MintHCM

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for MintHCM. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. MintHCM runs a PHP application, a database and an Elasticsearch index on the same instance, so memory matters. m5.large (8 GiB) is the recommended minimum.

Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your HR users connect from. Leave the root volume at the default size or larger.

Select Launch instance. First boot runs the MintHCM installation, which takes a few minutes after the instance state becomes Running and the status checks pass. When it finishes, the sign-in page is served on port 80.

The command below launches an instance from the SecureAnyCloud MintHCM Marketplace AMI into an existing subnet and security group. Replace the following values first:

• <ami-id>: the AMI ID shown on the Marketplace listing
• <key-name>: your EC2 key pair name
• <subnet-id>: your subnet ID
• <security-group-id>: a security group that opens ports 22, 80 and 443 as described above

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":40,"VolumeType":"gp3"}}]' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=minthcm}]'

Connect over SSH as ubuntu, using your key pair and the instance's public IP:

ssh -i /path/to/your-key.pem ubuntu@your-instance-public-ip

Then read the per-instance credentials file. First boot creates it with mode 0600, so only root can read it:

sudo cat /root/minthcm-credentials.txt

The file lists the generated administrator and database credentials for this instance:

minthcm.url=http://<instance-public-ip>/ minthcm.admin.user=admin minthcm.admin.pass=<generated-per-instance> minthcm.db.user=root minthcm.db.pass=<generated-per-instance>

If the file contains a note instead of credentials, first boot has not finished the installation yet. Wait a minute and read the file again.

The appliance runs as three Docker containers managed by Docker Compose. Confirm that they are up:

sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

NAMES IMAGE STATUS minthcm-minthcm-web-1 minthcm/minthcm:latest Up 38 minutes minthcm-minthcm-db-1 percona/percona-server:8.0 Up 38 minutes (healthy) minthcm-minthcm-es-1 docker.elastic.co/elasticsearch/elasticsearch:7.16.3 Up 38 minutes

Confirm the web application answers on port 80:

curl -I http://127.0.0.1/

HTTP/1.1 200 OK Server: Apache/2.4.58 (Ubuntu)

Browse to http://<instance-public-ip>/. Sign in with the admin username and the password from /root/minthcm-credentials.txt.

For production, put MintHCM behind HTTPS (Step 9) before you sign in over the public internet. That way the credentials are never sent in clear text.

MintHCM organises HR data into modules that you reach from the top navigation: Employees, Candidates, Positions, Organizational Units, Leave, Timesheets and more. Each record carries contact details, related documents, meetings, tasks and org-structure relationships. A candidate record, for example, shows its contact information and related panels.

Positions describe your organisational structure. Each position has a status, a supervised unit and relationships to the employees who hold it.

Open the Administration panel to manage users and roles, configure OAuth2 clients, define organisational units, and set system-wide options such as locale, languages, currencies and search.

Under User Management, create a named user account for each HR team member instead of sharing the administrator login. Assign roles to control which modules and records each user can see.

The administrator password is generated per instance. To change it, sign in as the admin user and open Administration > User Management. Select the admin user, choose Edit, and set a new password in the password fields.

Store the new password securely. The file at /root/minthcm-credentials.txt records only the original generated password.

For production, terminate TLS in front of MintHCM. The simplest approach is to place the instance behind an AWS Application Load Balancer with an ACM certificate. The load balancer forwards HTTPS on port 443 to the instance on port 80 within your VPC.

Alternatively, install a reverse proxy such as nginx or Caddy on the instance, with a Let's Encrypt certificate for your domain, and proxy to http://127.0.0.1:80.

After you put MintHCM behind HTTPS, open Administration > System Settings and change the site URL to the https:// address, so that generated links use HTTPS.

The database and the search index each live on their own dedicated EBS volume, separate from the operating system disk, so you can resize each tier independently. List the mounts with:

df -h /var/lib/minthcm/db /var/lib/minthcm/app

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 20G 305M 19G 2% /var/lib/minthcm/db /dev/nvme2n1 20G 49M 19G 1% /var/lib/minthcm/app

To grow a tier, expand the corresponding EBS volume in the EC2 console. Then grow the filesystem on the instance with resize2fs.

Back up the database with a logical dump from the Percona container:

# Logical database dump
DBPASS=$(sudo grep '^DB_PASS=' /opt/minthcm/.env | cut -d= -f2-)
sudo docker exec minthcm-minthcm-db-1 sh -c "mysqldump -uroot -p'$DBPASS' minthcm" > minthcm-backup.sql

For a full point-in-time copy, take EBS snapshots of the /var/lib/minthcm/db and /var/lib/minthcm/app volumes.

The appliance containers restart automatically on reboot. To restart them manually, run cd /opt/minthcm && sudo docker compose restart.