Install and maintain Open-EMR v7.0.3 on Ubuntu

OpenEMR 7.0.3 is built from the rel-7.0.3 source flow with Composer and npm on PHP 8.3, backed by MariaDB, and served by Apache with TLS.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A dedicated OpenEMR database/user/password and a separately generated administrator password.
• Apply healthcare-data retention, encryption, access-control, and audit requirements applicable in your jurisdiction.

What the AppStore installation creates

• Apache, PHP 8.3 extensions, MariaDB, Composer, npm
• OpenEMR source below a domain-specific web root
• Built PHP vendor dependencies and JavaScript assets
• Imported baseline schema/site configuration and TLS

1. Install the PHP 8.3 stack

sudo apt update
sudo apt install -y apache2 mariadb-server git composer npm \
  php8.3 php8.3-cli php8.3-mysql php8.3-curl php8.3-gd php8.3-intl php8.3-mbstring php8.3-xml \
  php8.3-zip php8.3-soap libapache2-mod-php8.3 certbot python3-certbot-apache ufw fail2ban
sudo systemctl enable --now mariadb apache2

2. Create the database

sudo mysql
CREATE DATABASE openemr CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'openemr'@'localhost' IDENTIFIED BY 'CHANGE_ME_DB_PASSWORD';
GRANT ALL PRIVILEGES ON openemr.* TO 'openemr'@'localhost';
FLUSH PRIVILEGES;
EXIT;

3. Fetch and build OpenEMR 7.0.3

The playbook uses the Sive-maintained OpenEMR 7.0.3 repository/branch, installs production Composer dependencies, installs npm dependencies, and builds the frontend.

sudo git clone --branch v7_0_3 https://github.com/sivehost/openemrv703.git /var/www/app.example.com
cd /var/www/app.example.com
sudo composer install --no-dev
sudo npm install
sudo npm run build
sudo chown -R www-data:www-data /var/www/app.example.com

4. Load the approved schema/config and enable TLS

Use only the schema and site template matching this exact source revision. Replace all example credentials and inspect the generated site configuration before exposing it.

sudo mysql openemr < APPROVED_OPENEMR_703_SCHEMA.sql
sudo nano /var/www/app.example.com/sites/default/sqlconf.php
sudo chmod 640 /var/www/app.example.com/sites/default/sqlconf.php
sudo a2enmod rewrite ssl headers
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo certbot --apache -d app.example.com -m [email protected] --agree-tos --redirect

Important files and data

• OpenEMR files: /var/www/app.example.com
• Site database config: sites/default/sqlconf.php
• Patient documents: include the configured documents directory
• Apache and PHP configuration

Health checks and logs

Run these checks after installation and after each upgrade:

sudo apache2ctl configtest
sudo systemctl status apache2 mariadb --no-pager
curl -I https://app.example.com
sudo tail -n 100 /var/log/apache2/error.log

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo mariadb-dump --single-transaction openemr > openemr.sql
cd /var/www/app.example.com
sudo -u www-data composer install --no-dev
sudo -u www-data npm install
sudo -u www-data npm run build
sudo systemctl reload apache2

Backup scope

• MariaDB OpenEMR database
• OpenEMR site configuration, documents, and customizations
• Encryption keys and audit material required for a complete compliant restore

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• Do not import a schema from a different OpenEMR release.
• If dependencies cannot write their cache, correct ownership narrowly instead of making the web root world-writable.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.