> ## Documentation Index
> Fetch the complete documentation index at: https://hmis-docs.derrickmugabwa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Prepare the Dokploy server

> Provision, harden, and install the supported single-server production platform.

This guide uses Ubuntu 24.04 LTS as the reference operating system. Dokploy also supports other documented Linux distributions, but keep each HMIS installation on a maintained, dedicated server.

## Baseline sizing

| Resource        | Small full-stack baseline | Planning rule                                                                  |
| --------------- | ------------------------: | ------------------------------------------------------------------------------ |
| CPU             |                    4 vCPU | Increase when sustained CPU exceeds 70% during normal peaks                    |
| RAM             |                     16 GB | Reserve capacity for three PostgreSQL services, OIE, Orthanc, and image builds |
| System SSD      |                    200 GB | Keep at least 25% free                                                         |
| Imaging storage |     Installation-specific | Size from modality volume, study size, retention, and annual growth            |
| Backup storage  |                  Off-site | Hold 30 daily, 12 weekly, and 12 monthly recovery points                       |

<Warning>
  The minimum is not a capacity guarantee. Measure staging workloads and imaging growth before clinical go-live. Do not store the only backup copy on the Dokploy server.
</Warning>

## Prepare the host

<Steps>
  <Step title="Create the server and administrator access">
    Provision a server with a static public IP. Add named administrator SSH keys, verify key access, then disable password and direct root SSH login according to hospital policy.
  </Step>

  <Step title="Patch and set time">
    ```bash theme={null}
    sudo apt update
    sudo apt full-upgrade -y
    timedatectl
    ```

    Configure the hospital-approved timezone and reliable NTP. Record maintenance and reboot requirements.
  </Step>

  <Step title="Reserve required ports">
    Dokploy installation requires ports `80`, `443`, and `3000` to be unused. Check before installation:

    ```bash theme={null}
    sudo ss -tulpn | grep -E ':(80|443|3000)\b' || true
    ```
  </Step>

  <Step title="Configure the firewall">
    Allow SSH only from the administrator VPN or approved source IPs. Allow public `80/TCP` and `443/TCP`. Allow `3000/TCP` only during initial Dokploy setup, then restrict it after configuring the protected dashboard domain.

    Do not open PostgreSQL, Orthanc Explorer, OIE management, DICOM, ASTM, MLLP, or analyzer listener ports to the internet.
  </Step>

  <Step title="Inspect and install Dokploy">
    Review the current official installation script before executing it, then install as root:

    ```bash theme={null}
    curl -sSL https://dokploy.com/install.sh | sh
    ```

    The installer configures Docker, Docker Swarm, and Dokploy's proxy network.
  </Step>

  <Step title="Create the first Dokploy account">
    Open `http://{{SERVER_IP}}:3000`, create the owner account, enable strong authentication controls, configure the dashboard domain and TLS, then remove broad public access to port `3000`.
  </Step>

  <Step title="Verify the platform">
    ```bash theme={null}
    docker version
    docker info --format '{{.Swarm.LocalNodeState}}'
    docker network inspect dokploy-network
    docker service ls
    ```
  </Step>
</Steps>

## Host hardening checklist

* Automatic security updates or a documented monthly patch window
* Named administrator accounts and retained SSH access audit
* Encrypted off-site backup credentials stored outside Git
* Disk, memory, CPU, certificate, and service monitoring
* Log retention that does not expose patient or credential data
* Tested console or rescue access if SSH becomes unavailable
* Documented server provider support and escalation contacts

<Check>
  Proceed when the Dokploy dashboard is protected by HTTPS, the firewall exposes only approved ports, monitoring can reach the host, and off-site backup storage is ready.
</Check>

Next, [create the Dokploy project](/platform/deployment/dokploy-project).