Deploy

Local development

Run the backend with emulated DICOM services and the viewer with yarn.

Backend

cd pacs-ai-backend
make             # default target up-local: docker compose -f docker-compose-dev.yml up --build, attached
make up          # same, detached (-d)
make down

# individual services
make up-api-pacs | up-orthanc | up-orthanc-pacs | up-redis | up-elasticsearch
# (make up-torchserve exists in the Makefile but the torchserve/ directory is not in the repo)

No DICOM or network configuration is needed locally: the orthanc-pacs service emulates a remote PACS.
Development values in api-pacs/.env: APP_URL=http://localhost:3000, ELASTICSEARCH_URL=http://localhost:9200, KIBANA_BASE_URL=http://localhost:5601, REDIS_HOST=localhost, FIREBASE_CONFIG_FILE_PATH pointing at api-pacs/configs/firebase/pacs-ai-firebase-admin.json.
Inside api-pacs/: make installs, builds and runs the binary; make install, make build (output in bin/), make lint (needs golangci-lint), make test.
study-service dev-only bypasses: ALLOW_UNAUTHENTICATED_INGEST=true and ALLOW_UNAUTHENTICATED_OPERATOR_ROUTES=true. Never enable them outside local development.

Viewer (PACS-AI, OHIF v3.9.0 base)

nvm install 18.17.0 && nvm use 18.17.0   # the README requires 18.17.0; its step-by-step block installs 18.13.0
npm install -g yarn
yarn config set workspaces-experimental true
yarn install
yarn start        # http://localhost:3000

Variable (`platform/app/.env`)	Purpose
`APP_PUBLIC_API_URL`	Backend URL: `http://localhost/api` locally, `https://<host>/api` in production (HTTPS is mandatory outside local development because login credentials travel to api-pacs)
`APP_PUBLIC_DEFAULT_TENANT`	Tenant ID from Google Cloud Identity Platform
`APP_PUBLIC_TURNSTILE_SITE_KEY`	Public Cloudflare Turnstile site key for registration and server-requested login challenges; the secret key stays backend-only
`APP_PUBLIC_TERMS_OF_USE_URL`, `APP_PUBLIC_PRIVACY_POLICY_URL`	Policy links shown during public registration (informational; the backend enforces versioned acceptance)
`APP_PUBLIC_STUDY_PROCESSING_SSE_ENABLED`	Authenticated live worklist updates; `false` falls back to REST snapshots
`APP_PUBLIC_CANDIDATE_PROCESSING_POLL_ENABLED`	Keeps legacy candidate polling available during the SSE rollout
`APP_FIREBASE_API_KEY`, `APP_FIREBASE_AUTH_DOMAIN`, `APP_FIREBASE_PROJECT_ID`, `APP_FIREBASE_STORAGE_BUCKET`, `APP_FIREBASE_MESSAGING_SENDER_ID`, `APP_FIREBASE_APP_ID`, `APP_FIREBASE_MEASUREMENT_ID`	Firebase web SDK configuration (`APP_FIREBASE_API_KEY` is the same value the deploy script uses as `FIREBASE_API_KEY`)
`PUBLIC_URL=/`, `APP_CONFIG=config/local_pacs_ai.js`, `USE_HASH_ROUTER=false`	Defaults, no change needed

Login is adaptive: ordinary logins do not render Turnstile; when the backend requires verification the viewer renders the widget with the login action and sends its single-use token only to the backend login endpoint. Browser-side Firebase password authentication is not part of the flow. In production the viewer needs no extra setup beyond its .env: make up-prod builds and serves it.