Managed by an Odoo Management Plane
An Odoo Management Plane (OMP) manages a whole fleet of servers, for one or several tenants, as one surface. A server it manages keeps everything it has - its own console, its own accounts, its own rules - and in addition reports to the plane and carries out what people do there.
The server opens every connection itself: it reports to the plane and asks it for work. The plane never needs the server's address, and the server opens no port for it.
What the OMP is, and how to get one
The Odoo Management Plane is a separate Antelao product. It is not part of the Odoo Host Manager, and nothing in this product installs one. What every Odoo Host Manager server does carry is the part that works with a plane: enrolling, reporting, carrying out its requests and leaving it. That part is what this page describes.
The OMP is not generally available yet. There is nothing to download, install or sign up for, and no enrolment token to obtain. Until it is available:
- To manage several servers from one console, register them as environments.
- To set up a server at a hosting provider, create it yourself, as Install the server or a ready-made image shows; the Hetzner Cloud, DigitalOcean and Microsoft Azure pages walk through it at those providers.
The rest of this page applies once your server is managed by a plane.
Enrol during the install
On the plane, choose the tenant and Servers > Enrol a server, and copy the command it shows. The command carries one enrolment token, and the token is all the server needs: it names the plane's address and the fingerprint of the plane's signing key.
curl -fsSL https://packages.antelao.io/raw/antelao-ohm-installer.sh | sudo ANTELAO_INSTALL_OMP_TOKEN='omp1....' bash
Before it sends anything, the installer reads the plane's identity at the address in the token and goes on only when the plane is the one that issued it. When the plane wants an administrator to approve new servers, the installer waits, asking every 15 seconds for up to 30 minutes. If nobody approves in that time it stops without installing anything; once the server is approved, run the same command again and it carries on where it stopped.
A server the plane rents for you is enrolled this way without anyone typing a token: the plane writes it into the server's bootstrap document before the install runs.
The enrolment combines with the installer's other variables; a server the plane rents is installed the same way, from its bootstrap document.
Enrol a server that is already installed
On the server:
sudo ohm omp enrol 'omp1....'
The same checks and the same wait apply. The server's own installation is not touched.
What the plane sees
About once a minute the server reports its instances with their state, health and last backup verdict, the jobs that moved, the alerts it raised, its license and the updates on offer. A server that stops reporting is marked unreachable on the plane until it reports again.
What the plane does
What people do on the plane for this server - start an instance, run a backup, apply an update - is sent to the server as a request signed with the plane's key, and the server carries it out as that person, with the role the plane gives them here. The server checks every request against the key it stored when it enrolled and refuses one that is not signed by it, has expired or is for another server. The server's own rules then decide exactly as they do in its console, and the work shows on the Jobs page under the person's name. The link to the plane itself is never changed this way: only an administrator on the server can do that.
The bar at the top of the console
While a plane manages the server, every page of the server's own console carries a bar across the top of the screen naming the plane, with a link to it. Nothing in the console is locked: changes made here are reported to the plane like any other.
Open console from the plane
Open console on a server's page in the plane signs you in to that server's console as yourself, with the role the plane gives you on it, without an account on the server. The link works once and for two minutes; the session it opens lasts twelve hours and ends at once if the server leaves the plane. A Viewer or an Operator the plane gives the whole server reaches the instances there are at the moment of signing in.
When the server has Cloudflare Turnstile on, Open console first opens a page on the server with the Turnstile widget and a Continue button: you are signed in once Cloudflare has confirmed the widget and you select Continue. A refused check counts like any refused sign-in, and it does not use up the link, so you can try again within its two minutes. Without Turnstile you are signed in straight away.
Your own account pages - password, authenticator, trusted devices - belong to accounts on the server, so they have nothing to show you here. You may be asked to accept the license agreement, as any other person is.
See who manages the server
ohm omp status
shows the plane's address, when the server enrolled, its last report and the last error, if any.
Leave the plane
ohm omp leave
removes the link: the server stops reporting and runs nothing the plane sends, and carries on as a stand-alone server. The plane marks it unreachable; remove it there too. To manage it again, enrol it with a new token.