Self-Hosting
OrangeHRM is an open-source human resource management system — the kind of platform a company uses to track employees, leave, time, recruitment, and performance. It has been around for years, with a free, open-source edition (sometimes called OrangeHRM Starter) alongside paid commercial tiers, and under the hood it is a standard PHP application on a MySQL or MariaDB database — a classic LAMP-stack app that is straightforward to self-host.
I deployed it in my homelab not just as another box to break into, but as a solution to a real problem: how does a small organization manage its people without signing up for an expensive HR SaaS? That is the lens I care about most — evaluating open-source software to see whether it genuinely solves a business need before recommending it. The fact that it also makes a realistic, data-rich target for security testing is a bonus, not the point.
This write-up walks through standing it up on Proxmox with a TurnKey Linux appliance, configuring it like a real deployment, and weighing what self-hosting an HR system means for a small business — from both an architecture-and-solutions and a security perspective.
I approach tools like this the way a solutions architect would: start with the problem, then test whether the software actually solves it. The problem here is concrete — a small or growing business needs to manage employee records, leave, and onboarding, but commercial HR platforms charge per employee per month and often keep your data inside a vendor cloud. OrangeHRM is a candidate answer, so the goal of the exercise was to stand it up, run it like a real deployment, and judge whether it holds up.
Standing it up in the lab also pays a second dividend. Most lab machines are empty — a bare OS with nothing on it — which is a poor stand-in for the systems you actually run in production. A populated HR system is the opposite: it has an organizational structure, user accounts at different permission levels, and a database full of the kind of personal data that matters. That makes it a believable application to integrate with directory services, to back up and restore, to put behind a reverse proxy, and — yes — to reason about from a security standpoint. But the headline is the solution: real software solving a real problem on infrastructure you control.
The fastest route is TurnKey Linux, a project that publishes ready-made, pre-configured appliances for common applications — OrangeHRM among them. Each appliance is a hardened Debian base with the full application stack already installed and wired together, so there is no manual LAMP setup. Proxmox ships these appliances directly as LXC container templates, which means you can pull OrangeHRM down and run it in minutes.
In the Proxmox web UI, select your storage, open CT Templates, click Templates, and search for orangehrm. Download it, then create a container from it. From the node shell the same thing looks like this:
# Refresh the appliance catalog and find the OrangeHRM template
pveam update
pveam available --section turnkeylinux | grep orangehrm
# Download it to local storage
pveam download local debian-12-turnkey-orangehrm_18.0-1_amd64.tar.gz
# Create an unprivileged container from the template (VMID 130)
pct create 130 local:vztmpl/debian-12-turnkey-orangehrm_18.0-1_amd64.tar.gz \
--hostname orangehrm --memory 2048 --cores 2 \
--net0 name=eth0,bridge=vmbr0,ip=dhcp --unprivileged 1 --start 1Adjust the exact template filename to whatever pveam available lists, and point the bridge and storage at your environment.
Running it as an LXC container is the lightest option and what I use here. If you would rather have a full VM -- for stronger isolation, or to mirror the templating workflow from my Proxmox post -- download the ISO or VM image from turnkeylinux.org and install it as a normal VM instead. The application and first-boot steps are identical either way.
TurnKey appliances run an interactive setup the first time they boot. Open the container console from Proxmox and you will be walked through the essentials:
Once that finishes, the appliance shows you its address. OrangeHRM itself is served over HTTPS at the container IP, and TurnKey adds a few admin interfaces on dedicated ports:
https://<container-ip>/ # OrangeHRM application
https://<container-ip>:12321/ # Webmin (system administration)
https://<container-ip>:12322/ # Adminer (database)
https://<container-ip>:12320/ # Web shellThe certificate is self-signed out of the box, so expect a browser warning until you put a real certificate or a reverse proxy in front of it.
Log into the application as Admin with the password you set at first boot. Before adding people, it helps to lay down the structure they slot into, all under the Admin menu:
With the scaffolding in place, switch to the PIM (Personnel Information Management) module and start adding employees — personal details, contact info, job and salary, reporting manager. As you create employees you can issue each one a login account with an ESS (Employee Self Service) role, so staff sign in and manage their own information rather than going through HR for every change.
The open-source edition is more capable than people expect. The core modules cover most of a small company day to day:
This is where the evaluation pays off. Choosing a self-hosted solution is an architecture decision with real trade-offs, and OrangeHRM lands well for a small business on several fronts:
But self-hosting is a trade, not a free lunch. The same business now owns everything a SaaS vendor would normally handle: patching the OS and the application, securing the database, managing TLS certificates, controlling access, and — critically — protecting a system that is essentially a concentrated store of employee personal information. A good solution accounts for that cost up front; for a company without dedicated IT, it is the deciding factor.
Because an HR system is a high-value target full of personal data, a few things are not optional once you move past kicking the tires:
OrangeHRM passed the test. A single TurnKey appliance gives you a fully functional, realistic HR platform in minutes, with enough depth to genuinely evaluate — and for a small business it is a credible, low-cost answer to a real problem, running on infrastructure you own. That is the part I care about most: not just whether a tool is interesting to a security researcher, but whether an open-source solution can stand in for an expensive commercial product and actually do the job. This one can — provided you go in clear-eyed about the security and maintenance that come with holding employee data yourself.