On-site installation
Server requirements
What the hospital IT department prepares before PneumoTrack is installed. Once these points are ready, the installation takes 20 to 30 minutes.
To send us before the day itself
Passwords are shared separately, by phone or encrypted message.
- Name of the VM and Remote Desktop accessLocal administrator account, for the duration of the installation
- SQL server and instanceFor example SQLHOSP01\INST1 or sql01.hospital.local,1433
- Dedicated SQL accountFor example pneumotrack, with the rights described below
- DNS name planned for the siteFor example pneumotrack.hospital.local
- HTTPS certificate in .pfx formatIssued for that DNS name, with its password
- Address of the internet proxy, if there is oneFor example http://proxy.hospital.local:8080, for updates
Requirements
Nothing to install beforehand: the program carries everything it needs.
Virtual machine
- Windows Server 2016, 2019, 2022 or 2025, 64-bit
- 2 vCPU, 4 GB RAM, 5 GB free space
- Local administrator access during the installation
SQL Server
Version 2016 or newer, any edition. Express is enough for one department. PneumoTrack uses a single database, named PneumoTrack by default.
SQL account
Recommended: a SQL account (user and password) with the dbcreator role. PneumoTrack then creates its own database and tables. If internal policy requires it, the SQL administrator creates an empty database and makes the account its owner.
ALTER AUTHORIZATION ON DATABASE::PneumoTrack TO pneumotrack;Owner, and not merely a member of db_owner: that is what allows the backup to be restored automatically if an update fails.
Integrated Windows authentication is possible: the rights are then given to the machine account of the VM (DOMAIN\VMNAME$).
HTTPS and DNS name
A readable name pointing to the VM and a .pfx certificate issued for that name. Without a certificate the site runs over HTTP on the internal network; it can move to HTTPS later without reinstalling.
Outbound internet access
For automatic updates, over HTTPS, directly or through the proxy. The server receives no connection from the internet. Without internet access, updates are done by hand from a package copied onto the VM.
Network flows to open
The Windows firewall rule on the VM is created by the installation.
| From | To | Port | For |
|---|---|---|---|
| User workstations | PneumoTrack VM | TCP 443or 5000 over HTTP | Using the site |
| PneumoTrack VM | SQL server | TCP 1433+ UDP 1434 for a named instance | Database |
| PneumoTrack VM | api.github.comgithub.comrelease-assets.githubusercontent.comobjects.githubusercontent.com | TCP 443 | Updates (optional) |
| PneumoTrack VM | rest.smsmode.com | TCP 443 | SMS reminders (only with the PneumoTrack SMS account) |
What is installed on the VM
Everything is removed cleanly by the uninstall script. The SQL database is never deleted by our scripts.
On installation day
Having IT available during the first half hour helps.
- 1Connection to the VM and copy of the packageA single zip file, checked against its SHA256 fingerprint.
- 2Installation in one commandCheck of the SQL access, creation of the database and tables, service, firewall, update tool. The script stops with a clear message at the first problem, and runs again once that point is fixed.
- 3Check from a hospital workstationOpening the site, first administrator login with a temporary password to be changed immediately.
- 4Going liveCreation of the user accounts and department settings (institution, language, reminder thresholds).
Security and backups
In short, for the information security officer.
- Patient data only in SQL Server, on the hospital infrastructure. No patient data leaves the hospital network.
- Encrypted SQL connection. User passwords hashed (PBKDF2, 600,000 iterations), account locked after repeated failures, session limited to 12 hours.
- Audit log of changes and of patient record openings, kept for 10 years, exportable.
- Full backup before every update, written by SQL Server into its default backup folder, in COPY_ONLY mode: it does not disturb your backup plan. Plan for the corresponding space.
- Regular backups remain your responsibility, as for your other applications.
- Updates checked by fingerprint before installation, with automatic return to the previous version if the site does not answer. The site is down for 1 to 3 minutes, at night if you prefer.
- Logs in the Windows Event Viewer. Forwarding to your monitoring (syslog, Splunk, Graylog) is possible with a simple setting.