LambogeniusAs an operating system service
# Windows (as Administrator)
hl7-edge-gateway.exe service install --config C:\hl7edge\hl7-edge-gateway.toml
sc start Hl7EdgeGateway
# Linux: deploy/systemd/hl7-edge-gateway.service
# macOS: deploy/launchd/com.lambogenius.hl7-edge-gateway.plistContainers and cloud
| Where | Template |
|---|---|
| Docker Compose: one node, or a 3-node NATS cluster with 2 gateways and HAProxy | compose.yaml, compose.cluster.yaml |
| Kubernetes: AKS, EKS, GKE | Helm chart, optionally with NATS as a dependency |
| Azure Container Apps | Bicep |
| AWS ECS Fargate behind a Network Load Balancer | Terraform |
Their local storage doesn't survive a replica being replaced, so store-and-forward routes there need an external NATS JetStream cluster. Otherwise messages that were already acknowledged can be lost. The templates refuse to deploy an embedded store there unless you explicitly accept that, and the gateway then shows a warning in its log and console. Pass-through routes have no such limitation.
The templates take console users, API tokens, single sign-on (with the client secret from the platform's secret store) and store encryption keys from secrets: Helm admin.users, admin.oidc and store.encryption; Bicep consoleUsers, oidc and storeKeys from Key Vault; Terraform console_users, oidc and store_keys from Secrets Manager, with admin_certificate_arn for an HTTPS console on the load balancer.
MLLP is usually best kept close to the sending system: run the gateway at the edge, next to MEDITECH, and let it make outbound HTTPS calls to the cloud. Hosting it in the cloud means carrying MLLP across a VPN or private link, and MLLPS is then a must.