email

MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD, MAIL_FROM, MAIL_SMTP_AUTH, MAIL_SMTP_STARTTLS. Email powers account setup, password resets, reminders, critical lab alerts and stock digests. HMS_HELP_URL sets where the Help link in every signed-in page’s top bar points. The default is https://docs.ndumed.co. Set it to an empty value to hide the link.

File storage

Patient documents are stored on the local filesystem under HMS_STORAGE_LOCAL_DIR. Mount a persistent disk there; otherwise uploaded documents are lost on every redeploy. HMS_STORAGE_MAX_SIZE (default 10 MB) and HMS_STORAGE_ALLOWED_TYPES control uploads.

Optional features

  • AI scribe: needs the speech-to-text and AI API keys (HMS_SCRIBE_*) and the module enabled per hospital.
  • ICD-11 sync: needs the WHO ICD API settings (HMS_ICD_*).

Health checks

Backups

scripts/backup-tenants.sh writes one GPG-encrypted (AES-256) dump per hospital plus the platform registry, keeps 30 days (BACKUP_RETENTION_DAYS), and copies off-site when BACKUP_OFFSITE_BUCKET is set. Provide BACKUP_GPG_PASSPHRASE or BACKUP_GPG_KEYFILE.
The backup script is not scheduled automatically. Schedule it (for example nightly with cron) on your host, and test restores regularly with scripts/restore-tenant.sh <slug> <file> into a scratch database.