Skip to main content
ariefrse.my
HomeSkillsProjectsAI WorkWritingContact
Resume
All writing

Note · Infrastructure

Hosting a company's HR system on a PC that never turns off

A production pilot on one desktop machine, zero hosting bill, real TLS and a hidden origin. What that buys, and what it honestly costs.

July 7, 2026 · 8 min read

The pilot stack for hrmydeck, the HRMS built end to end with AI agents, is three pieces. None of them is a rented server.

A desktop PC runs Docker Compose: Postgres 16 plus a Laravel container serving /admin, /employee and /api. A Cloudflare Tunnel dials out from that machine, so there are no open ports and no public IP. DNS at Hostinger points hr.ariefrse.my at the tunnel, and Cloudflare terminates TLS.

The container boots self-sufficient. Migrations run on start, the first boot seeds demo accounts, and secrets live in one .env.staging file. The machine runs unattended: cloudflared is installed as a Windows service that restarts if it dies, containers carry restart: unless-stopped, and a scheduled task dumps the database nightly to a second location.

The footguns

Do not run cloudflared inside Docker pointing at localhost. That is the container's localhost, not the host's, and every request 502s. The tunnel runs natively on the host. The app runs in Docker. They are not neighbours.

The app must know its public URL. Laravel scopes session cookies to STAGING_PUBLIC_URL. If that does not match the browser's URL exactly, logins die with "Page expired" and nothing anywhere hints at why.

Quick tunnels are for demos only. trycloudflare.com URLs change on every restart. A named tunnel plus the DNS record is what makes the address permanent.

The trade-off, honestly

What this buysWhat this costs
RM0 per month, no certificates to renewUptime rides on one machine and one connection
A hidden origin that never opens a portFailures are silent, nothing pages me
Real hardware, which beats a cheap VPSBackups are nobody's problem but mine
A clean exit to a VPS laterCloudflare sees the plaintext

The reasoning behind accepting that column on the right: a pilot with one company and unproven revenue should cheap out on exactly one thing, availability, while keeping the security fundamentals real. Cheaping out on encryption or backups would be borrowing against a bill that arrives with someone else's payroll data attached.

What I learned

A production pilot does not need production infrastructure. One machine, one compose file, zero hosting bill, but real TLS, a hidden origin, encrypted employee data, boot-time migrations and nightly off-disk backups.

Graduating to a VPS later is a docker compose up on different hardware, not a redesign. Same tunnel trick as this portfolio, and the same class of surprise:

how my website quietly lost its security padlock

.

self-hostingcloudflaredockerlaravel

Share

XLinkedInWhatsAppThreads

Related

  • How my website quietly lost its security padlockEvery trailing-slash redirect was downgrading visitors from HTTPS to plain HTTP. Browsers follow that without a word, so nothing ever looked broken.
  • An HR platform where seven in ten commits came from an agentSeven in ten commits came from an agent. Zero in ten decisions about what "correct" means for the business did.

© 2026 Muhammad Arief Roseli

GitHubLinkedInSnapInvois