Open HRMS

1. Open the Azure Marketplace and search for Open HRMS on Ubuntu 24.04 LTS by SecureAnyCloud.
2. Select Create, then choose your subscription, resource group and region.
3. Pick a VM size of Standard_D2s_v3 or larger.
4. Under Administrator account, select SSH public key and supply your public key.
5. Under Inbound port rules, allow SSH (22) and HTTPS (443).
6. Select Review + create, then Create.

Create a resource group, accept the Marketplace terms, then create the VM and open port 443.

az group create --name openhrms-rg --location eastus

az vm image terms accept --urn sac1647283583153:openhrms-ubuntu-24-04:default:latest
az vm create \
  --resource-group openhrms-rg \
  --name openhrms-vm \
  --image sac1647283583153:openhrms-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group openhrms-rg --name openhrms-vm --port 443 --priority 1010

First boot takes a couple of minutes. The VM does the following:

1. Creates its own PostgreSQL password, Odoo master password, TLS certificate and administrator password.
2. Sets the administrator credential through Odoo's own password hasher.
3. Starts the application.
4. Proves the whole stack with the bundled self-test before it reports ready.

Connect to the VM.

ssh azureuser@<public-ip>

Check that all five services are active.

systemctl is-active postgresql nginx openhrms-tls odoo openhrms-firstboot

You should see output like this.

active active active active active

openhrms-tls is a one-shot unit that mints this VM's TLS certificate before nginx starts. openhrms-firstboot is the one-shot unit that created every secret. Both report active after they complete.

Check the Odoo version, the number of staged Open HRMS modules, and the number of installed modules.

dpkg-query -W -f='${Version}\n' odoo

ls /opt/openhrms/addons | grep -vE '^(LICENSE|README.md)$' | wc -l

sudo -u postgres psql -d openhrms -tAc "select count(*) from ir_module_module where state='installed'"

You should see output like this.

18.0.20260909 33 133

33 Open HRMS modules are staged on disk. 133 Odoo modules are installed in the database, which is the Open HRMS set plus every Odoo Community module they depend on.

Three modules from the upstream repository are deliberately not shipped, and the image asserts their absence at build time:

• ent_uae_wps_report: Declares the Odoo Proprietary License (OPL-1), which forbids redistribution, and is the only module in the set that depends on Odoo Enterprise addons. The LGPL-3 module uae_wps_report provides the same UAE WPS report on Community payroll and is included.
• oh_hr_zk_attendance: Integrates physical ZKTeco biometric terminals through the PyPI packages zklib (last released 2015) and pyzk (last released 2019), both abandoned and predating Python 3.12. It cannot function without the hardware on your LAN.
• hr_company_policy: Its browser-side template targets an element that the Open HRMS dashboard no longer renders at this release, which breaks the dashboard outright for every user. It is excluded rather than patched, so the image keeps shipping upstream code unmodified.

You can install any of them yourself from the upstream repository if your deployment needs them.

Every secret on this VM was created on this VM. Read them as root.

sudo cat /root/openhrms-credentials.txt

You should see output like this. Your values will differ, because every VM creates its own.

# Open HRMS on Ubuntu 24.04 — Per-VM Instance Info
# Generated: <generation timestamp>
#
# Every secret below was generated on THIS virtual machine at first boot. None was baked into
# the image and no two sac VMs share any of them. Keep this file secret.
# OPENHRMS_ADMIN_USER=admin OPENHRMS_ADMIN_PASSWORD=<set-at-first-boot> OPENHRMS_URL=https://<your VM's public IP>/ OPENHRMS_DB_NAME=openhrms

The Odoo master password and the PostgreSQL password are not in that file. They live in /etc/odoo/odoo.conf, which only root and the odoo service account can read. Check the permissions.

sudo stat -c '%a %U:%G %n' /root/openhrms-credentials.txt /etc/odoo/odoo.conf

You should see output like this.

600 root:root /root/openhrms-credentials.txt 640 root:odoo /etc/odoo/odoo.conf

Only three TCP ports face the network. Odoo's HTTP worker (8069), its websocket worker (8072) and PostgreSQL (5432) are bound to loopback and cannot be reached from outside the VM. List the listeners.

ss -tlnH | awk '{print $4}' | sort -u

You should see output like this.

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5432 127.0.0.1:8069 127.0.0.1:8072 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

The database manager is blocked. Odoo's built-in manager serves its Create, Duplicate, Backup and Restore forms to an unauthenticated visitor even when database listing is switched off. So this image blocks the whole /web/database path at nginx, as well as setting list_db = False. Test the paths.

for U in /healthz /web/health /web/login /web/database/manager /web/database/create /web/database/selector; do printf '%-28s %s\n' "$U" "$(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1$U)" done

You should see output like this.

/healthz 200 /web/health 200 /web/login 200 /web/database/manager 404 /web/database/create 404 /web/database/selector 404

Plain HTTP only redirects. Confirm it.

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/

You should see this output.

301

Run the self-test.

sudo /usr/local/bin/openhrms-selftest

This is a real feature round trip, not a page load. The test does the following:

• Checks the TLS front door and the HTTP redirect
• Confirms that the login page and its stylesheet and script bundles are served with the right content types
• Confirms that the database manager refuses to serve
• Rejects a deliberately wrong password
• Signs in with this VM's own administrator credential
• Reads all 33 Open HRMS modules back as installed
• Resolves the Open HRMS dashboard
• Creates an employee record, reads it back field by field, finds it by name search and deletes it, then checks that the employee count returns to where it started
• Asserts the exact set of network-facing ports

You should see output like this.

