Skip to main content

DigitalOcean

The simple route on DigitalOcean needs nothing from this site: create a Droplet from DigitalOcean's own Debian 13 image and give it a few lines of user data that run the one-line installer on its first boot. The Droplet is ready about 10 minutes after you create it, in any region, with IPv6 if you want it.

The ready-made image works on DigitalOcean too, imported once as a custom image. The import takes about 25 minutes; after that a Droplet from it is ready a little sooner, but without IPv6.

Before you start​

  • A DigitalOcean team in which you may create Droplets and firewalls.
  • A plan with 2 vCPU and 4 GB of memory or more, as Hardware describes. Basic, CPU option Regular, 4 GB / 2 CPUs with an 80 GB disk (s-2vcpu-4gb) is the smallest that fits.
  • A region that offers it. The regions do not all offer the same plans. Where your region has no Regular 2 vCPU / 4 GB plan, the Premium Intel plan s-2vcpu-4gb-intel is the nearest that fits.
  • Your SSH public key, already in your DigitalOcean team or added while you create the Droplet.
  • A DNS name you can point at the Droplet's public address later, for publicly trusted certificates on your Odoo instances. Optional at this point.

The user data​

This is the whole of it, the same block as on Hetzner Cloud. Copy it as it is:

#cloud-config
# Antelao Odoo Host Manager: install on the first boot of a stock Debian 13 server.
# The administrator's first password goes to /root/antelao-ohm-handoff.json (root only),
# never to the cloud-init log.
package_update: true
package_upgrade: true
runcmd:
  - curl -fsSL https://packages.antelao.io/raw/antelao-ohm-installer.sh | ANTELAO_INSTALL_RESULT=/root/antelao-ohm-handoff.json ANTELAO_INSTALL_NO_REGISTRATION_KEY=yes bash
  • The first line must be exactly #cloud-config.
  • package_update and package_upgrade bring Debian up to date before the install.
  • ANTELAO_INSTALL_RESULT writes the hand-off - the console's address, the user admin and its generated password - to /root/antelao-ohm-handoff.json, readable by root only, instead of printing it. The cloud-init log, /var/log/cloud-init-output.log, then carries no password.
  • ANTELAO_INSTALL_NO_REGISTRATION_KEY=yes leaves out the registration key. Writing the hand-off to a file otherwise also issues an API key, the registration key, for a console that registers the new server as an environment; with nobody to collect it, it would only be a credential lying in a file. A ready-made image's first boot leaves it out too.

Without the two variables the install still works, but the password is then shown nowhere and you set a new one on the server with sudo ohm user password-reset admin.

To decide things up front - the server's DNS name, the mail profile, the provisioning domain - add a write_files entry that writes the bootstrap document to /etc/antelao/bootstrap.json with permissions: '0600', as Microsoft Azure shows. DigitalOcean keeps the user data with the Droplet, so leave passwords out of it unless that is acceptable.

Create the Droplet​

In the DigitalOcean control panel:

  1. Create (top right) > Droplets.
  2. Choose Region: one that offers the plan; see Before you start.
  3. Choose an image: the OS tab > Debian > version 13 x64.
  4. Choose Size: Shared CPU > Basic > CPU options Regular > 4 GB / 2 CPUs, 80 GB SSD, or larger. Where the page offers a choice of bundled plans, keep the bundled one.
  5. Choose Authentication Method: SSH Key, and select your key or add one with New SSH Key.
  6. Advanced Options: tick Public IPv6 if you want it, then Add Initialization scripts and paste the user data.
  7. Finalize Details: Quantity 1, a Hostname such as pelmo, and the tag odoo-host-manager. The hostname becomes the server's host name and the name on the console's certificate, until you give the server a DNS name.
  8. Create Droplet.

Create the firewall​

Once per team, after the first Droplet carrying the tag exists:

  1. Networking > Firewalls > Create Firewall, name odoo-host-manager.
  2. Inbound Rules: SSH (22), HTTP (80) and HTTPS (443), from All IPv4 and All IPv6, and ICMP. Add nothing for 5322 or the other management ports.
  3. Outbound Rules: keep the defaults: all TCP, all UDP and ICMP.
  4. Apply to Droplets: the tag odoo-host-manager, so every Droplet with the tag gets the firewall.
  5. Create Firewall.

This firewall is what keeps the management ports closed. The console (5322), the API (5312) and the agent (5202) listen on every address of the server, as the installation page warns. The install runs for several minutes after the Droplet starts, so there is time to add it; do not leave it out.

With doctl​

The same, from the doctl command-line tool signed in to your team. Save the user data as cloud-config.yaml:

doctl compute ssh-key import admin-laptop --public-key-file ~/.ssh/id_ed25519.pub
doctl compute droplet create pelmo --region ams3 --size s-2vcpu-4gb --image debian-13-x64 \
    --ssh-keys <key id> --tag-name odoo-host-manager --enable-ipv6 \
    --user-data-file cloud-config.yaml --wait
doctl compute firewall create --name odoo-host-manager --tag-names odoo-host-manager \
    --inbound-rules "protocol:tcp,ports:22,address:0.0.0.0/0,address:::/0 protocol:tcp,ports:80,address:0.0.0.0/0,address:::/0 protocol:tcp,ports:443,address:0.0.0.0/0,address:::/0 protocol:icmp,address:0.0.0.0/0,address:::/0" \
    --outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::/0 protocol:udp,ports:all,address:0.0.0.0/0,address:::/0 protocol:icmp,address:0.0.0.0/0,address:::/0"

Create the Droplet first. doctl compute firewall create --tag-names fails with tag odoo-host-manager does not exist while nothing carries the tag yet.

