Install from a ready-made image

A ready-made image is a virtual machine disk with everything already on it: Debian 13, fully patched, the antelao-ohm package, and the container images a fresh server runs. You import it into your hypervisor or cloud, start the machine, and it installs itself on its first boot.

What you end up with is the same server the one-line installer lays, with most of the downloading already done. From the first sign-in on, the steps are the same.

An image carries nothing that belongs to one server. The agent's keys, the console key, the server identity, the certificate authority and the administrator's password are all made at the first boot, on your machine, and never exist in the file you download.

Which file for your platform

The images are for 64-bit Intel and AMD (amd64) machines only. Apple Silicon Macs and other ARM hosts cannot run them.

Platform	File	First sign-in through
Proxmox VE	qcow2	Proxmox's own Cloud-Init drive, or a seed ISO
KVM and libvirt (virt-manager, virsh)	qcow2	A seed ISO
TrueNAS SCALE	qcow2	A seed ISO
Unraid	qcow2	A seed ISO
OpenStack clouds	qcow2	The key pair and user data you give the instance
Microsoft Hyper-V	VHDX, as a Generation 2 machine	A seed ISO
VMware ESXi and vSphere	OVA	The OVA's properties
VMware Workstation, VMware Fusion (Intel Macs)	OVA	The OVA's properties, or a seed ISO
Oracle VirtualBox	OVA	A seed ISO
QNAP Virtualization Station	OVA	A seed ISO
Synology Virtual Machine Manager	VHDX, or the VMDK inside the OVA	A seed ISO
Microsoft Azure	None: a route of its own, on its own page	The administrator account and key you give Azure
Hetzner Cloud	None: Debian 13 and the installer, or the qcow2 as a snapshot, on its own page	The SSH key you choose at Hetzner, for root
DigitalOcean	None: Debian 13 and the installer, or the qcow2 as a custom image, on its own page	The SSH key you choose at DigitalOcean, for root

An OVA is a tar archive holding the machine's description and its disk, a VMDK file. Any archive tool that reads tar files unpacks it, which is how you reach the VMDK for a platform that takes the disk alone.

Hardware

Processor	2 vCPU, amd64
Memory	4 GB
Disk	40 GB. The image's disk is 40 GB; grow it before the first start if you want more, and the machine uses the space on its first boot
Firmware	UEFI or BIOS: the disk boots both
Network	One adapter, with a way out to the internet for the first boot and for updates, as the installer's requirements describe

That is a floor, not a recommendation. Odoo instances grow with their filestores, so give the disk room.

Download

The current images are release 0.23.0. Only the newest release is published, and this table always shows it:

File and SHA-256	Size
antelao-ohm-0.23.0-amd64.qcow2QEMU disk (qcow2), compressedc1b01a78bb545395b577c4ca0f0d4c670b5b6dec0439d389fec093ded98fb370	3.0 GB
antelao-ohm-0.23.0-amd64.vhdx.zipHyper-V disk (VHDX), zippedb3b3bf3a6dbf205d2bbcc5e107392967bb7485c1f3431a0a34752fa408399542	2.8 GB
antelao-ohm-0.23.0-amd64.ovaOpen Virtual Appliance (OVF and a VMDK disk)a3cfa13c82089e88290333bd95ec9026884cecfe35133ab6e2e725dd41581d30	2.9 GB
SHA256SUMSThe three checksums, one per line
SHA256SUMS.sigAntelao's signature of SHA256SUMS

Verify the download

Antelao signs SHA256SUMS with the same key it signs every release with. Check the signature, then check the image against SHA256SUMS. Run this in the folder you downloaded the image to; it needs cosign, which Verify a download shows how to install:

curl -fsSLO https://packages.antelao.io/raw/cosign.pub
sha256sum cosign.pub
curl -fsSLO https://images.antelao.io/ohm/stable/0.23.0/SHA256SUMS
curl -fsSLO https://images.antelao.io/ohm/stable/0.23.0/SHA256SUMS.sig
cosign verify-blob --key cosign.pub --signature SHA256SUMS.sig \
  --insecure-ignore-tlog=true SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

Three things must come out right:

1. sha256sum cosign.pub prints b485d68100a0e9213130796831efcca16bc445bfcf0375299262a2428581cdb4.
2. cosign prints Verified OK. Its warning about --insecure-ignore-tlog is expected; see Why --insecure-ignore-tlog=true.
3. sha256sum prints OK after the name of every image you downloaded.

On Windows, compare the image's checksum with its line in SHA256SUMS from PowerShell:

Get-FileHash .\antelao-ohm-<version>-amd64.vhdx.zip -Algorithm SHA256

On a Mac, shasum -a 256 antelao-ohm-<version>-amd64.ova prints the same checksum.

If any check fails, do not import the image. Delete it and download it again; see When a check fails.

