> ## Documentation Index
> Fetch the complete documentation index at: https://hmis-docs.derrickmugabwa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Domains, TLS, and storage

> Route HMIS services through Dokploy and protect persistent application, integration, and imaging data.

Configure domains only after DNS resolves to the Dokploy server. Compose-service domain changes require a redeployment before the proxy labels take effect.

## Domain routes

| Domain                 | Service | Container port | Access policy                                                                        |
| ---------------------- | ------- | -------------: | ------------------------------------------------------------------------------------ |
| `{{HMIS_DOMAIN}}`      | `app`   |             80 | Hospital-approved user access                                                        |
| `{{OHIF_DOMAIN}}`      | `ohif`  |             80 | Authenticated clinical access or protected network                                   |
| `{{OIE_ADMIN_DOMAIN}}` | `oie`   |           8080 | Temporary browser administration behind VPN, IP allow-list, or identity-aware access |

<Warning>
  Do not create public routes for `postgres`, `oie-postgres`, `orthanc-postgres`, Orthanc Explorer, raw DICOMweb, `mock-analyzer`, or `mock-modality`.
</Warning>

<Steps>
  <Step title="Create DNS records">
    Create the required `A` or `AAAA` records and wait for them to resolve from an external network.
  </Step>

  <Step title="Add the HMIS domain">
    In the Dokploy Compose service, route `{{HMIS_DOMAIN}}` to service `app`, port `80`, with HTTPS and automatic certificate management enabled.
  </Step>

  <Step title="Add optional protected domains">
    Add OHIF and temporary OIE browser routes only when those services are enabled. Apply the access controls before sharing the URL.
  </Step>

  <Step title="Redeploy and verify TLS">
    Redeploy the Compose service, open each approved URL, confirm the expected certificate and redirect, and verify `/up` on the HMIS origin.
  </Step>
</Steps>

## OIE Administrator client

The browser route terminates HTTPS at Dokploy and forwards to OIE HTTP port `8080`. The desktop Administrator client uses OIE's separate HTTPS management port `8443` and cannot use that browser proxy route.

Keep `8443` bound to loopback. Use a VPN or SSH tunnel:

```bash theme={null}
ssh -L 8443:127.0.0.1:8443 {{ADMIN_USER}}@{{SERVER_IP}}
```

Then connect the Administrator client to `https://127.0.0.1:8443`.

## Persistent volumes

| Volume                  | Content                                       | Backup priority                           |
| ----------------------- | --------------------------------------------- | ----------------------------------------- |
| `postgres-data`         | HMIS transactional database                   | Critical                                  |
| `app-storage`           | Uploaded files and generated application data | Critical                                  |
| `oie-postgres-data`     | OIE configuration and message data            | Critical when OIE is enabled              |
| `oie-appdata`           | OIE runtime application data                  | Critical when OIE is enabled              |
| `oie-extensions`        | Installed OIE extensions                      | Required for reproducibility              |
| `orthanc-postgres-data` | Orthanc metadata                              | Critical when radiology is enabled        |
| `orthanc-storage`       | DICOM studies                                 | Critical and normally the largest dataset |

Do not rename, delete, or recreate volumes during a release. Before moving storage, stop writers and capture a consistent database-and-volume backup.

## Storage controls

* Alert at 80% disk utilization and escalate at 90%.
* Keep at least 25% free space for builds, database maintenance, and restore staging.
* Separate imaging storage when study growth threatens the system disk.
* Encrypt host disks and backup repositories according to hospital policy.
* Restrict backup and Docker-volume access to named administrators.
* Do not treat a VPS snapshot as the only database backup.

Continue with the [first deployment](/platform/deployment/first-deployment).