Install and maintain Odoo on Ubuntu

Odoo 18 Community is installed from source under /opt/odoo with PostgreSQL 16, a Python virtual environment, custom add-ons, systemd, Nginx, and TLS.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A strong Odoo master database password.
• Enough RAM/CPU for the configured workers and PostgreSQL workload.
• Review all third-party custom add-ons before installing them.

What the AppStore installation creates

• Odoo 18.0 source below /opt/odoo/odoo-server
• Dedicated Odoo system user and Python virtual environment
• PostgreSQL 16, wkhtmltopdf, Node tooling, custom add-ons
• Systemd service, Nginx proxy for ports 8069/8072, Certbot, UFW, and Fail2ban

1. Install PostgreSQL and build dependencies

sudo apt update
sudo apt install -y git python3-venv python3-pip python3-dev build-essential \
  libxml2-dev libxslt1-dev libldap2-dev libsasl2-dev libpq-dev \
  nodejs npm postgresql postgresql-client nginx certbot python3-certbot-nginx \
  ufw fail2ban
sudo systemctl enable --now postgresql nginx

2. Create the Odoo user and source tree

sudo useradd --system --home=/opt/odoo --create-home --shell=/bin/bash odoo
sudo -u postgres createuser --createdb odoo
sudo -u odoo git clone --depth 1 --branch 18.0 https://github.com/odoo/odoo.git /opt/odoo/odoo-server
sudo -u odoo python3 -m venv /opt/odoo/venv
sudo -u odoo /opt/odoo/venv/bin/pip install --upgrade pip wheel
sudo -u odoo /opt/odoo/venv/bin/pip install -r /opt/odoo/odoo-server/requirements.txt
sudo install -d -o odoo -g odoo -m 0750 /opt/odoo/custom/addons

3. Create the protected Odoo configuration

Set the master password, PostgreSQL connection, add-ons paths, proxy mode, log path, HTTP port 8069, and gevent/long-polling port 8072.

sudo nano /etc/odoo-server.conf
sudo chown root:odoo /etc/odoo-server.conf
sudo chmod 0640 /etc/odoo-server.conf

4. Create the service and Nginx proxy

Run Odoo as the dedicated user. Proxy normal requests to 8069 and websocket/long-polling requests to 8072.

sudo nano /etc/systemd/system/odoo-server.service
sudo systemctl daemon-reload
sudo systemctl enable --now odoo-server
sudo nano /etc/nginx/sites-available/odoo
sudo ln -s /etc/nginx/sites-available/odoo /etc/nginx/sites-enabled/odoo
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d app.example.com -m admin@example.com --agree-tos --redirect

Important files and data

• Odoo source: /opt/odoo/odoo-server
• Python environment: /opt/odoo/venv
• Custom add-ons: /opt/odoo/custom/addons
• Protected configuration: /etc/odoo-server.conf
• Service and logs: odoo-server.service and the configured log file

Health checks and logs

Run these checks after installation and after each upgrade:

sudo systemctl status odoo-server postgresql nginx --no-pager
sudo journalctl -u odoo-server -n 100 --no-pager
curl -I http://127.0.0.1:8069
sudo nginx -t

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo systemctl stop odoo-server
# Back up PostgreSQL and filestore, then update only within a tested release plan.
sudo -u odoo git -C /opt/odoo/odoo-server pull --ff-only
sudo -u odoo /opt/odoo/venv/bin/pip install -r /opt/odoo/odoo-server/requirements.txt
sudo systemctl start odoo-server

Backup scope

• Every Odoo PostgreSQL database
• Each matching filestore below the Odoo data directory
• Custom add-ons and /etc/odoo-server.conf

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• A database backup without its matching filestore is incomplete.
• If real-time features fail, verify the Nginx websocket/long-polling route to port 8072.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.