ohm command reference

Generated from ohm docs export --json: 229 commands, 203 of which run against a remote server and 26 of which must run on the server itself.

Pass --server <name|url> to choose a stored connection or an API endpoint, or --local to act on the host you are on. Those two, and the three other options the root command carries, are on every command and are omitted from the tables below; they are listed in Configuration and state.

Installing

One command lays the whole host, and the same command repairs it. It runs on the server itself and has no remote form: it is what a remote call would travel over.

ohm install

Install the system on this host, or repair the installation that exists (local only).

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--license`	No	A license file to place; it can also be installed later in the console.
`--workstation`	No	A developer workstation: every listener on loopback, no GeoIP or Fail2Ban service, instances owned by the developer's own account, every restore neutralised.
`--workstation-user`	No	The developer's account name (default: the account that ran sudo).
`--allow-unencrypted-disk`	No	Install a workstation on a disk with no encrypted volume; Confidential and Restricted instances still cannot be pulled onto it.
`--no-docker-group`	No	Leave the developer out of the docker group; their editor cannot then attach to the running instance container.
`--ide`	No	The IDE new developer profiles default to: vscode (default) or pycharm.
`--rotate-secrets`	No	On a repair, replace the agent keys, the console key and the administrator's password instead of keeping the ones that already work.
`--move-pin-down`	No	Pin this server to this ohm's own release even when it runs a newer one, to take it back to an older release on purpose. Refused when the master database was written by a newer release.
`--show-secrets`	No	Print the agent's operator key and a generated administrator password in the hand-off even when the output is not a terminal (a log file, a pipe, an automated job).
`--accept-license`	No	Accept the license agreement without being asked (read it with 'ohm license agreement show').
`--maxmind-account`	No	The MaxMind account ID the GeoLite2 database is downloaded with (with --maxmind-key).
`--maxmind-key`	No	The MaxMind license key (with --maxmind-account).
`--smtp-host`	No	The SMTP host mail is relayed to; enables the mail profile (with --smtp-sender).
`--smtp-port`	No	The SMTP port (default 587).
`--smtp-user`	No	The SMTP username (with --smtp-password).
`--smtp-password`	No	The SMTP password (with --smtp-user).
`--smtp-sender`	No	The sender address; also where the server's notifications go until changed.
`--smtp-sender-name`	No	The display name mail is sent as.
`--smtp-to`	No	Notification recipients, comma separated (default: the sender).
`--smtp-cc`	No	Carbon-copy recipients, comma separated.
`--smtp-bcc`	No	Blind-copy recipients, comma separated.
`--smtp-from-filter`	No	The allowed sender addresses, comma separated.
`--trusted-proxies`	No	Addresses or CIDR ranges of a reverse proxy in front of nginx, comma separated.
`--api-allow`	No	Addresses or CIDR ranges the management API admits beside this server's own network, comma separated. A fresh install closes its API to the outside; name the console that manages this server here.
`--provisioning-domain`	No	The domain instances created without a host name are named under, for example customers.example.com (<id>.customers.example.com). Point a wildcard DNS record for it at this server.
`--admin-password-file`	No	A file, readable by its owner only, holding the administrator's password on its first line (at least 12 characters). Set on a fresh install, and on a repair too.
`--admin-totp-file`	No	A file, readable by its owner only, holding the administrator's base32 two-factor seed on its first line; two-factor is switched on and required with it.
`--result`	No	Write the hand-off (the addresses, the server identity, a registration key and the administrator's password) to this file, root-only, instead of printing it; for a provisioning console that runs the install over SSH.
`--stage`	No	Only pull and build the images a fresh install of this release runs, and the browser editor's, and change nothing else on the host; for building a machine image whose first boot then installs. Reads the channel and the registry like an install does.

Local only

$ sudo ohm install

Connections

ohm talks to a remote server by default. Connections are stored once and then named, so day-to-day commands do not repeat a URL and an API key.

ohm connection add

Store a new management-API connection.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-n`, `--name`	No	Name of the connection.
`-u`, `--url`	No	Base URL of the management API (e.g. https://server:5312).
`-k`, `--api-key`	No	API key for the management API. Prompted for when omitted.
`--ca-file`	No	PEM or DER file of the certificate authority to trust for this server instead of this machine's trust store, such as the .crt file of the server's trust kit.
`--certificate-sha256`	No	SHA-256 fingerprint of the server's certificate (AB:CD:...): only that certificate is accepted for this server, whoever issued it.
`--default`	No	Make this connection the default. The first stored connection is the default automatically.

Local only

$ ohm connection add

ohm connection default

Show or set the default management-API connection.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-n`, `--name`	No	Name of the connection.

Local only

$ ohm connection default

ohm connection list

List the stored management-API connections.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--show-secrets`	No	Reveal secrets (passwords, tokens) instead of masking them.

Local only

$ ohm connection list

ohm connection remove

Remove a stored management-API connection.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-n`, `--name`	No	Name of the connection.

Local only

$ ohm connection remove

Server

Configuring and maintaining the host: the managed containers, the console and agent keys, mail, intrusion prevention, PostgreSQL, and the whole server as one manifest.

ohm server agentimage - Verify or repin the host agent's own image (local only; run by the host's units).
ohm server agentkey - Show or rotate the bootstrap agent's credentials (local only).
ohm server alerts - Manage the alert rules, channels and delivery log.
ohm server alerts channels - List and manage the alert delivery channels.
ohm server alerts rules - List and manage the alert rules.
ohm server analytics - Manage the analytics service (Metabase) beside the shared PostgreSQL cluster.
ohm server apikey - Manage the console key the Web UI presents to the API.
ohm server certificate - Manage the management console's certificate.
ohm server config - Manage the Odoo server configuration.
ohm server config domain - Show, set or clear the provisioning domain unnamed instances are named under.
ohm server config proxy - Show, set, clear or test the outbound proxy the server reaches the Internet through.
ohm server database - Manage the Odoo server database.
ohm server fail2ban - Manage Fail2Ban for the Odoo server.
ohm server fail2ban config - Manage the Odoo server Fail2Ban configuration.
ohm server manifest - Export this server as a manifest, or apply one to it.
ohm server pgbouncer - Manage the connection pooler in front of the shared PostgreSQL cluster.
ohm server portainer - Install or remove Portainer, the optional Docker administration console.
ohm server postgres - Manage PostgreSQL for the Odoo server.
ohm server postgres image - Manage the PostgreSQL image.
ohm server postgres slow-queries - Show the slow statements PostgreSQL has executed.
ohm server replica - Manage the streaming read replica of the shared PostgreSQL cluster.
ohm server scaling - Manage the server's scaling policy.
ohm server turnstile - Show or change Cloudflare Turnstile on the console sign-in, and its emergency bypass.

ohm server agentimage upgrade

Verify the agent image the agent asked to be upgraded to, and repin the agent's unit on it (run by ohm-agent-upgrade.service).

