devsofttech_hms_ci4/docs/HEALTHPLIX_APACHE_PROXY_CENTOS7.md

HealthPlix Reverse Proxy Setup (CentOS 7 + Apache)

This guide is for a central public Apache server that forwards each hospital domain to its own local HMS over VPN.

Example topology:

• Public Apache server: 139.59.13.39
• Hospital A domain: 100001.dhms.in -> A record -> 139.59.13.39
• Hospital A HMS private VPN IP: 10.7.0.32
• Hospital B domain: 100002.dhms.in -> A record -> 139.59.13.39
• Hospital B HMS private VPN IP: 10.8.0.45

Recommended exposure model:

• Expose only callback/fetch path to internet.
• Do not expose full HMS unless required.

1) Install and enable required Apache modules

Run on CentOS 7 Apache host:

sudo yum install -y mod_ssl sudo httpd -M | egrep "proxy|ssl|headers|rewrite"

If any are missing, enable in Apache config and restart httpd.

2) Reusable virtual-host template (callback-only)

Create one file per hospital in /etc/httpd/conf.d/

Template file name:

• /etc/httpd/conf.d/DOMAIN.conf

Template content:

<VirtualHost :80> ServerName DOMAIN RewriteEngine On RewriteRule ^/(.)$ https://DOMAIN/$1 [R=301,L]

<VirtualHost *:443> ServerName DOMAIN

  SSLEngine On
  SSLCertificateFile /etc/letsencrypt/live/DOMAIN/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/DOMAIN/privkey.pem

  ProxyRequests Off
  ProxyPreserveHost On
  SSLProxyEngine On

  RequestHeader set X-Forwarded-Proto "https"
  RequestHeader append X-Forwarded-For %{REMOTE_ADDR}s

  ProxyTimeout 60
  Timeout 60

  # Callback/fetch endpoint only
  ProxyPass        /healthplix/fetch http://VPN_HMS_IP/healthplix/fetch
  ProxyPassReverse /healthplix/fetch http://VPN_HMS_IP/healthplix/fetch

  ErrorLog  /var/log/httpd/DOMAIN-healthplix-error.log
  CustomLog /var/log/httpd/DOMAIN-healthplix-access.log combined

Replace:

• DOMAIN with hospital DNS name (example 100001.dhms.in)
• VPN_HMS_IP with local HMS VPN IP (example 10.7.0.32)

3) Hardened variant (recommended)

Use this inside the :443 VirtualHost when HealthPlix source IPs and secret are available.

3.1 Limit endpoint to known HealthPlix source IPs

<Location /healthplix/fetch> Require all denied Require ip 203.0.113.10 Require ip 203.0.113.11

3.2 Shared-secret header validation at edge

RewriteEngine On RewriteCond %{REQUEST_URI} ^/healthplix/fetch$ RewriteCond %{HTTP:X-Healthplix-Secret} !^REPLACE_WITH_STRONG_SECRET$ RewriteRule ^ - [F,L]

3.3 Restrict methods

<Location /healthplix/fetch> Require all denied

3.4 Body size limits (adjust to payload)

LimitRequestBody 1048576

Notes:

• Replace placeholder IPs with official HealthPlix outbound IPs.
• Replace secret with a long random value.
• Validate same secret again in HMS controller before processing.

4) Multi-hospital mapping examples

Hospital A:

• Domain: 100001.dhms.in
• Target: 10.7.0.32

Hospital B:

• Domain: 100002.dhms.in
• Target: 10.8.0.45

Hospital C:

• Domain: 100003.dhms.in
• Target: 10.9.0.20

All domains can point to same public IP 139.59.13.39. Apache routes by ServerName.

5) Enable and reload Apache

sudo apachectl configtest sudo systemctl reload httpd

If using firewalld:

sudo firewall-cmd --add-service=http --permanent sudo firewall-cmd --add-service=https --permanent sudo firewall-cmd --reload

6) HMS application-side settings

For outbound sync from HMS to HealthPlix:

• Keep HEALTHPLIX_BASE_URL as official HealthPlix API base URL.
• Keep token/patient/appointment paths as currently configured.

For inbound fetch/callback from HealthPlix:

• Give HealthPlix callback URL as: https://DOMAIN/healthplix/fetch

7) Validation checklist

1. DNS resolves correctly: nslookup DOMAIN
2. TLS certificate is valid: curl -Iv https://DOMAIN/healthplix/fetch
3. Reverse proxy reaches HMS private node: curl -i -X POST https://DOMAIN/healthplix/fetch -H "X-Healthplix-Secret: REPLACE_WITH_STRONG_SECRET" -d '{}'
4. Apache logs show routed request in domain-specific log file.
5. HMS receives request and returns expected response.

8) Operations notes

• Keep one vhost file per hospital for isolation.
• Keep one log file pair per hospital for easier troubleshooting.
• Rotate logs and monitor 4xx/5xx rates.
• Keep VPN routes and ACLs documented and version-controlled.
• Do not log bearer tokens or patient-sensitive payloads in plaintext.