Laborbuch — step-by-step installation

From a bare server to a running Laborbuch in about 10 minutes — no programming knowledge required.

Installation takes about 10 minutes and requires no programming knowledge — the script asks a few questions and does the rest. This page explains every step.

What you need

A Linux server (e.g. Ubuntu or Debian): at least 2 GB RAM and 20 GB disk (4 GB RAM with the antivirus enabled). It can be a rented server in a data centre (e.g. Hetzner — from about €5/month) or a server in your office.
Docker — the free runtime Laborbuch runs in. If missing, one command installs it (step 1).
Remote variant (server on the internet): your own domain, e.g. laborbuch.yourcompany.com, pointing to the server’s IP (an A record), and open ports 80 and 443.
Local variant (office server): nothing more — the server’s IP address on your company network is enough.

What does the script actually do?

You start with a bare server — nothing needs to be prepared on it except Docker (step 1). The script installs the complete stack: the Laborbuch application, the database, and a web server that takes care of traffic encryption by itself. In remote mode this web server automatically obtains a free SSL certificate for your domain and renews it by itself roughly every 3 months — you buy no certificate, track no renewal dates and configure nothing; connections are fully encrypted from the first minute (the padlock in the browser). In local mode traffic is encrypted as well — the certificate is issued by your installation’s internal authority (described below).

Step 1 — log in to the server and install Docker

Connect via SSH (Windows: PuTTY or the built-in terminal; macOS/Linux: Terminal):

ssh root@YOUR-SERVER-ADDRESS

If Docker is not installed yet, paste and confirm with Enter:

curl -fsSL https://get.docker.com | sh

Step 2 — download and run the install script

Paste these two lines (confirm each with Enter):

curl -fsSL -o install-laborbuch.sh https://koch-laboratory.com/download/install-laborbuch.sh
sh install-laborbuch.sh

The script sends nothing to us — all passwords and keys are generated on your server and stay there.

Step 3 — the script’s questions explained

Question	Meaning	What to answer
Install directory	Folder for the program and data	Enter (default `./laborbuch`)
Mode: remote / local	`remote` = internet server with your own domain; the SSL certificate is issued automatically. `local` = office server, access from the company network only	Data centre → `remote`; office → `local`
Domain (remote)	The address your team will open	e.g. `laborbuch.yourcompany.com` (must already point to the server)
Let’s Encrypt e-mail (remote)	SSL certificate notifications	Your admin e-mail
Hostname or IP (local)	The server’s address on the office network	e.g. `192.168.1.50`
Antivirus (yes/no)	Scanning of uploaded evidence files (ClamAV with automatic signature updates)	`yes` if the team will upload files (scans, measurement data) — needs about 1.5 GB extra RAM. `no` if you use hash-only mode (files never leave workstations) or want to add it later
Database: sqlite / postgres	Where the system stores its data	`sqlite` (built-in — recommended). `postgres` only if your company runs its own PostgreSQL server with an administrator; the script will then ask for the database address (details below)
Admin login and password	The first account you will log in with	Any login, password min. 12 characters
Path to license.json	The licence file from Advena Partners	If you have it — enter the path; if not — Enter (see “Activation”)

After the last question the script downloads the software and starts the system — at the end it prints the address and login.

Activating the licence

You will receive license.json from us by e-mail after purchase. Upload it into the installation directory on the server (overwriting the existing empty file) — e.g. with WinSCP or:

scp license.json root@SERVER-ADDRESS:laborbuch/license.json

No restart needed — the system detects the licence by itself. Until activation the instance runs read-only. Renewal after a year = the same step with a new file.

Local mode — trusting the certificate once

In local mode the SSL certificate is issued by your installation’s internal authority, so browsers warn on first visit. Import the file data/caddy/pki/authorities/local/root.crt from the installation directory on your team’s computers (Windows: double-click → Install certificate → Trusted Root Certification Authorities). In remote mode this step does not exist.

Database: built-in (SQLite) or PostgreSQL?

The script asks about the database. For the vast majority of companies the right answer is sqlite (the default — just press Enter):

zero administration and configuration — works immediately,
backups and restore with one click in the admin panel,
performance with plenty of headroom for every plan, including Institute.

Choose postgres only if your company already runs a PostgreSQL server with an administrator. The script will then ask for the database address in the form postgres://user:password@host:5432/database — your administrator must create the database and account beforehand, and backups are then done with the database server’s tools (not in the panel). In doubt? Pick sqlite.

Security and privacy of your data

A few facts you can hand straight to your IT department or data protection officer:

Your data never leaves your company. Laborbuch runs entirely on your server — the vendor has no access to the instance or the data. The only thing that ever goes out are short cryptographic fingerprints (hashes) for timestamping — never content.
Encryption in transit and at rest. Connections are always encrypted (HTTPS in both installation modes); evidence files are additionally encrypted on disk with AES-256. The encryption key is generated during installation on your server and never leaves it.
Access control. Two-factor login (app, hardware token or e-mail code — set per account by the administrator), automatic lockout of password-guessing attempts, roles, and masking of colleagues’ hours from one another.
A tamper-evident journal. Closed entries can be neither changed nor deleted (corrections only as an explicit storno); every week is timestamped through two independent channels — including the Bitcoin blockchain. The proof of integrity can be verified without the vendor’s involvement.
Access log and backups. The system records who viewed reports and downloaded files and when; database backups are one click, and every restore leaves a trace.
Compliance documentation (in German): TOM — technical and organisational measures, Art. 32 GDPR, DPA template (AVV), GoBD retention.

After installation — the first 15 minutes

Log in at the address from the summary (admin account).
Admin panel → Site settings → Laboratory profile: enable/disable Git integration and pick the evidence file mode (upload or hash-only).
Add a project and assign team members.
Create user accounts and assign each a 2FA method (app / hardware token / e-mail).
Admin panel → Database backups → create the first backup.

The manuals take it from here: the user manual (the team’s daily work) and the administrator manual (configuration, week closes, backups, licence).

Common problems

The site does not respond → on the server: cd laborbuch && docker compose logs web.
Certificate error in remote mode → check the domain points at the server’s IP (ping domain) and ports 80/443 are open.
“Read-only mode” → the licence file is missing or expired; is license.json in the installation directory?
Times shifted relative to the clock → Laborbuch displays times in one timezone for the whole installation (default Europe/Berlin). If your team works in a different timezone, set TIME_ZONE= in the .env file in the installation directory to an IANA name (e.g. Europe/Lisbon) and run docker compose up -d.

Support: info@dms-secure.de — please include the output of docker compose logs web (without sensitive data).