Local only

This command has no remote form. Run it on the server itself.

Local only

$ sudo ohm server agentimage upgrade

ohm server agentimage verify

Check, offline, that the agent image the unit runs is one this host verified (run before every agent start).

Local only

This command has no remote form. Run it on the server itself.

Local only

$ sudo ohm server agentimage verify

ohm server agentkey rotate

Rotate the bootstrap agent's credentials and restart it (local only).

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--consumer`	No	Rotate the scoped key ohm-api presents, instead of the operator key.
`--both`	No	Rotate both credentials.
`--no-restart`	No	Write the new key(s) but leave the agent running the old one. It takes effect at the next restart; use this when something is mid-flight.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Local only

$ sudo ohm server agentkey rotate

ohm server agentkey show

Print the bootstrap agent's credentials from its environment file (local only).

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--quiet`	No	Print the operator key alone, with no labels - for piping into something.

Local only

$ sudo ohm server agentkey show

ohm server alerts channels add

Create an alert delivery channel.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`-k`, `--kind`	No	The channel kind: email, slack, discord or webhook.
`--url`	No	The webhook URL. Give it as a value, or pass --url alone to be prompted without echo.
`--secret`	No	The signing secret. Give it as a value, or pass --secret alone to be prompted without echo.
`--header`	No	An extra request header as Name=value. Repeat for more than one.
`--to`	No	An e-mail recipient. Repeat for more than one; none means the SMTP profile's own.
`--disabled`	No	Create it switched off.

Remote or local

$ ohm server alerts channels add

ohm server alerts channels list

List the alert delivery channels.

Remote or local

$ ohm server alerts channels list

ohm server alerts channels remove

Delete an alert delivery channel.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`-y`, `--yes`	No	Do not ask for confirmation.

Remote or local

$ ohm server alerts channels remove

ohm server alerts channels resume

Lift a paused channel's pause and drain the last hour of deliveries.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.

Remote or local

$ ohm server alerts channels resume

ohm server alerts channels test

Send one test message through a channel.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.

Remote or local

$ ohm server alerts channels test

ohm server alerts channels update

Update an alert delivery channel.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`--new-name`	No	A new name for the rule or channel.
`--url`	No	The webhook URL. Give it as a value, or pass --url alone to be prompted without echo.
`--clear-url`	No	Clear the stored webhook URL.
`--secret`	No	The signing secret. Give it as a value, or pass --secret alone to be prompted without echo.
`--clear-secret`	No	Clear the stored signing secret.
`--header`	No	An extra request header as Name=value. Repeat for more than one.
`--clear-headers`	No	Clear the stored extra headers.
`--to`	No	An e-mail recipient. Repeat for more than one; none means the SMTP profile's own.
`--enable`	No	Switch it on.
`--disable`	No	Switch it off.

Remote or local

$ ohm server alerts channels update

ohm server alerts deliveries

List the alert delivery log, or retry one delivery.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`--status`	No	Only deliveries with this status: queued, delivered, failed, paused or skipped.
`--take`	No	How many rows to return.
`--retry`	No	Queue this delivery for another attempt.

Remote or local

$ ohm server alerts deliveries

ohm server alerts events

List the alert events this server has published.

Option	Required	Description
`-t`, `--type`	No	An event type the rule selects. Repeat for more than one; none means every type.
`--severity`	No	Only events of this severity.
`--instance`	No	An instance the rule is narrowed to, by name or id. Repeat for more than one.
`--take`	No	How many rows to return.

Remote or local

$ ohm server alerts events

ohm server alerts rules add

Create an alert rule.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`-c`, `--channel`	No	A channel the rule delivers to, by name. Repeat for more than one.
`-t`, `--type`	No	An event type the rule selects. Repeat for more than one; none means every type.
`--min-severity`	No	The lowest severity delivered: info, warning or critical.
`--instance`	No	An instance the rule is narrowed to, by name or id. Repeat for more than one.
`--cooldown`	No	Minutes during which the same subject is not delivered again through this rule.
`--disabled`	No	Create it switched off.

Remote or local

$ ohm server alerts rules add

ohm server alerts rules defaults

Add the recommended alert rules, delivering to one channel.

Option	Required	Description
`-c`, `--channel`	No	A channel the rule delivers to, by name. Repeat for more than one.
`-y`, `--yes`	No	Do not ask for confirmation.

Remote or local

$ ohm server alerts rules defaults

ohm server alerts rules list

List the alert rules.

Remote or local

$ ohm server alerts rules list

ohm server alerts rules remove

Delete an alert rule.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`-y`, `--yes`	No	Do not ask for confirmation.

Remote or local

$ ohm server alerts rules remove

ohm server alerts rules update

Update an alert rule.

Option	Required	Description
`-n`, `--name`	No	The rule or channel name.
`--new-name`	No	A new name for the rule or channel.
`-c`, `--channel`	No	A channel the rule delivers to, by name. Repeat for more than one.
`-t`, `--type`	No	An event type the rule selects. Repeat for more than one; none means every type.
`--min-severity`	No	The lowest severity delivered: info, warning or critical.
`--instance`	No	An instance the rule is narrowed to, by name or id. Repeat for more than one.
`--cooldown`	No	Minutes during which the same subject is not delivered again through this rule.
`--enable`	No	Switch it on.
`--disable`	No	Switch it off.

