> ## Documentation Index
> Fetch the complete documentation index at: https://hmis-docs.derrickmugabwa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Prerequisites

> Accounts, software, infrastructure, DNS, and operational access required before HMIS setup.

Collect the required access and infrastructure before beginning. Do not generate production credentials in chat, tickets, or shared documents.

<Tabs>
  <Tab title="Developer workstation">
    * Windows 11 with Git
    * PHP 8.5 with the extensions required by Laravel
    * Composer 2
    * Node.js 22 and npm
    * Docker Desktop with the Compose plugin for the integration stack
    * Access to the HMIS Git repository
  </Tab>

  <Tab title="Dokploy server">
    * A supported 64-bit Linux server with a public static IP
    * Root or passwordless sudo access for installation
    * At least 4 vCPU, 16 GB RAM, and SSD storage for the complete small-installation stack
    * Separate off-site backup storage
    * Outbound access for Git, container registries, package downloads, DNS, TLS, mail, and monitoring
  </Tab>

  <Tab title="Hospital readiness">
    * Approved production and staging domain names
    * A named system owner, database owner, security contact, clinical approver, and rollback authority
    * Hospital organization, branch, department, clinic, user, payer, and service catalogue data
    * Approved retention, backup, downtime, and incident-response policies
    * Vendor interface documentation for every analyzer or modality
  </Tab>
</Tabs>

## Required DNS names

Create only the records needed by the enabled services. Point each record to the Dokploy server before requesting certificates.

| Placeholder               | Purpose                                        | Required                  |
| ------------------------- | ---------------------------------------------- | ------------------------- |
| `{{HMIS_DOMAIN}}`         | Main HMIS user and API endpoint                | Yes                       |
| `{{STAGING_HMIS_DOMAIN}}` | Staging HMIS endpoint                          | Yes                       |
| `{{OHIF_DOMAIN}}`         | Protected imaging viewer                       | When radiology is enabled |
| `{{OIE_ADMIN_DOMAIN}}`    | Temporary protected OIE browser administration | When OIE is enabled       |

## Network access

|         Port | Source                                         | Destination         | Policy                                                  |
| -----------: | ---------------------------------------------- | ------------------- | ------------------------------------------------------- |
|       22/TCP | Approved administrator IPs or VPN              | Server              | Restrict; disable password login after key verification |
|       80/TCP | Internet                                       | Dokploy proxy       | Allow for redirect and certificate issuance             |
|      443/TCP | Approved users or internet per hospital policy | Dokploy proxy       | Allow with TLS                                          |
|     8443/TCP | Administrator through VPN/SSH tunnel           | OIE                 | Do not expose publicly                                  |
| Device ports | Laboratory or radiology VLAN                   | OIE/Orthanc         | Allow only the exact approved sources and protocols     |
|     5432/TCP | Internal containers                            | PostgreSQL services | Never publish publicly                                  |

## Values to prepare

* Long random database and keystore passwords
* A Laravel `APP_KEY` generated once for each environment
* Mail server credentials and an approved sender address
* Backup repository URL, access key, secret key, and encryption password
* Domain names and DNS access
* Integration tokens with minimum Sanctum abilities
* OIE channel exports and mapping worksheets

<Check>
  Proceed when DNS resolves, the server is patched, backup storage is available, ownership is assigned, and no production secret has been placed in the repository.
</Check>