How to deploy employee tracking software on your own server

Self-hosting employee tracking software is usually driven by one of three things: a client contract that prohibits employee data leaving your infrastructure, screenshots that would contain sensitive material, or a headcount where per-user billing has stopped making sense. Whichever it is, the deployment itself is more straightforward than most teams expect — and the parts that go wrong are predictable.

1. Size the server, and size the disk properly

Compute is rarely the constraint. Disk is, and specifically screenshot storage, because it grows every working day and nobody notices until the volume is full.

The rule of thumb is roughly 1.5 to 3 GB per employee per month with captures at a five to ten minute interval over an eight-hour day. That figure scales linearly with retention, so halving the retention period halves the steady-state requirement. Decide the retention number before you provision the disk, not after.

2. Prepare the host

• A Linux distribution with Docker Engine 24+ and the compose plugin.
• A DNS A record pointing at the host, for example hr.yourcompany.com. Do this first — certificate issuance depends on it and DNS propagation is the one step you cannot hurry.
• Ports 80 and 443 reachable if you want automatic certificates, or an existing certificate to mount.
• An SMTP relay. Notification and invitation email will not work without one, and finding this out during the employee import is a bad time to find it out.
• A separate volume or mount for uploads, so a full screenshot directory does not take the operating system down with it.

Set the timezone before anybody marks attendance. Attendance calculations compare timestamps against shift times using the server timezone. Changing it after a month of records exist means those records were evaluated against a different reference, and unwinding that is genuinely painful.

3. Install

tar xzf employeedesk-selfhosted.tar.gz
cd employeedesk

nano .env          # domain, database password, licence key, SMTP, TZ

docker compose up -d
docker compose logs -f app

curl -fsS https://hr.yourcompany.com/api/health

The bundle is a compose file, an environment template and the container images. Nothing else on the host is modified, which matters if the server is doing something else as well. Full detail is in the installation documentation.

4. Decide where screenshots live

Two options, and the choice is mostly about who you want to own the growth problem.

• Local disk. Simplest, and the right answer when the whole point is that nothing leaves the building. Monitor free space, and make retention shorter than you initially think you need.
• Your own S3-compatible bucket. Growth stops being an operational problem and becomes a line item. Still your data, still your bucket, still not ours.

5. Set up backups before you go live

A complete backup is a database dump plus the uploads directory. It is worth writing this before the first employee is imported, because after go-live it competes with everything else for attention and quietly never happens.

docker compose exec -T db \
  mongodump --archive --gzip --db=employeedesk \
  > /backup/edc-db-$(date +%F).archive.gz

rsync -a --delete ./uploads/ /backup/uploads/

Then sync /backup somewhere off the host, and restore it once into a scratch database. An untested backup is a hypothesis. The backup and restore guide has the full procedure.

6. Roll out the desktop trackers

On a self-hosted installation the desktop app is configured with your own server URL, so no employee activity data leaves the network. Installs are per-user on Windows and macOS and need no administrator rights. The app updates itself from your server, so a fleet does not need to be revisited when you publish a new build.

The four things that actually go wrong

What self-hosting genuinely costs you

Being honest about the other side of the ledger: a server, and somebody who patches it, backs it up and notices when it fills. If nobody in the organisation owns that, a self-hosted installation will decay and cloud is the better decision. Private cloud is the middle option — single-tenant, in your region, operated by us.

Related