Purpose
Distinguish the operational application from the public learning website and understand the responsibility of hosting configuration.
Expected outcome
You can describe the system layers and identify deployment controls that require qualification rather than assuming localhost behavior is production-ready.
Prerequisites
Authorized technical/quality responsibility and a documented target environment. End users should not change infrastructure or database settings to resolve a workflow issue.
Section 1: Application layers
| Component | Responsibility |
|---|---|
| Operational Blazor web | Authenticated workflow interface and feedback. |
| ASP.NET Core API and services | Authorization, scope enforcement, validation and operational transitions. |
| EF Core / PostgreSQL 17 | Relational persistence and transactional updates. |
| Public Razor Pages website | Server-rendered marketing/help pages on .NET 10 with preserved ASPX URLs; no trial DB connection. |
Section 2: Local addresses
The current development application is at localhost:8080; its API is a separate service. This parallel website is at localhost:8086. Local addresses refer to the machine opening them; they are not customer-facing internet addresses. The locally published PostgreSQL port is restricted to IPv4 loopback.
Section 3: External deployment checklist
- HTTPS certificates, proxy/forwarded-header configuration and approved public addresses.
- Private database/API access, least-privilege administration and protected secrets.
- Persistent Data Protection keys and preservation of existing encrypted records/documents.
- Database-consistent encrypted backups, restoration exercises and recovery objectives.
- Monitoring, logging/retention, patching, data residency and supplier assessment.
- Approved deployment qualification and intended-use validation.
Troubleshooting and checks
This Razor Pages site supports Linux .NET 10 container hosting; its preserved ASPX URLs are routes, not Web Forms execution. The original Windows/IIS website remains a separate deployment. Do not expose database or API ports to the internet simply to make the site reachable.
This guide supports training and does not authorize clinical decisions, override access controls or establish regulatory compliance. The approved protocol and organizational procedures remain authoritative.