OK openhrms self-test passed: healthz 200, :80 301, login page + text/css + javascript served, /web/health pass, database manager refuses to serve, wrong password rejected, per-VM admin authenticated, all 33 Open HRMS modules installed (both excluded modules absent), dashboard action resolves, hr.employee create/read/search/delete round-trip OK with the count back to 1, backend asset bundle compiled (1185944 bytes of real CSS), anonymous RPC refused, exposed ports exactly {22,80,443}, Odoo 8069/8072 + PostgreSQL 5432 loopback-only

Open https://<your VM's public IP>/ in a browser. The certificate is self-signed and created on your VM, so your browser warns once. Accept it, or replace the certificate as described in Step 14.

Sign in with the username and password from /root/openhrms-credentials.txt.

The sign-in page is wrapped in Odoo's public website layout with sample content, because the Website module is a dependency of the Open HRMS Employee Background Verification module. After you sign in, you can edit or unpublish those public pages from the Website app.

Signing in lands you on the Open HRMS dashboard, the suite's home view. It draws your own figures from the database: payslip, timesheet and contract counts, the broad factor absence score, a check-in control, and panels for attendance, leave, expenses and projects. It also shows upcoming birthdays, events and announcements.

Further down are the leave and skill analyses, leave request and allocation counts, job applications, departments, and the monthly join, resign and attrition charts.

• Open the Employees app from the app menu.
• Select New, enter the person's name and job title, and fill in the work email and department.
• Save.

The employee form is Odoo's own, extended by Open HRMS. It adds extra tabs for Insurance and Employee History, smart buttons for Disciplinary Action and Announcements, and menu entries for Document Templates, Legal Actions, Services and Loans & Advances.

The image ships with a single employee record, Administrator, which Odoo's own HR module creates and links to the administrator account.

There is no demo data of any kind: no sample company beyond the default, and no invented employees, contracts or payslips.

Open the Apps app, clear the default Apps filter, and search for Open HRMS. Every module in the result set is already installed, so none of them shows an Activate button.

You can confirm the same thing from the shell.

sudo -u postgres psql -d openhrms -tAc "select count(*) from ir_module_module where state='installed' and (name like 'ohrms\_%' or name like 'oh\_%' or name like 'hrms\_%')"

You should see this output.

12

That counts only the modules whose technical name carries an Open HRMS prefix. The rest of the suite uses hr_-prefixed names shared with Odoo's own HR modules, which is why the full staged count in Step 5 is 33.

Here is where to find each part of the suite.

• Departments and job positions: Employees > Configuration
• Working schedules and shifts: Employees > Configuration > Working Schedules, and the Open HRMS Employee Shift module for shift rosters
• Attendance: the Attendances app, with Open HRMS Attendance Regularization for correcting missed check-ins
• Leave: the Time Off app, with Open HRMS Leave Multi-Level Approval for multi-stage approval chains and Leave Request Aliasing for requests by email
• Payroll: the Payroll app provided by the Open HRMS community payroll modules, covering salary structures, salary rules, contracts and payslips
• Loans and advances: Open HRMS Loan Management and Advance Salary, with the accounting bridge in Loan Accounting
• Appraisals, custody, insurance, resignation, transfer and legal actions: each has its own menu after you sign in

The shipped certificate is self-signed and created on your VM. For production, point a DNS name at the VM and install a CA-signed certificate. Place the certificate and key at /etc/nginx/tls/openhrms.crt and /etc/nginx/tls/openhrms.key, keep the key mode 0600, then reload nginx.

If you use Let's Encrypt, install certbot and issue the certificate against your own domain.

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After you change the hostname that customers use, update Odoo's own base URL so generated links point at it. Sign in as the administrator and enable the developer tools. Then open Settings > Technical > System Parameters and set web.base.url to your HTTPS URL.

The image sets web.base.url.freeze to True deliberately, so Odoo does not silently overwrite that value with whatever host an administrator last signed in from.

The whole application state is the PostgreSQL database plus Odoo's filestore. Back up both.

sudo -u postgres pg_dump -Fc openhrms > /var/backups/openhrms-$(date +%F).dump
sudo tar czf /var/backups/openhrms-filestore-$(date +%F).tar.gz -C /var/lib/odoo filestore

Odoo's own browser-based backup tool is not available on this image, because the database manager it lives in is blocked at the front door. pg_dump is the supported path, and it is what you should schedule.

Read the Odoo server log and the Odoo journal.

sudo tail -20 /var/log/odoo/odoo-server.log

sudo journalctl -u odoo --no-pager | tail -20

The first-boot log records everything that was created on this VM.

sudo tail -20 /var/log/sac/sac-firstboot.log

If the web interface is unreachable, work outwards:

1. Check systemctl is-active odoo nginx postgresql.
2. Confirm that Odoo is answering on loopback with curl -sf http://127.0.0.1:8069/web/health.
3. Check that your network security group allows inbound 443.

You can re-run sudo /usr/local/bin/openhrms-selftest at any time. It tells you exactly which layer is broken.