Remote or local

$ ohm server alerts rules update

ohm server alerts types

List the event types this server can publish.

Remote or local

$ ohm server alerts types

ohm server analytics access

Show who can reach what in the analytics service.

Remote or local

$ ohm server analytics access

ohm server analytics install

Install or reconcile the analytics service.

Option	Required	Description
`--force`	No	Recreate the container even when nothing about it differs.

Remote or local

$ ohm server analytics install

ohm server analytics remove

Remove the analytics container; --purge-data drops its application database too.

Option	Required	Description
`--purge-data`	No	Also drop the service's application database: every question and dashboard anybody made in it.

Remote or local

$ ohm server analytics remove

ohm server analytics set

Change the server's analytics policy.

Option	Required	Description
`--enabled`	No	Install or remove the analytics service: on or off.
`--http-port`	No	The host port the service answers HTTP on. 1024 to 65535.
`--https-port`	No	The host port the service answers HTTPS on, with the management certificate. 1024 to 65535.
`--memory`	No	Memory ceiling of the container, e.g. 2GiB. At least 1.5GiB; never unlimited.
`--cpus`	No	CPUs the container may use. 0.25 to 256; 0 removes the ceiling.
`--ignore-memory-check`	No	Start the service even when the host is short of memory, with a warning in the logs instead of a refusal: on or off. If the host runs out, the kernel may stop Odoo or PostgreSQL.
`--rotate-admin-password`	No	Mint a fresh password for the plane's own administrator account in the service.

Remote or local

$ ohm server analytics set

ohm server analytics show

Show the server's analytics policy.

Remote or local

$ ohm server analytics show

ohm server analytics status

Show what the analytics service is doing.

Remote or local

$ ohm server analytics status

ohm server analytics sync

Make the analytics service match this server's instances and users.

Remote or local

$ ohm server analytics sync

ohm server apikey rotate

Rotate the console key and recreate the API and Web containers with it.

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server apikey rotate

ohm server audit

List the server's audit trail: who did what, when, from where.

Option	Required	Description
`--since`	No	How far back: a duration such as 24h, 7d or 30d, an ISO date, or 'all' for everything kept.
`--until`	No	The end of the window, as an ISO date; the present when omitted.
`--actor`	No	Only rows whose actor contains this text.
`--action`	No	Only these actions (repeatable). A value ending in '.' matches every action with that prefix, such as 'login.'.
`--outcome`	No	Only this outcome: Queued, Succeeded, Failed, Cancelled, Interrupted or Refused.
`--target`	No	Only rows whose target id equals, or whose target name contains, this text.
`--address`	No	Only rows whose address contains this text.
`--source`	No	Only this source: console, api, cli, cli-local, scheduler, watchdog or backfill.
`--take`	No	How many rows to list at most (1 to 500).
`--csv`	No	Write the rows as CSV to this file instead of showing a table.

Remote or local

$ ohm server audit

ohm server certificate custom

Upload a certificate and private key from files for the management console's Custom mode.

Option	Required	Description
`--certificate-file`	Yes	The PEM certificate, optionally followed by its intermediates.
`--key-file`	Yes	The PEM private key (PKCS#8 or PKCS#1, encrypted or not).
`--passphrase-file`	No	A file holding the passphrase of an encrypted private key. Used once and never stored.

Remote or local

$ ohm server certificate custom

ohm server config domain clear

Remove the provisioning domain; new instances without a name are named <id>.localhost.

Remote or local

$ ohm server config domain clear

ohm server config domain set

Set the provisioning domain; new instances without a name are named <id>.<domain>.

Argument	Required	Description
`<domain>`	Yes	The domain, for example customers.example.com ('*.customers.example.com' is accepted too). Point a wildcard DNS record for it at this server.

Remote or local

$ ohm server config domain set

ohm server config domain show

Show the provisioning domain and the name an instance created without one gets.

Remote or local

$ ohm server config domain show

ohm server config export

Export the Odoo server configuration to a transportable file.

Option	Required	Description
`-j`, `--json`	Yes	Odoo server JSON configuration file path.
`--overwrite`	No	Overwrite the output file when it already exists.

Remote or local

$ ohm server config export

ohm server config import

Import the Odoo server configuration.

Option	Required	Description
`--keep-guid`	No	Keep the server GUID from the imported configuration instead of regenerating it.
`-j`, `--json`	Yes	Odoo server JSON configuration file path.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server config import

ohm server config proxy clear

Remove the outbound proxy and its password; the server reaches the Internet directly again.

Remote or local

$ ohm server config proxy clear

ohm server config proxy set

Set the outbound proxy; what is not given is kept. Saved and applied at once.

Option	Required	Description
`--url`	No	The proxy's address with its port, for example http://proxy.example.com:3128 (https for a proxy that speaks TLS itself).
`--username`	No	The user name the proxy is signed in to with. --username "" removes it and the password.
`--password`	No	Ask for the proxy password at a masked prompt. A value on the command line is not accepted.
`--password-file`	No	Read the proxy password from a file (its first line).
`--password-stdin`	No	Read the proxy password from standard input (its first line).
`--no-proxy`	No	Host names, domains (.example.com), addresses and CIDR ranges that go out directly, comma separated. Loopback, the server's host name and its instances always do. --no-proxy "" empties the list.

Remote or local

$ ohm server config proxy set

ohm server config proxy show

Show the outbound proxy (never its password) and what always goes around it.

Remote or local

$ ohm server config proxy show

ohm server config proxy test

Test the outbound proxy and report whether it works and how long it took.

Option	Required	Description
`--url`	No	The proxy's address with its port, for example http://proxy.example.com:3128 (https for a proxy that speaks TLS itself).
`--username`	No	The user name the proxy is signed in to with. --username "" removes it and the password.
`--password`	No	Ask for the proxy password at a masked prompt. A value on the command line is not accepted.
`--password-file`	No	Read the proxy password from a file (its first line).
`--password-stdin`	No	Read the proxy password from standard input (its first line).

Remote or local

$ ohm server config proxy test

ohm server config rebuild

rebuilds an Odoo server configuration.

Remote or local

$ ohm server config rebuild

ohm server config validate-dns

Validate the Odoo instance DNS record(s).

