How to Handle Employee Onboarding and Offboarding with Self-Hosted Tools

Employee onboarding and offboarding are the two highest-risk processes for a small business. Onboarding creates new accounts across multiple systems with the wrong permissions. Offboarding leaves active accounts for former employees who no longer work there. Both scenarios are security incidents waiting to happen. Here is how to handle both with self-hosted tools.

The Problem with Manual Onboarding

When a new hire starts, someone needs to create accounts on: email, file storage, CRM, project management, chat, wiki, HR system, and password manager. That is eight to ten systems, each with its own permission model. One missed account means the new hire cannot do their job on day one. One over-permissioned account means they can see data they should not.

The offboarding side is worse. When someone leaves, every one of those accounts needs to be disabled or deleted. Studies show that 50 percent of former employees can still access at least one company system after leaving. That is not a statistic. That is a liability.

The SSO Solution: Authelia

Authelia provides single sign-on across every application in your stack. Instead of creating accounts on eight different systems, you create one Authelia account per person and assign them to groups. Authelia then controls access to each application based on group membership.

For onboarding: create one user, assign to the appropriate groups, and they can access everything they need. For offboarding: disable one user, and they lose access to everything immediately. No lingering accounts on individual applications.

Authelia supports LDAP and file-based user backends, TOTP two-factor authentication, and integration with every major reverse proxy (Nginx, Traefik, Caddy).

Automating the Process with n8n

Authelia handles authentication, but there is still work to do: creating email accounts, assigning tasks in the project management tool, granting access to specific CRM records, and sending welcome emails. This is where n8n comes in.

A simple n8n workflow can:

1. Watch a Google Form or a simple web form for new hire submissions
2. Create the Authelia user account via API
3. Create the email account via Mailcow or Docker Mailserver API
4. Send a welcome email with setup instructions and links
5. Create an onboarding task in your project management tool
6. Post a welcome message in Mattermost or Rocket.Chat

The same workflow in reverse handles offboarding: disable the Authelia account, archive the email, notify the team, and create a checklist of assets to collect.

What About HR Records?

For structured HR data (employee records, leave balances, performance reviews), consider self-hosting OrangeHRM. It is an open-source HR management system with modules for personnel information, leave management, time and attendance, and performance tracking. It is heavier than a spreadsheet but lighter than a SaaS HR platform that charges per employee per month.

Let VPS1 set up your employee lifecycle automation. We configure Authelia, n8n workflows, and HR tools tailored to your team size.