What the first boot does

When the machine starts for the first time:

1. cloud-init, the standard first-boot tool of cloud images, reads your seed, the OVA's properties or the cloud's user data. It names the machine and gives the image's user debian your SSH key or password.
2. The antelao-ohm package is brought up to date when a newer release is available. A machine that cannot reach the package repository carries on with the release in the image.
3. ohm install runs, unattended, exactly as the one-line installer runs it: the keys, the server identity, the certificate authority, the containers and the administrator are made on this machine.
4. The hand-off - the console's address and the administrator's first password - is written to /root/antelao-ohm-handoff.json, readable by root only. It never goes to the screen or the boot log, which a cloud may show to anyone allowed to read the machine's console.

This takes a few minutes. Sign in while it runs and the login message says so and shows how to follow it:

sudo journalctl -u ohm-firstboot -f

Once the first boot has completed, nothing starts it again: not a reboot, a resize, a later update or a changed seed. Until it has completed, a machine that looks new to cloud-init - its seed or its Cloud-Init drive changed - starts it again by itself. If it fails, the login message says FAILED with the reason; fix the cause and run it again:

sudo /usr/local/lib/ohm/ohm-firstboot

The first sign-in

A machine nobody can sign in to is no use, so the first boot needs to be told who you are. There are three ways, depending on the platform (the table above says which):

• A seed ISO. A small disc holding your SSH key, a password or both, attached to the machine as a CD or DVD drive before its first start. Build one below.
• The OVA's properties. Deploying the OVA on ESXi or vSphere asks for them, and so does importing it into VMware Workstation or Fusion: a hostname, an SSH public key, a password for debian, and an optional cloud-config. Leave the instance id as it is.
• The cloud's own fields. Proxmox's Cloud-Init drive and OpenStack ask for an SSH key when you create the machine, and the image gives it to debian. Where they also take user data, it is the same cloud-config a seed ISO carries: build a seed, open What is on the disc, and copy its user-data. Hetzner Cloud and DigitalOcean give the key to root instead; their pages say how.

No seed? The machine still installs itself, takes its address from your network's DHCP and is named antelao-ohm. Its own screen, in your hypervisor's console, then shows the console's address and a one-time sign-in code:

Open the address in your browser and choose Sign in with a one-time code under the sign-in form. Type the code:

The console then asks for the password you will sign in with from now on (at least 12 characters), and after that for the license agreement:

The code works once. Until somebody has signed in, every restart of the machine shows a new one and the old one stops working; after the first sign-in no code is shown again (a spent code may stay on the screen until the next restart). Nobody can sign in to the machine itself over SSH, so give it a seed whenever you can.

With a key, sign in over SSH as debian once the first boot is done; the login message shows the console's address. Then read the administrator's first password:

ssh debian@odoo.example.com
sudo cat /root/antelao-ohm-handoff.json

With a password only, sign in as debian on the machine's own screen, from your hypervisor's console. SSH keeps refusing passwords, so the password is for that screen alone.

Delete the hand-off file after your first sign-in to the console. The login message then shortens to the console's address.

Keep the seed attached

Leave the seed ISO in the machine's drive for as long as the machine exists. A machine whose seed disappears looks like a new machine to cloud-init at its next start: it makes new SSH host keys (your SSH client then warns you) and falls back to DHCP if the seed gave it a fixed address. The server itself is not installed again.

If you gave a password, the disc holds a hash of it: keep the ISO file where only administrators can reach it, as you would keep the password. A seed with an SSH key only holds nothing secret.

The management ports are not behind the managed nginx

A machine from an image is a server like any other: the console (5322), the API (5312) and the other management ports listen on the machine directly. Keep them closed to the internet and reach the console over SSH, as Reach the console shows.

From here, carry on with the installation page:

1. Check the server
2. Reach the console
3. Sign in and finish the setup
4. Create your first instance

Build a seed ISO

A seed ISO is a disc labelled cidata with two small text files on it: user-data, which says who may sign in, and meta-data, which names the machine. cloud-init looks for it at the first boot.

This page builds one for you. Give an SSH key, a password or both, and a server name if you want one now. The server name is handed to the installation as the server's DNS name, and can be changed later with a rename.

Build a seed ISO

Everything happens in this browser. Nothing you type is sent anywhere, and the password never goes on the disc: only its SHA-512 hash does.

Server name (optional)The DNS name the server answers to. Leave it empty to keep the machine's own name; you can rename the server later.

SSH public keysOne per line, as your .pub file has it. They sign in as the user debian.

Password for debian (optional)

Password again

For signing in on the machine's own screen. SSH keeps refusing passwords, so a key is still the way in over the network.

Attach seed.iso to the machine as a CD or DVD drive before you start it for the first time, and leave it attached afterwards, as The first sign-in explains. The disc holds a hash of your password, if you gave one, so keep the file as you would keep the password.

On Linux you can build the same disc yourself from two files of your own:

xorriso -as genisoimage -output seed.iso -volid cidata -joliet -rock user-data meta-data

Related

• Install the server, the one-line installer on a Debian host
• Verify a download
• The management console