Remote or local

$ ohm server config validate-dns

ohm server database list

List databases.

Local only

This command has no remote form. Run it on the server itself.

Local only

$ sudo ohm server database list

ohm server fail2ban ban

Manually ban an IP address on the Odoo server.

Argument	Required	Description
`<ip>`	Yes	The IPv4 or IPv6 address to ban.
`<jail>`	Yes	The fail2ban jail to ban the address in, for example 'ohm-login'.

Remote or local

$ ohm server fail2ban ban

ohm server fail2ban config install

Install the Odoo server Fail2Ban filter and jail configuration.

Remote or local

$ ohm server fail2ban config install

ohm server fail2ban config remove

Remove the Odoo server Fail2Ban filter and jail configuration.

Remote or local

$ ohm server fail2ban config remove

ohm server fail2ban install

Install the Fail2Ban service.

Remote or local

$ ohm server fail2ban install

ohm server fail2ban list

List the Odoo server ban(s).

Option	Required	Description
`-b`, `--ban`	No	Ban selector: IP address.
`-A`, `--all`	No	Lists every ban record, expired and active.

Remote or local

$ ohm server fail2ban list

ohm server fail2ban remove

Remove the Fail2Ban service.

Remote or local

$ ohm server fail2ban remove

ohm server fail2ban unban

Unban an IP address on the Odoo server.

Option	Required	Description
`-b`, `--ban`	No	Ban selector: IP address.
`-A`, `--all`	No	Lists every ban record, expired and active.

Remote or local

$ ohm server fail2ban unban

ohm server info

Show the Odoo server information (URLs, ports, credentials).

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--show-secrets`	No	Reveal secrets (passwords, tokens) instead of masking them.

Local only

$ sudo ohm server info

ohm server install

Install the Odoo server.

Option	Required	Description
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm server install

ohm server manifest apply

Apply a manifest file to this server.

Option	Required	Description
`-j`, `--json`	Yes	Odoo server JSON configuration file path.
`--admin-password`	No	The administrator's initial password when the manifest creates one; generated and shown once when omitted.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server manifest apply

ohm server manifest export

Export this server as a manifest file.

Option	Required	Description
`-j`, `--json`	Yes	Odoo server JSON configuration file path.
`--overwrite`	No	Overwrite the output file when it already exists.

Remote or local

$ ohm server manifest export

ohm server pgbouncer install

Install or reconcile the connection pooler.

Option	Required	Description
`--force`	No	Recreate the container even when nothing about it differs.

Remote or local

$ ohm server pgbouncer install

ohm server pgbouncer remove

Remove the connection pooler.

Option	Required	Description
`--drop-auth`	No	Also drop the pooler's auth role and lookup function from the cluster.

Remote or local

$ ohm server pgbouncer remove

ohm server pgbouncer status

Show what the connection pooler is doing.

Remote or local

$ ohm server pgbouncer status

ohm server pgbouncer sync

Re-plan the pools and reload the pooler's configuration.

Remote or local

$ ohm server pgbouncer sync

ohm server portainer install

Install Portainer on the server (asks first; Portainer controls the whole server).

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server portainer install

ohm server portainer remove

Remove Portainer from the server. Its data and admin password are kept.

Remote or local

$ ohm server portainer remove

ohm server postgres image build

Build the PostgreSQL image.

Option	Required	Description
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm server postgres image build

ohm server postgres image list

List PostgreSQL images.

Remote or local

$ ohm server postgres image list

ohm server postgres image remove

Remove unused PostgreSQL images.

Option	Required	Description
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm server postgres image remove

ohm server postgres reindex

Rebuild all indexes across all PostgreSQL databases (concurrently).

Option	Required	Description
`--jobs`	No	Number of parallel maintenance jobs (0 = auto).

Remote or local

$ ohm server postgres reindex

ohm server postgres shell

Open a shell to the PostgreSQL server.

Local only

This command has no remote form. Run it on the server itself.

Local only

$ sudo ohm server postgres shell

ohm server postgres slow-queries list

List the slow statements PostgreSQL has executed, the most expensive first.

Option	Required	Description
`--postgres`	No	The PostgreSQL server: 'ohm-postgres' for the managed container, or a profile name. Every server when omitted.
`--range`	No	The range: 'hour' (the last hour), 'day' (the last 24 hours) or 'reset' (since the counters were reset).
`--database`	No	Only statements against this database.
`--instance`	No	Only statements attributed to this instance (its 12-character id).
`--top`	No	How many statements to list at most, the most expensive first (1 to 500).
`--threshold`	No	The mean time (ms) from which a statement reads as slow: orange from it, red from twice it. 0 is the server's own threshold.
`--full`	No	Print the whole statement instead of its first 120 characters.

Remote or local

$ ohm server postgres slow-queries list

ohm server postgres slow-queries reset

Reset one PostgreSQL server's statement counters; the stored history stays.

Option	Required	Description
`--postgres`	No	The PostgreSQL server: 'ohm-postgres' for the managed container, or a profile name. Every server when omitted.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server postgres slow-queries reset

ohm server postgres slow-queries status

Show whether each PostgreSQL server collects statement statistics.

Option	Required	Description
`--postgres`	No	The PostgreSQL server: 'ohm-postgres' for the managed container, or a profile name. Every server when omitted.

Remote or local

$ ohm server postgres slow-queries status

ohm server postgres vacuum

Run VACUUM + ANALYZE across all PostgreSQL databases.

Option	Required	Description
`--jobs`	No	Number of parallel maintenance jobs (0 = auto).
`--full`	No	Run VACUUM FULL (rewrites tables; takes exclusive locks - use with care).

Remote or local

$ ohm server postgres vacuum

ohm server rename

Rename this server and request a certificate for the new name (local only).

Local only

This command has no remote form. Run it on the server itself.

Argument	Required	Description
`<name>`	Yes	The new name, fully qualified, for example console.example.com.

Option	Required	Description
`--no-certificate`	No	Do not request a certificate for the new name in the configured mode afterwards; the console is then served over the self-signed certificate until one is requested.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Local only

$ sudo ohm server rename

ohm server replica install

Install, reconcile or rebuild the read replica.

