Installation Odoo 19 prête pour
la production

# System user — never run Odoo as root
sudo adduser --system --home=/opt/odoo --group odoo

# PostgreSQL 16
sudo apt install -y postgresql-16 postgresql-client-16

# Create DB role (no superuser, no createdb in production)
sudo -u postgres createuser --createdb --no-superuser \
  --no-createrole odoo

# Python build deps + Odoo runtime deps
sudo apt install -y \
  python3-dev python3-pip python3-venv \
  libxml2-dev libxslt1-dev libldap2-dev libsasl2-dev \
  libpq-dev libjpeg-dev zlib1g-dev \
  node-less npm git

# wkhtmltopdf 0.12.7 (Odoo 19 requirement)
wget https://github.com/wkhtmltopdf/packaging/releases/\
download/0.12.7-1/wkhtmltox_0.12.7-1.jammy_amd64.deb
sudo dpkg -i wkhtmltox_0.12.7-1.jammy_amd64.deb
sudo apt install -f -y

# rtlcss for RTL language support
sudo npm install -g rtlcss

# Clone Odoo 19 (shallow clone saves ~2GB)
sudo -u odoo git clone --depth 1 --branch 19.0 \
  https://github.com/odoo/odoo.git /opt/odoo/odoo

# Virtual environment (isolated from system Python)
sudo -u odoo python3 -m venv /opt/odoo/venv
sudo -u odoo /opt/odoo/venv/bin/pip install --upgrade pip wheel
sudo -u odoo /opt/odoo/venv/bin/pip install \
  -r /opt/odoo/odoo/requirements.txt

# Enterprise (if licensed)
sudo -u odoo git clone --depth 1 --branch 19.0 \
  https://github.com/odoo/enterprise.git /opt/odoo/enterprise

# Custom addons
sudo mkdir -p /opt/odoo/custom-addons
sudo chown odoo:odoo /opt/odoo/custom-addons

[Unit]
Description=Odoo 19
After=postgresql.service
Requires=postgresql.service

[Service]
Type=simple
User=odoo
Group=odoo
ExecStart=/opt/odoo/venv/bin/python /opt/odoo/odoo/odoo-bin \
  -c /etc/odoo/odoo.conf
StandardOutput=journal
StandardError=journal

# Security hardening
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/odoo/.local /var/log/odoo
NoNewPrivileges=true
PrivateTmp=true

# Restart policy
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

upstream odoo_backend {
    server 127.0.0.1:8069;
}
upstream odoo_longpoll {
    server 127.0.0.1:8072;
}

server {
    listen 443 ssl http2;
    server_name erp.yourcompany.com;

    ssl_certificate     /etc/letsencrypt/live/erp.yourcompany.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/erp.yourcompany.com/privkey.pem;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    # Odoo request size (large imports, attachments)
    client_max_body_size 256m;

    # Timeouts for long operations (reports, exports)
    proxy_read_timeout 720s;
    proxy_connect_timeout 720s;
    proxy_send_timeout 720s;

    location / {
        proxy_pass http://odoo_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
    }

    location /websocket {
        proxy_pass http://odoo_longpoll;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Block database manager from outside
    location ~* ^/web/database {
        deny all;
        return 404;
    }

    # Static file caching
    location ~* /web/static/ {
        proxy_pass http://odoo_backend;
        expires 365d;
        add_header Cache-Control "public, immutable";
    }
}