How to Install OpenEMR on Ubuntu 24.04 Server

Self-Hosting OpenEMR on Ubuntu 24.04: A Comprehensive Guide

Are you a tech-savvy healthcare professional or IT enthusiast looking to take control of your electronic health records (EHR)? This guide provides a detailed walkthrough on self-hosting OpenEMR, a powerful open-source health records and medical practice management solution, on your Ubuntu 24.04 server. By leveraging the robust LEMP stack (Linux, Nginx, MariaDB, PHP-FPM), you’ll gain full sovereignty over your data, enhance data privacy, and tailor the system to your exact needs. Dive in to learn how to deploy and secure your own OpenEMR instance, from initial setup to HTTPS encryption.

Prerequisites for OpenEMR Deployment

Before embarking on your OpenEMR installation journey, ensure you have the following ready:

• An Ubuntu 24.04 server instance.
• A non-root user with sudo (administrator) privileges.
• A domain name pointing to your server’s public IP address. This is crucial for securing your OpenEMR instance with HTTPS.

Setting Up the LEMP Stack on Ubuntu 24.04

OpenEMR is a web-based application built with PHP and MySQL. To run it, we’ll install the essential components of the LEMP stack: Nginx (web server), MariaDB (database), and PHP-FPM (PHP FastCGI Process Manager).

First, update your package index and install all necessary LEMP packages and PHP extensions:

bash
sudo apt update && sudo apt install -y nginx mariadb-server php-fpm php-mysql php-bcmath php-xml php-zip php-curl php-mbstring php-gd php-tidy php-intl php-cli php-soap imagemagick libtiff-tools php-ldap

After installation, verify that all services are running and enabled:

bash
sudo systemctl is-enabled nginx && sudo systemctl status nginx
sudo systemctl is-enabled mariadb && sudo systemctl status mariadb
sudo systemctl is-enabled php8.3-fpm && sudo systemctl status php8.3-fpm

Ensure all commands report the services as enabled and active (running).

Fine-Tuning PHP-FPM for OpenEMR

Optimizing your PHP-FPM configuration is vital for OpenEMR’s performance. We’ll adjust key parameters in the php.ini file.

Open the PHP-FPM configuration file:

bash
sudo nano /etc/php/8.3/fpm/php.ini

Modify the following lines to match or exceed these values. Adjust memory_limit based on your server’s available RAM (e.g., 512M for 2GB+ RAM).

ini
max_execution_time = 60
max_input_time = -1
memory_limit = 512M
post_max_size = 30M
upload_max_filesize = 30M
max_input_vars = 3000
mysqli.allow_local_infile = On

Save and exit the editor.

Next, set the correct ownership for PHP session files:

bash
sudo chgrp -R www-data /var/lib/php/sessions

Finally, restart PHP-FPM to apply your changes:

bash
sudo systemctl restart php8.3-fpm

Securing and Configuring MariaDB for OpenEMR

Now, let’s secure your MariaDB server and prepare a dedicated database for OpenEMR.

Begin by running the security script:

bash
sudo mariadb-secure-installation

Follow the prompts:

• Press ENTER to continue.
• Enter Y to set a strong root password for MariaDB.
• Enter Y to disable remote root login.
• Enter Y to remove the default ‘test’ database.
• Enter Y to apply the changes.

After securing MariaDB, create a new database and user specifically for OpenEMR. Log in to the MariaDB console:

bash
sudo mariadb -u root -p

Enter your MariaDB root password. Then, execute the following SQL commands. Remember to replace 'Your_password2' with a robust, unique password.

sql
CREATE DATABASE openemr;
CREATE USER ‘openemruser’@’localhost’ IDENTIFIED BY ‘Your_password2’;
GRANT ALL PRIVILEGES ON openemr.* TO ‘openemruser’@’localhost’;
FLUSH PRIVILEGES;

Verify the user’s privileges:

sql
SHOW GRANTS FOR openemruser@localhost;

Type quit to exit the MariaDB client.

Acquiring OpenEMR Source Code

With the LEMP stack configured, it’s time to download OpenEMR.

Navigate to the /var/www directory:

bash
cd /var/www/

Download the latest stable OpenEMR source code (as of this guide, version 7.0.2):

bash
wget https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/7.0.2/openemr-7.0.2.tar.gz

Extract the archive and rename the directory for easier access:

bash
tar -pxzf openemr-7.0.2.tar.gz
mv openemr-7.0.2 openemr

Set the correct ownership for the OpenEMR directory, ensuring the web server can read and write to it:

bash
sudo chown -R www-data:www-data /var/www/openemr

Configuring Nginx Server Block for OpenEMR

The Nginx server block defines how your web server handles requests for your OpenEMR site.