Option	Required	Description
`--rebuild`	No	Take a fresh base backup. The existing standby cluster is moved aside, never deleted.
`--force`	No	Recreate the container even when nothing about it differs.

Remote or local

$ ohm server replica install

ohm server replica promote

End recovery on the read replica, making it a primary of its own.

Option	Required	Description
`--confirm`	No	The word PROMOTE. After a promotion the standby is a primary of its own and the two clusters diverge for good.

Remote or local

$ ohm server replica promote

ohm server replica remove

Remove the read replica and its replication slot.

Option	Required	Description
`--purge-data`	No	Also delete the standby's data directory, which is a full copy of every database on this server.

Remote or local

$ ohm server replica remove

ohm server replica status

Show what the read replica is doing.

Remote or local

$ ohm server replica status

ohm server rollback

Go back to the release this server ran before its last update.

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server rollback

ohm server scaling set

Change the server's scaling policy.

Option	Required	Description
`--pgbouncer`	No	Install or remove the connection pooler: on or off.
`--pgbouncer-max-clients`	No	How many clients the pooler accepts at once. 100 to 20000.
`--postgres-cpus`	No	CPUs the shared PostgreSQL container may use. 0.25 to 256.
`--postgres-memory`	No	Memory ceiling of the shared PostgreSQL container, e.g. 4GiB. 'none' removes it.
`--replica`	No	Install or remove the read replica: on or off.
`--replica-port`	No	The loopback port the replica is published on. 1024 to 65535.
`--deploy-health-timeout`	No	Seconds a new container may take to turn healthy before a deploy rolls back.
`--deploy-drain`	No	Seconds the old container keeps serving after a deploy switches.
`--rotate-pgbouncer-password`	No	Mint a fresh auth password for the pooler even though one is stored.
`--rotate-replication-password`	No	Mint a fresh replication password even though one is stored.

Remote or local

$ ohm server scaling set

ohm server scaling show

Show the server's scaling policy.

Remote or local

$ ohm server scaling show

ohm server support-bundle

Collect a support bundle for a time window, and optionally download it.

Option	Required	Description
`--hours`	No	The window's length in hours, back from --to or from now (1 to 744). Default: 48.
`--from`	No	The window's start, as an ISO date and time (UTC unless it names a zone). Wins over --hours.
`--to`	No	The window's end, as an ISO date and time (UTC unless it names a zone). Default: now.
`--output`	No	Download the finished bundle to this file or directory. Without it, the bundle stays on the server's Support page.

Remote or local

$ ohm server support-bundle

ohm server turnstile clear

Remove both keys of Turnstile on the console sign-in, which switches it off.

Remote or local

$ ohm server turnstile clear

ohm server turnstile disable

Turn Turnstile on the console sign-in off and keep its keys (emergency bypass).

Remote or local

$ ohm server turnstile disable

ohm server turnstile enable

Turn Turnstile on the console sign-in back on after 'disable'.

Remote or local

$ ohm server turnstile enable

ohm server turnstile set

Set Turnstile's keys, its host name check, or whether refused challenges count as failed sign-ins.

Option	Required	Description
`--site-key`	No	Set the public Turnstile site key.
`--secret-key`	No	Set the Turnstile secret key, typed at a masked prompt. A value on the command line is refused.
`--secret-key-file`	No	Set the Turnstile secret key from a file (its first line).
`--secret-key-stdin`	No	Set the Turnstile secret key from standard input (its first line).
`--hostname`	No	Refuse a token solved on another host name than this one. --hostname "" removes the check.
`--count-failures`	No	Count a sign-in Turnstile refuses as a failed sign-in (the Sign-in rate limit and the audit trail), on or off. On is the default.

Remote or local

$ ohm server turnstile set

ohm server turnstile status

Show Turnstile on the console sign-in: keys (never the secret), host name check, bypass.

Remote or local

$ ohm server turnstile status

ohm server update

Check for newer Docker images for the Odoo server's managed containers.

Remote or local

$ ohm server update

ohm server upgrade

Upgrade the Odoo server: apply the newer Docker images.

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm server upgrade

ohm server uptime

Show every probed target's availability.

Option	Required	Description
`-p`, `--period`	No	The period: 24h, 7d, 30d, 90d or 1y.

Remote or local

$ ohm server uptime

Instances

Creating and running Odoo instances: their containers, images, certificates, access rules, Git-backed addons, databases and backups.

ohm instance access-control - Manage who may reach each path of the Odoo instance.
ohm instance backup-config - Manage the Odoo instance backup configuration.
ohm instance certificate - Manage the Odoo instance certificate(s).
ohm instance code-editor - The browser editor of an Odoo instance.
ohm instance config - Manage the Odoo instance configuration.
ohm instance container - Manage the container(s) of the Odoo instance.
ohm instance database - Manage the database(s) of the Odoo instance.
ohm instance database comment - Get or set the Odoo instance database comment.
ohm instance database sysadmin - Manage the Odoo instance database sysadmin(s).
ohm instance database user - Manage the Odoo instance database user(s).
ohm instance deploy - Roll an Odoo instance's container, or update its add-ons.
ohm instance image - Manage the Odoo instance image(s).
ohm instance modules - Manage the Odoo instance modules.
ohm instance modules auto-update - Follow the git remotes and update the modules by themselves.
ohm instance nginx - Manage Nginx for the Odoo instance.
ohm instance nginx config - Manage the Odoo instance Nginx configuration.
ohm instance odoo - Manage Odoo Community and Enterprise addon modules for the instance.
ohm instance pre-authentication - Manage the sign-in page in front of the Odoo instance.
ohm instance pre-authentication credential - Manage the credentials visitors sign in with.
ohm instance quota - Manage the container limits of an Odoo instance.
ohm instance repair - Repair an Odoo instance.
ohm instance restore-config - Manage the Odoo instance restore configuration.
ohm instance upgrade - Upgrade an Odoo instance's databases to a newer major version.

ohm instance access-control list

List the access rules of the Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance access-control list

ohm instance access-control remove

Remove one access rule of the Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--path`	Yes	The path whose rule is removed.

