Frappe HR

A note on compliance

This image makes no compliance claims. Frappe HR as shipped here is not GDPR-compliant out of the box and is not a payroll-regulatory or tax-filing product. SecureAnyCloud ships the software installed, configured and hardened. How you use it for real employee data is yours to govern.

You will enter employee personal data and, if you run payroll, financial data. You remain responsible for your own compliance posture. That includes:

• Establishing a lawful basis for processing.
• Honouring data-subject rights.
• Setting a retention and deletion policy.
• Encrypting data in transit (see Enabling HTTPS) and at rest.
• Restricting network access and managing user roles and permissions.
• Keeping audit records.
• Meeting the payroll and tax obligations of your jurisdiction.

Treat this VM as a system that holds sensitive personal data from the moment you add your first employee.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended size. It matches SecureAnyCloud's ERPNext and Frappe Lending images, because this appliance contains ERPNext. The stack is memory-tuned and runs on a Standard_B2s (2 vCPU / 4 GiB RAM) for evaluation. For production HR and payroll workloads and multiple concurrent users, choose B4ms or larger.

Set the NSG inbound rules to allow 22/tcp from your management network and 80/tcp for the web interface. Front the site with TLS for public exposure (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for Frappe HR by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then choose Review + create, and then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:frappe-hr-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name frappe-hr \
  --image sac1647283583153:frappe-hr-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

Then open the web port:

az vm open-port --resource-group <your-rg> --name frappe-hr --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-ip>

Step 4 - Confirm the HR stack is running

Check that all four services report active:

systemctl is-active mariadb redis-server supervisor nginx

Frappe answers an unauthenticated health check, and both applications are installed on the site. Run the check:

curl -s http://127.0.0.1/api/method/ping

Step 5 - Retrieve the Administrator password

Every VM generates its own Administrator password on first boot and writes it to a root-only file. Nothing is shared between deployments, and there is no default login. Read the file:

sudo cat /root/frappe-hr-credentials.txt

Only root can read the file. Confirm its mode and owner:

sudo stat -c '%a %U:%G %n' /root/frappe-hr-credentials.txt

The per-VM password authenticates. Published vendor defaults are rejected, and anonymous access to employee and payroll data is denied. A real Employee round-trip proves the HR module works.

Step 6 - Sign in to Frappe HR

Browse to http://<vm-ip>/ and sign in as Administrator with the password from Step 5.

After you sign in, you land on the Frappe desk. Frappe HR does not use a single "HR" page. It organises the module into separate workspaces. Start at HR Setup:

http://<vm-ip>/app/hr-setup

The other HR workspaces are Tenure (/app/tenure), Recruitment (/app/recruitment), Leaves (/app/leaves), Expenses (/app/expenses), Performance (/app/performance) and Payroll (/app/payroll). You can reach them all from the sidebar once you are in any one of them.

Step 7 - Set up your company

The image ships a neutral starter company named Demo Company with a standard chart of accounts, so you can use and evaluate the HR module immediately, without any setup. It contains no employee, payroll or leave data.

For production use, either rename it or create your own:

• Rename: go to http://<vm-ip>/app/company and open Demo Company. Choose Menu -> Rename to set your own legal entity name and abbreviation. Then set your country, default currency and fiscal year on the same form.
• Create a new company: from the same list, choose Add Company. Fill in the name, abbreviation, default currency and country, and pick a chart of accounts template. Set it as the default in Global Defaults.

Employees, salary structures, leave allocations and payroll entries are all scoped to a company. Make sure the company you intend to use exists before Step 8.

If you create a company for a different country, Frappe HR seeds that country's salary components automatically when the company is saved.

Step 8 - Add your first employee

The Employee record is the anchor of the whole system: leave, attendance, payroll, expense claims and appraisals all hang off it.

Go to http://<vm-ip>/app/employee and choose Add Employee. Enter the first name, select the company, gender, date of birth and date of joining, then save. Frappe generates the employee ID from the HR-EMP- naming series.

To let an employee sign in and use self-service, create a User for them and link it in the User ID field on the employee record.

Step 9 - Configure leave

The image ships the standard leave types: Casual Leave, Sick Leave, Privilege Leave, Compensatory Off and Leave Without Pay. Review them at http://<vm-ip>/app/leave-type.

