Network requirements
Hosts and ports to allow for EDFlow: web, the realtime WebSocket, push notifications, integration-engine egress to the API, the waiting-room display kiosk, and guest Wi-Fi guidance for patients.
EDFlow needs no inbound access to the hospital network. Everything is outbound HTTPS (TCP 443) from the hospital.
Staff workstations and the display
| Purpose | Host |
|---|---|
| Web app (console, admin, patient and family web, display) | https://app.edflow.space |
| Realtime updates | The backend's WebSocket host for your deployment (secure WebSocket on 443), provided at onboarding |
| Auth cookie proxy | Same host as the web app (/api/auth) |
| Documentation | https://docs.edflow.space |
| Microsoft sign-in (if used) | login.microsoftonline.com |
Allow secure WebSockets through any proxy that inspects TLS; the board and queue depend on a long-lived connection.
Hospital-managed staff phones
Push notifications use Apple APNs and Google FCM through Expo:
| Platform | Hosts |
|---|---|
| iOS | *.push.apple.com (443, and 5223 where your MDM allows it) |
| Android | fcm.googleapis.com, mtalk.google.com (5228–5230) |
| Both | exp.host |
Integration engine egress
| Purpose | Host |
|---|---|
| Integration API and signed ingest (live) | https://api.edflow.space |
| mTLS token endpoint (live) | https://mtls.api.edflow.space |
| Customer test | https://api.test.edflow.space |
| Sandbox | https://api.sandbox.edflow.space |
In customer test and live, your engine's egress addresses go on the source's or app's IP allowlist. Webhooks to your receivers come from fixed egress IPs listed by GET /v1/meta; new IPs are published 90 days before first use.
Waiting-room display
A TV at 1920 × 1080 or larger with a current browser in kiosk mode, on a network that can reach the web app host over HTTPS and WebSocket. If the site uses a display key, it's carried in the URL fragment; rotate it from the admin.
Patient guest Wi-Fi
Patients use their own data or the hospital's guest Wi-Fi. Make sure the guest network allows the web app host and the WebSocket over 443, and doesn't block push services. Put the network name and password in Hospital information so patients can copy them.
Related
Last updated on