Wait for the install​

The Droplet is active within a minute. The user data then upgrades Debian and the installer lays the server: about 10 minutes in all.

On DigitalOcean's Debian, your key signs in as root. Follow the install:

ssh root@203.0.113.10
cloud-init status --wait                 # says "status: done" when the install is finished
tail -f /var/log/cloud-init-output.log   # or follow it as it goes

Reach the console​

Once cloud-init is done, read the administrator's first password:

sudo cat /root/antelao-ohm-handoff.json

The user is admin, and the password is the file's administratorPassword. Delete the file after your first sign-in to the console.

Then open the console through an SSH tunnel from your own computer, which opens no port on the firewall:

ssh -N -L 5322:127.0.0.1:5322 root@203.0.113.10

Browse to https://localhost:5322/ and accept the self-signed certificate once; it is made out to the server's name and to localhost. Point your DNS name at the Droplet's public addresses, then carry on with the installation page:

  1. Check the server
  2. Reach the console
  3. Sign in and finish the setup
  4. Create your first instance

Install your license in the console under Server > License; see Installing a license.

The ready-made image as a custom image​

DigitalOcean imports the qcow2 straight from its download address, as a custom image you create Droplets from. Once imported, a Droplet from it is ready in about 8 or 9 minutes: the image installs itself on its first boot, as every ready-made image does. What differs from the simple route:

  • An SSH key is mandatory. DigitalOcean gives this image no root password: the control panel offers no password option, and without a key DigitalOcean refuses the Droplet with The image for this droplet does not use root passwords, please use an SSH key. It cannot reset the root password later either.
  • No IPv6. DigitalOcean gives Droplets from custom images no IPv6 address.
  • The disk must be at least the image's, 40 GB. A 25 GB plan is refused with Cannot create a droplet with a smaller disk than the image; the 2 vCPU / 4 GB plans have 80 GB anyway.
  • One region. The image is imported into one region. Transfer it to others from its More menu.
  • Storage. DigitalOcean bills the custom image's storage for as long as you keep it.

Import the image​

  1. Copy the address of the qcow2 from the table on the overview page: https://images.antelao.io/ohm/stable/<version>/antelao-ohm-<version>-amd64.qcow2.
  2. Backups & Snapshots > the Custom Images tab > Import via URL.
  3. Paste the address, then Next.
  4. Name: for example Antelao Odoo Host Manager <version>. Distribution: Debian. Datacenter region: the region your Droplets go in.
  5. Upload Image.

With doctl:

doctl compute image create "antelao-ohm-<version>" \
    --image-url https://images.antelao.io/ohm/stable/<version>/antelao-ohm-<version>-amd64.qcow2 \
    --region ams3 --image-distribution Debian \
    --image-description "Antelao Odoo Host Manager <version>"
doctl compute image get <image id>      # pending, then available

The import takes about 25 minutes, and the image shows as pending with no progress figure until it is done. The address must keep working until then. Only the newest release is published, so use the address the overview's table shows now: an address copied before a release can stop working part-way.

There is no need to check the image yourself first: DigitalOcean downloads it, not you. To check it anyway, download it and run the verification against the same version.

Create a Droplet from it​

  1. Create > Droplets.
  2. Choose Region: the image's region.
  3. Choose an image: the Custom images tab > Antelao Odoo Host Manager <version>.
  4. Choose Size: Basic > Regular > 4 GB / 2 CPUs, or larger.
  5. Choose Authentication Method: SSH Key, and select your key.
  6. Advanced Options: user data is optional here; the image needs none to install itself. It takes a cloud-config that writes the bootstrap document, for example.
  7. Hostname and the tag odoo-host-manager, then Create Droplet.

With doctl:

doctl compute droplet create pelmo --region ams3 --size s-2vcpu-4gb --image <image id> \
    --ssh-keys <key id> --tag-name odoo-host-manager --wait

The firewall applies to it through the tag. Keep its outbound UDP rule: a Droplet from a custom image gets its address over DHCP.

Sign in as root with your key; there is no debian user on DigitalOcean. While the first boot runs, the login message says so and shows how to follow it; when it is done, the message shows the console's address and the tunnel command. From there, Reach the console is the same as for the simple route.

An image a release behind still lands on the current release: its first boot brings the package up to date before it installs.

Platform notes and troubleshooting​

  • The plan is not offered. Plans differ between regions. Choose another region, or another plan with 2 vCPU, 4 GB and 40 GB of disk or more.
  • SSH times out. Check that the odoo-host-manager firewall applies to the Droplet, through its tag or by name, and allows port 22.
  • SSH refuses the key. Sign in as root, with the key you selected when you created the Droplet.
  • The install is not finished after 15 minutes. tail /var/log/cloud-init-output.log shows where it stopped, and If the install stops part-way what to look at; sudo ohm install repairs whatever it finds. On a Droplet from the custom image, see What the first boot does instead.
  • The management ports. Keep 5322, 5312 and the other management ports out of the cloud firewall, or open them to your own addresses only. For a second line on the server itself, see Restricting the management ports.
  • The DNS name. Without one, the server is named after the Droplet. Point an A record, and an AAAA record where the Droplet has IPv6, at it, then rename the server as Renaming the server shows.
Last updated on