Allocate leave before employees can apply for it. A Leave Policy (/app/leave-policy) groups leave types and annual amounts. A Leave Policy Assignment grants that policy to employees for a leave period. You can also allocate directly with a Leave Allocation (/app/leave-allocation).

Employees then submit Leave Applications (/app/leave-application). These check the allocated balance and the company holiday list.

Create a Holiday List at /app/holiday-list for your working calendar. Set it on the company or on individual employees.

Step 10 - Payroll

Salary components and salary structures drive payroll. The image seeds the standard salary components for the starter company's country. Review them at http://<vm-ip>/app/salary-component.

Build a Salary Structure (/app/salary-structure) from earnings and deduction components. Assign it to employees with a Salary Structure Assignment. Then run a Payroll Entry (/app/payroll-entry) for a period to generate salary slips. Submitting the payroll entry posts the accounting entries into ERPNext.

Payroll rules, tax rates and statutory deductions vary by jurisdiction. You are responsible for configuring and verifying them. See the compliance note above.

Step 11 - The mobile progressive web app

Frappe HR ships a mobile-first progressive web app for employee self-service. Employees can check in and out, apply for leave, submit expense claims and view salary slips. The app is built into this image and served at:

http://<vm-ip>/hrms

The shift roster interface is at http://<vm-ip>/hr.

Step 12 - Verify the HR module from the command line

The image ships a self-test. It creates a real Employee, reads it back, removes it again, and asserts that the HR master data is present. It is the same check SecureAnyCloud runs against the published image. It is safe to run at any time and leaves no records behind:

sudo /usr/local/sbin/frappe-hr-selftest.sh

Step 13 - Enabling HTTPS

The image serves plain HTTP on port 80. Employee and payroll data is sensitive, so terminate TLS in front of the site before you enter any real data. Install certbot and issue a certificate for a DNS name that points at the VM:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d hr.your-domain.example

Then tell Frappe its public URL so generated links use HTTPS:

sudo -u frappe -H bash -lc "cd /opt/frappe/frappe-bench && bench --site hr.localhost set-config host_name 'https://hr.your-domain.example'"
sudo systemctl restart supervisor

Open 443/tcp in the NSG and restrict 80/tcp to the redirect only.

Step 14 - Maintenance

Check the Frappe process tree:

sudo supervisorctl status

Back up the site (database plus files). Backups are written to the site's private/backups directory:

sudo -u frappe -H bash -lc "cd /opt/frappe/frappe-bench && bench --site hr.localhost backup"

These backups contain employee personal data. Move them off the VM to encrypted storage, and apply your retention policy to them.

Keep the operating system patched:

sudo apt-get update && sudo apt-get -y upgrade

Restart the application tier after configuration changes:

sudo systemctl restart supervisor && sudo systemctl reload nginx

Troubleshooting

The site does not respond on port 80. Confirm that nginx and supervisor are active with systemctl is-active nginx supervisor. Then check the Frappe processes with sudo supervisorctl status. Confirm that the NSG allows inbound 80/tcp.

Sign-in fails. Re-read the password with sudo cat /root/frappe-hr-credentials.txt. The username is Administrator. This image has no default password. Each VM generates its own on first boot.

First boot did not complete. Inspect the one-shot service with sudo systemctl status frappe-hr-firstboot.service and sudo journalctl -u frappe-hr-firstboot.service.

An employee record will not save. First name, company, gender, date of birth and date of joining are all mandatory, and the date of joining must be after the date of birth. If the gender list is empty, add entries at /app/gender.

A leave application is rejected for insufficient balance. Leave must be allocated before it can be applied for. Check /app/leave-allocation for that employee and leave type, and confirm the leave period covers the requested dates.

Payroll produces no salary slips. Every employee in the payroll entry needs an active Salary Structure Assignment covering the payroll period. Check /app/salary-structure-assignment.

Support

SecureAnyCloud provides 24/7 support for this image by email at sales@secureanycloud.com and by live chat. The average response time for critical issues is one hour.

Frappe, ERPNext and Frappe HR are trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Frappe HR on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com