Remote or local

$ ohm instance access-control remove

ohm instance access-control set

Write one access rule of the Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--path`	Yes	The path the rule governs, as a prefix (/web/database).
`--policy`	No	Allow (everyone except) or Block (nobody except). Default Allow.
`--address`	No	An address or CIDR range to admit. Repeatable.
`--hostname`	No	A host name to admit, resolved and kept current. Repeatable.
`--country`	No	An ISO 3166-1 alpha-2 country code to admit. Repeatable.
`--continent`	No	A two-letter continent code to admit. Repeatable.
`--description`	No	What the rule is for.
`--enabled`	No	Whether the rule is in force. Default true.
`--on-block`	No	What a refused caller gets: NotFoundPage (default), MaintenancePage, Status, Redirect, CloseConnection.
`--status`	No	The status code for --on-block Status. 4xx or 5xx; 403 by default.
`--redirect`	No	Where --on-block Redirect sends a refused caller. An absolute URL.

Remote or local

$ ohm instance access-control set

ohm instance analytics

Show or change whether the instance's operators may write native SQL in analytics.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--native-sql`	No	Whether the instance's operators may write native SQL in the analytics console: on or off.

Remote or local

$ ohm instance analytics

ohm instance backup

Backup an Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--backup-format`	No	Backup format.
`--backup-provider`	No	Backup provider(s). Omit to use every configured provider.
`--backup-destination`	No	Backup destination.

Remote or local

$ ohm instance backup

ohm instance backup-config set

Set the Odoo instance backup mode and storage providers.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--mode`	No	Mode: Disabled, Manual or Automatic. Omit to keep the current mode.
`--provider`	No	Provider type to add or update: Lfs, Ftp, S3 or AzureBlob - and, on restore-config, Instance (another instance to restore from).
`--name`	No	Name of the provider entry to add or update (required with --provider).
`--enable`	No	Enable the provider entry.
`--disable`	No	Disable the provider entry.
`--remote-path`	No	Remote path (Lfs, Ftp).
`--hostname`	No	FTP host name.
`--port`	No	FTP port.
`--username`	No	FTP user name.
`--password`	No	FTP password. Omit to be prompted (or to keep the stored one with --no-prompt); pass an empty string to clear it.
`--encryption`	No	FTP encryption mode: None, Implicit, Explicit or Auto.
`--bucket`	No	S3 bucket name.
`--access-key`	No	S3 access key id, or the Azure storage key/SAS token (the Azure value is a secret).
`--secret-key`	No	S3 secret key. Omit to be prompted (or to keep the stored one with --no-prompt); pass an empty string to clear it.
`--region`	No	S3 region.
`--service-url`	No	S3 endpoint for S3-compatible storage (e.g. MinIO), or the Azure service URI.
`--storage-account`	No	Azure storage account name.
`--container`	No	Azure blob container.
`--prefix`	No	Object prefix (S3, AzureBlob).
`--no-prompt`	No	Never prompt for a secret; leave the stored one unchanged.
`--remove-policy`	No	Remove the backup policy with this set id from its backup target. Its recovery points stay on the target unless --delete-data is given.
`--delete-data`	No	With --remove-policy: also delete the policy's recovery points from the target, once the change is saved. Administrator only; cannot be undone.
`--lift-retention`	No	With --delete-data: lift an Unlocked (Azure Blob) or Governance (S3) retention to delete the copies it still holds. A Locked or Compliance retention is never lifted.

Remote or local

$ ohm instance backup-config set

ohm instance backup-config show

Show the Odoo instance backup configuration.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance backup-config show

ohm instance certificate list

List the Odoo instance certificates.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance certificate list

ohm instance certificate renew

Renew the Odoo instance certificate when it is missing, invalid, or nearing expiry.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm instance certificate renew

ohm instance certificate request

Request the Odoo instance certificate.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm instance certificate request

ohm instance code-editor prepare

Prepare the browser editor of an Odoo instance ahead of its first opening, so that opening does not wait for the install.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance code-editor prepare

ohm instance config export

Export the Odoo instance(s) configuration.

Option	Required	Description
`-e`, `--export-path`	Yes	Directory on the machine running the command to write the exported files to.
`--skip-existing-files`	No	Skip existing files.

Remote or local

$ ohm instance config export

ohm instance config import

Import an Odoo instance from a configuration file.

Option	Required	Description
`-j`, `--json`	Yes	Path of the Odoo instance JSON configuration file on the machine running the command.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).
`--keep-guid`	No	Keep the instance GUID from the imported configuration instead of regenerating it.
`--git-auto-update`	No	Switch on automatic git updates for a Test or Staging preset (off by default).

Remote or local

$ ohm instance config import

ohm instance config preset

Manage the Odoo instance configuration presets.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).
`--no-git-auto-update`	No	Apply a Test or Staging preset with automatic git updates left off, without asking.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm instance config preset

ohm instance config rebuild

Rebuild an Odoo instance configuration.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance config rebuild

ohm instance config validate-dns

Validate the Odoo instance DNS record(s).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance config validate-dns

ohm instance container restart

Restart the Odoo container.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance container restart

ohm instance container shell

Open an interactive shell session inside the Odoo container.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Local only

$ sudo ohm instance container shell

ohm instance container start

Start the Odoo container.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance container start

ohm instance container stop

Stop the Odoo container.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance container stop

ohm instance create

Create an Odoo instance: its certificate, and a database created and activated once it is installed.