Create a new Nginx configuration file for OpenEMR:

bash
sudo nano /etc/nginx/sites-available/openemr

Insert the following configuration, replacing openemr.example.com with your actual domain name. Important: Double-check the fastcgi_pass line to ensure it specifies php8.3-fpm.sock for Ubuntu 24.04.

nginx
server {
listen 80;
server_name openemr.example.com;
access_log /var/log/nginx/openemr.access.log;
error_log /var/log/nginx/openemr.error.log;
root /var/www/openemr;
index index.php;

location / {
    try_files $uri $uri/ /index.php?$query_string;
}

# Pass PHP Scripts To FastCGI Server
location ~* \.php$ {
    try_files $uri =404;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock; # Ensure this matches your PHP version
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    fastcgi_param DOCUMENT_ROOT $realpath_root;
    include fastcgi_params;
}

# deny access to writable files/directories
location ~* ^/sites/*/(documents|edi|era) {
    deny all;
    return 404;
}

# deny access to certain directories
location ~* ^/(contrib|tests) {
    deny all;
    return 404;
}

# Alternatively all access to these files can be denied
location ~* ^/(admin|setup|acl_setup|acl_upgrade|sl_convert|sql_upgrade|gacl/setup|ippf_upgrade|sql_patch)\.php {
    deny all;
    return 404;
}

location = /favicon.ico {
    log_not_found off;
    access_log off;
}

location = /robots.txt {
    log_not_found off;
    access_log off;
}

location ~ /\. {
    deny all;
}

}

Save and exit the editor.

Activate the server block by creating a symbolic link and test your Nginx configuration:

bash
sudo ln -s /etc/nginx/sites-available/openemr /etc/nginx/sites-enabled/
sudo nginx -t

You should see test is successful - syntax is ok. Finally, restart Nginx:

bash
sudo systemctl restart nginx

Securing OpenEMR with HTTPS (Let’s Encrypt)

Securing your OpenEMR instance with HTTPS is paramount, especially when dealing with sensitive patient data. We’ll use Certbot and Let’s Encrypt for free SSL certificates.

First, allow HTTP and HTTPS traffic through your firewall:

bash
sudo ufw allow ‘Nginx Full’

Install Certbot and its Nginx plugin:

bash
sudo apt install certbot python3-certbot-nginx -y

Generate your SSL certificates. Replace openemr.example.com with your actual domain name:

bash
sudo certbot –nginx -d openemr.example.com

Follow the prompts from Certbot. It will automatically configure Nginx to use HTTPS and set up automatic certificate renewal. Unique Tip: For any server deployment involving sensitive data like electronic health records (EHR), always prioritize strong encryption (HTTPS). This not only protects data in transit but also builds trust and complies with privacy regulations.

Completing the OpenEMR Web Installation

With the server configuration complete, open your web browser and navigate to https://your-domain.com.

1. The OpenEMR installer will first perform a permission check. Ensure all necessary directories have the correct permissions (www-data ownership).
2. Select the “I have created the database” option.
3. Enter the database details you configured earlier (database name openemr, user openemruser, and your chosen password). You will also create the initial OpenEMR administrator user here.
4. The installer will initialize the database and create your admin account.
5. Review the PHP configuration requirements to ensure everything is met.
6. Once the installation is complete, you’ll be redirected to the OpenEMR login page. Enter your newly created administrator username and password.

Congratulations! You should now see the OpenEMR dashboard, ready for use. You’ve successfully performed a secure self-hosting deployment of a critical electronic health records system.

FAQ

Question 1: Why should I self-host OpenEMR instead of using a cloud-based EHR solution?
Self-hosting OpenEMR provides unparalleled control over your data privacy and security. You retain full ownership of your sensitive patient data, dictate server configurations, and manage updates directly. This can be crucial for compliance with specific regional data residency laws and for organizations that prefer to avoid third-party reliance for critical infrastructure. It also eliminates recurring subscription fees, offering a potentially more cost-effective long-term solution.

Question 2: What are the main challenges to be aware of when self-hosting an EHR system like OpenEMR?
The primary challenges include ongoing server maintenance (updates, security patching), ensuring robust backup and disaster recovery plans, monitoring server performance, and maintaining network security. Unlike a managed cloud service, you are solely responsible for uptime and data integrity. It requires a dedicated IT understanding or access to skilled professionals to ensure a secure, reliable, and compliant server deployment.

Question 3: How do I keep my OpenEMR and LEMP stack up-to-date after installation?
Regular updates are vital for security and performance. For the LEMP stack components (Nginx, MariaDB, PHP-FPM), you can use sudo apt update && sudo apt upgrade on your Ubuntu server. For OpenEMR itself, updates typically involve downloading new versions from the official source, backing up your existing installation, and following their specific upgrade instructions, which usually include database migration steps. Always back up your data before performing any major system or application upgrades.

Read the original article