Odoo production hosting checklist

Why a go-live checklist matters

Most Odoo hosting problems are not exotic. A disk fills up with logs. Backups stop and nobody notices. Invoices land in spam. The database manager is open to the internet. Each one is easy to prevent before launch and painful to fix after users depend on Odoo.

This checklist pulls the essentials together in one place. Each section links to a longer guide if you need the details. Odoo's own deployment documentation is the reference for the configuration options mentioned here.

1. Server and sizing

Pick a size for real usage

Size the server for the number of people who will use Odoo at the same time, not the total number of users. As a rule of thumb, 2 vCPUs and 4 to 8 GB of RAM handle a small team, and 4 vCPUs with 8 to 16 GB a mid-sized one. Our Odoo workers and server sizing guide has the numbers.

Choose the region and the operating system

• Put the server in a region close to most of your users.
• Check data residency rules first if you handle personal data in the EU. See Odoo data residency and GDPR.
• Use a supported long-term release of Ubuntu or Debian, and leave room on the disk for the database, the filestore and logs to grow.

2. Odoo configuration

Multi-process mode and limits

• Set workers above 0 so Odoo runs in multi-process mode. Threaded mode is for development.
• Set max_cron_threads for scheduled actions, usually 1 or 2.
• Set limit_memory_soft, limit_memory_hard, limit_time_cpu and limit_time_real, so one runaway request cannot take the server down.

Lock down the database manager

• Set list_db = False to hide the database manager, so nobody can create, copy, drop or download databases from the web.
• Set a long, random master password (admin_passwd) and store it in a password manager.
• Set a dbfilter that matches only your production database, and do not install demo data on it.

Run behind a reverse proxy

• Bind Odoo to 127.0.0.1 and put Nginx (or another proxy) in front for HTTPS.
• Turn on proxy_mode so Odoo sees the real client address and protocol.
• Route long-polling or websocket traffic to Odoo's gevent port, so live chat and notifications work.

3. Domain, HTTPS and the base URL

• Point your domain's DNS at the server and issue a certificate for it.
• Redirect plain HTTP to HTTPS.
• Check that the web.base.url system parameter shows your real domain, because links in emails and portal invitations use it. Set web.base.url.freeze if an administrator logging in from another address keeps changing it.

Our guide to custom domains and SSL for Odoo covers the DNS records and certificate renewal.

4. Email

• Send through an email provider, not directly from the server. Many clouds block outgoing port 25.
• Publish SPF, DKIM and DMARC records for your sending domain.
• Set the alias domain so replies and bounces come back to the right Odoo record.
• Send a test invoice to an outside mailbox and check that it lands in the inbox.

See configuring email for self-hosted Odoo for the full setup.

5. Backups and recovery

Back up the right things

• Back up the database and the filestore together. One without the other is not a backup.
• Run backups at least daily, and keep several days, weeks and months.
• Keep at least one copy off the server, in a different account or provider from the server itself.

Prove you can restore

• Restore a backup to a separate instance before go-live, and time it.
• Write down who restores, how and where, so it is not a guess on a bad day.
• Get an alert when a backup fails, not a silent log line.

Our Odoo backup strategy and disaster recovery for Odoo guides go further.

6. Staging and updates

• Create a staging copy of production, with outgoing email and scheduled actions turned off, so tests cannot email customers or run real jobs.
• Test new modules, module updates and Odoo upgrades there first.
• Keep custom modules in Git and deploy a known branch, rather than copying files by hand.
• Pull Odoo's source updates regularly, after testing them on staging.

See why every Odoo project needs a staging environment and deploying Odoo custom modules from Git.

7. Security

• Use SSH keys, turn off SSH password logins and block brute-force attempts.
• Install operating system security updates automatically.
• Open only SSH, HTTP and HTTPS to the internet. Never expose PostgreSQL or Odoo's own ports.
• Give Odoo its own PostgreSQL role without superuser rights, and its own system user.
• Turn on two-factor authentication for Odoo administrators.

The full list is in our Odoo security hardening checklist.

8. Monitoring

• Check that Odoo answers over HTTPS, from outside the server, every few minutes.
• Alert on disk space, memory and CPU before they run out.
• Watch the Odoo log for errors, and rotate logs so they cannot fill the disk.
• Keep an eye on certificate expiry and on failed scheduled actions.

See what to monitor on an Odoo server for thresholds and tools.

Launch day

On the day you switch users over:

1. Take a fresh backup, and confirm it finished.
2. Lower the DNS TTL a day in advance if you are moving from another server.
3. Switch DNS, then check HTTPS, sign-in and the base URL.
4. Send one test email in each direction.
5. Check that scheduled actions run and that the next backup is scheduled.
6. Watch the server's memory and CPU through the first busy morning.

How CloudPilot covers the checklist

CloudPilot handles most of the server items for you, on your own cloud account or server:

• Odoo configuration: each instance gets a generated master password, list_db = False, a dbfilter for its own database, proxy_mode on, Odoo bound to 127.0.0.1, and memory limits calculated from the server size and worker count.
• Isolation: each instance has its own system service, system user and PostgreSQL role without superuser rights.
• Server hardening on new cloud servers: SSH password logins off, fail2ban and automatic security updates.
• Domains and HTTPS, with certificates issued and renewed for you.
• Daily backups with retention, restore to the same or a new instance, and offsite copies to S3, Azure Blob Storage, Google Cloud Storage or SFTP.
• Staging with outgoing email and scheduled actions neutralized, and Git deploys for custom modules.
• Monitoring with health checks, server metrics and email alerts.

You still own the parts only you can do: DNS, your email provider, Odoo user accounts and a restore test. See managed Odoo hosting for what CloudPilot looks after, getting started for the first steps, and pricing for each plan.

Odoo production hosting: questions