Option	Required	Description
`--fqdn`	No	The instance's FQDN(s); the first is the main one. Repeat it or separate several with commas. Left out, the instance gets a generated name.
`--odoo-version`	No	The Odoo version, e.g. 19.0. Left out, the server's default.
`--edition`	No	Community (default) or Enterprise.
`--role`	No	The Role. Left out: Production on a server, Development on a developer workstation.
`--classification`	No	The classification.
`--description`	No	The description.
`--certificate`	No	SelfSigned or LetsEncrypt. Left out, it follows the Role: Let's Encrypt for Production, Self-signed otherwise.
`--staging`	No	Request the certificate from Let's Encrypt's staging environment.
`--github-token-file`	No	A file whose first line is the builtin provider's GitHub token, which an Enterprise instance needs.
`--github-token-prompt`	No	Ask for the GitHub token at a masked prompt.
`--no-install`	No	Create the configuration only; implies --no-database.
`--no-start`	No	Do not start the container after the installation.
`--no-database`	No	Create no database.
`--database-name`	No	The database's name. Left out, derived from the instance.
`--admin-login`	No	The database administrator's login (default: admin).
`--admin-password-file`	No	A file whose first line is the database administrator's password.
`--admin-password-prompt`	No	Ask for the database administrator's password at a masked prompt. Without this or --admin-password-file a password is generated and printed once.
`--country`	No	The two-letter ISO country the database is set up for (company, currency, time zone), e.g. BE.
`--demo-data`	No	Load Odoo's demonstration data into the database.

Remote or local

$ ohm instance create

ohm instance database activate

Activate an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database activate

ohm instance database backup

Backup an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--backup-format`	No	Database backup format.
`--backup-destination`	No	Backup destination.
`-o`, `--overwrite`	No	Overwrite the destination if it already exists.

Remote or local

$ ohm instance database backup

ohm instance database cloc

Count the lines of code for the installed Odoo instance database addons.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database cloc

ohm instance database clone

Clone an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-n`, `--name`	No	Odoo database name.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).
`--neutralize`	No	Neutralize the Odoo instance database.
`--activate`	No	Activate the Odoo instance database.
`--keep-as-is`	No	Leave the database exactly as it arrives: apply no database options (and do not neutralize a clone). Its mail servers, scheduled actions and integrations stay live. Refused on a developer workstation.

Remote or local

$ ohm instance database clone

ohm instance database comment get

Get the Odoo instance database comment.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database comment get

ohm instance database comment set

Set the Odoo instance database comment.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--schema-version`	No	Schema version for the database comment.
`--customer`	No	Customer or tenant identifier.
`--restored-from-instance`	No	Source Odoo instance identifier.
`--restored-from-name`	No	Source database name at the origin instance.
`--restored-datetime-utc`	No	Restore UTC timestamp (ISO-8601).
`--active`	No	Mark the database as active.
`--clear`	No	Clear the database comment instead of setting it.

Remote or local

$ ohm instance database comment set

ohm instance database create

Create an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-n`, `--name`	No	Odoo database name.
`--no-init`	No	Do not initialize the Odoo database.
`--demo-data`	No	Load Odoo's demonstration data into the new database.
`-c`, `--country`	Yes	Two-letter ISO country code used to initialize the Odoo database (e.g. BE, NL, FR).
`--location`	No	Odoo instance database filestore location.
`--activate`	No	Activate the Odoo instance database.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).

Remote or local

$ ohm instance database create

ohm instance database dump

Dump an Odoo instance database to a file using the custom format.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--backup-destination`	Yes	Backup destination.
`-o`, `--overwrite`	No	Overwrite the destination if it already exists.

Remote or local

$ ohm instance database dump

ohm instance database init

Initialize an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-c`, `--country`	Yes	Two-letter ISO country code used to initialize the Odoo database (e.g. BE, NL, FR).
`--activate`	No	Activate the Odoo instance database.

Remote or local

$ ohm instance database init

ohm instance database list

List the Odoo instance database(s).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database list

ohm instance database load

Load an Odoo instance database from a custom dump format.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-a`, `--archive`	Yes	Archive to restore the database from (e.g. /backups/ohm-2025-10-28.zip).
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).
`--keep-as-is`	No	Leave the database exactly as it arrives: apply no database options (and do not neutralize a clone). Its mail servers, scheduled actions and integrations stay live. Refused on a developer workstation.

Remote or local

$ ohm instance database load

ohm instance database migrate-filestore

Migrate an Odoo instance database filestore.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.
`--location`	Yes	Odoo instance database filestore location.
`-b`, `--batch-size`	No	Number of records processed in each migration batch.

Remote or local

$ ohm instance database migrate-filestore

ohm instance database modules

Manage the Odoo instance database modules.

Argument	Required	Description
`<ModuleAction>`	Yes	Odoo instance database module action.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-m`, `--modules`	No	Odoo instance database modules (comma- or semicolon-separated).

Remote or local

$ ohm instance database modules

ohm instance database options

Process the Odoo instance database restore options.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).

Remote or local

$ ohm instance database options

ohm instance database pgbouncer

Route an instance through the connection pooler, or back to the cluster.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--via-pgbouncer`	Yes	Route this instance through the pooler: on or off.

Remote or local

$ ohm instance database pgbouncer

ohm instance database postgres

Launch the Odoo instance database PostgreSQL shell.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Local only

$ sudo ohm instance database postgres

ohm instance database recaptcha

Enable or disable the Odoo instance database reCAPTCHA, and restart the instance so it takes effect.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--enable`	Yes	Enable or disable.
`--restart`	No	Restart the instance after the change, when it is running, without asking.
`--no-restart`	No	Do not restart the instance; the change takes effect at its next restart.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm instance database recaptcha

ohm instance database reindex

Rebuild all indexes on a specific Odoo instance database (concurrently).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--jobs`	No	Number of parallel maintenance jobs (0 = auto).

Remote or local

$ ohm instance database reindex

ohm instance database remove

Remove an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database remove

ohm instance database rename

Rename an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-n`, `--name`	No	Odoo database name.

Remote or local

$ ohm instance database rename

ohm instance database reset-permissions

Repair the Odoo instance database permissions.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database reset-permissions

ohm instance database restore

Restore an Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-a`, `--archive`	Yes	Archive to restore the database from (e.g. /backups/ohm-2025-10-28.zip).
`-n`, `--name`	No	Odoo database name, or leave empty to use the name from the archive.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).
`-o`, `--overwrite`	No	Overwrite the destination if it already exists.
`--restore-filestore`	No	Restore the Odoo filestore from the archive.
`--keep-guid`	No	Keep the Odoo database UUID from the backup instead of regenerating it.
`--keep-as-is`	No	Leave the database exactly as it arrives: apply no database options (and do not neutralize a clone). Its mail servers, scheduled actions and integrations stay live. Refused on a developer workstation.

