Settings
Platform configuration
Current Session
Domain Management
Lab subdomains are resolved against these base domains (e.g. abc.ceylab.com). The Primary domain is shown in lab URLs. Changes take effect within 60 seconds.
No domains configured yet.
Demo Period
How many days a lab’s demo runs. Applied when you start a demo from a lab’s page — the end date is fixed at that moment, so changing this never shortens or extends demos already running.
AI Provider & API Keys
Keys entered here are encrypted at rest and used by the patient AI assistant. They override any values set in the server environment.
The selected provider has no key yet — the assistant stays hidden from patients until a key is set.
AI Report Assistant
Global throttles for the patient AI assistant, applied across every lab. Set 0 for unlimited. The number of follow-up questions a patient may ask per report is set per plan.
Patient Notifications
Globally enable or disable each channel per event. A message only sends when the channel is enabled here, the provider below is configured, and the cashier selected that channel on the bill.
| Event | SMS | ||
|---|---|---|---|
Bill alert When a bill is created | |||
Lab report delivery When a report is signed & ready |
Credential Encryption
Each lab database password is encrypted with AES-256-GCM before storage. The key is derived from MASTER_ENCRYPTION_KEY via scrypt. The GCM auth tag ensures any tampered record is rejected on decryption.
Algorithm: AES-256-GCM (authenticated encryption)
KDF: scrypt — memory-hard, brute-force resistant
Per-record IV: 16 random bytes — same password encrypts differently each time
Warning: changing or losing MASTER_ENCRYPTION_KEY requires re-entering all lab DB passwords.
Required Environment Variables
MASTER_DB_HOSTHostname of the master MySQL DB (stores lab registry and super admin accounts)
MASTER_DB_NAMEMaster database name (e.g. ceylab_master)
MASTER_ENCRYPTION_KEYAES-256-GCM key for encrypting lab DB credentials. Generate: openssl rand -base64 32
SUPER_ADMIN_JWT_SECRETJWT secret for /admin/* routes. Separate from lab staff JWT.
JWT_SECRETJWT secret for lab staff login tokens
TENANT_BASE_DOMAINFallback base domain used if no domains are configured in the database (default: ceylab.com)
CORS_ORIGINComma-separated allowed origins — include both lab frontend and admin dashboard URL
SMTP_HOST / SMTP_USER / SMTP_PASSSMTP credentials for staff invite and password reset emails
WAHA_BASE_URL / WAHA_SESSION / WAHA_API_KEYSelf-hosted WAHA (WhatsApp HTTP API) for WhatsApp notifications. Leave WAHA_BASE_URL empty to disable WhatsApp sends.
TEXTLK_API_TOKEN / TEXTLK_SENDER_IDText.lk SMS gateway for SMS notifications. Leave TEXTLK_API_TOKEN empty to disable SMS.
MONGODB_URIEnables the activity feed and the outbound-message log (SMS/WhatsApp/email counts shown above).