Remote or local

$ ohm instance database restore

ohm instance database shell

Launch the Odoo instance database shell.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--limit-request`	No	Number of requests a worker will process before being recycled and restarted.
`--limit-memory-soft`	No	Maximum allowed virtual memory per worker in bytes. If the limit is exceeded, the worker is killed and recycled at the end of the current request.
`--limit-memory-hard`	No	Hard limit on virtual memory in bytes. Any worker exceeding the limit will be immediately killed without waiting for the end of the current request processing.
`--limit-time-cpu`	No	Number of CPU seconds the worker is allowed to use for each request.
`--limit-time-real`	No	Number of seconds the worker can process a request.

Local only

$ sudo ohm instance database shell

ohm instance database size

Show the size of an Odoo instance database (PostgreSQL + filestore).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database size

ohm instance database sysadmin create

Create an Odoo instance database sysadmin.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database sysadmin create

ohm instance database sysadmin remove

Remove an Odoo instance database sysadmin.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.

Remote or local

$ ohm instance database sysadmin remove

ohm instance database turnstile

Show or change the Odoo instance database's Cloudflare Turnstile settings, including the portal bypass.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--status`	No	Show the sign-in protection of the database and change nothing (the default without a change option).
`--bypass`	No	Switch the portal bypass on or off: on lets the portal sign-in skip the Turnstile check.
`--site-key`	No	Set the public Turnstile site key.
`--secret-key`	No	Set the Turnstile secret key, typed at a masked prompt. A value on the command line is refused.
`--secret-key-file`	No	Set the Turnstile secret key from a file (its first line).
`--secret-key-stdin`	No	Set the Turnstile secret key from standard input (its first line).
`--clear-keys`	No	Remove both active Turnstile keys. Keys an environment preset has parked are left to the preset.
`--count-failures`	No	Count failed Turnstile checks as failed sign-ins, on or off. On is the default.
`--restart`	No	Restart the instance after the change, when it is running, without asking.
`--no-restart`	No	Do not restart the instance; the change takes effect at its next restart.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm instance database turnstile

ohm instance database user list

List Odoo instance database users.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-u`, `--user`	No	Odoo instance database user selector: model id, login, name, or email.

Remote or local

$ ohm instance database user list

ohm instance database user password-reset

Reset an Odoo instance database user password.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-u`, `--user`	No	Odoo instance database user selector: model id, login, name, or email.

Remote or local

$ ohm instance database user password-reset

ohm instance database user totp-disable

Disable an Odoo instance database user's TOTP (multi-factor authentication).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-u`, `--user`	No	Odoo instance database user selector: model id, login, name, or email.

Remote or local

$ ohm instance database user totp-disable

ohm instance database user totp-reset

Reset an Odoo instance database user's TOTP (multi-factor authentication).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-u`, `--user`	No	Odoo instance database user selector: model id, login, name, or email.

Remote or local

$ ohm instance database user totp-reset

ohm instance database user totp-token

Generate the current TOTP token for an Odoo instance database user. Remotely it needs an Administrator or a read-write API key, and every read is recorded in the audit trail.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`-u`, `--user`	No	Odoo instance database user selector: model id, login, name, or email.

Remote or local

$ ohm instance database user totp-token

ohm instance database vacuum

Run VACUUM + ANALYZE on a specific Odoo instance database.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-d`, `--database`	No	Odoo instance database name.
`--jobs`	No	Number of parallel maintenance jobs (0 = auto).
`--full`	No	Run VACUUM FULL (rewrites tables; takes exclusive locks - use with care).

Remote or local

$ ohm instance database vacuum

ohm instance deploy modules

Update the instance's add-ons behind a maintenance page.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--modules`	No	The modules to update. Omitted, every module the instance carries is.
`--latest`	No	Fetch the newest commit of each repository before updating.
`--no-backup`	No	Skip the safety dump taken before the update. Not advised.
`--rebuild-image`	No	Rebuild the image even when it carries every package the add-ons need.

Remote or local

$ ohm instance deploy modules

ohm instance deploy recover

Finish or undo a deploy that was interrupted.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance deploy recover

ohm instance deploy run

Roll the instance's container without taking it offline.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--reason`	No	Why: recreate (the same image), image-refresh (a new tag) or config-apply (put the stored configuration on a new container).
`--image-tag`	No	The image tag to roll onto (image-refresh). It must already be built.
`--force`	No	Roll even when nothing differs, which is a repair.

Remote or local

$ ohm instance deploy run

ohm instance deploy status

Show the deploy in flight or interrupted on an Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance deploy status

ohm instance drift

Show what still differs from the running Odoo instance(s) and why; --apply retries the apply.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--apply`	No	Retry the apply for every instance that drifts, and follow the jobs.
`--force`	No	With --apply: apply the selected instances in full, rewriting their configuration file and restarting them, even when nothing drifts.

Remote or local

$ ohm instance drift

ohm instance health

Show the health report of the Odoo instance(s); --check runs the checks, --repair the auto repair.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--check`	No	Run the health checks now and wait for the report, instead of showing the stored one.
`--repair`	No	Run the auto repair of every repairable finding, which checks again afterwards, and wait.

Remote or local

$ ohm instance health

ohm instance image activate

Activate an Odoo instance image.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-t`, `--image-tag`	No	Odoo Docker image tag to use.

Remote or local

$ ohm instance image activate

ohm instance image build

Build an Odoo instance image without activating it.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.
`-t`, `--image-tag`	No	Odoo Docker image tag to use.
`--image-source`	No	Where the base image comes from: Prebuilt (Odoo's image from Docker Hub, the default) or Built (built on this server from Odoo's recipe). Kept for every later rebuild.
`--odoo-release`	No	Odoo nightly build of the instance's own version the image carries (yyyyMMdd): for Prebuilt, the image version, Docker Hub's image of that build (only builds Docker Hub publishes); for Built, the build Odoo's recipe installs on this server. 'default' is Docker Hub's latest image of the version (Prebuilt) or the newest (Built). Kept for every later rebuild.
`--prebuilt-odoo-release`	No	For Prebuilt: the Odoo nightly build of the instance's own version (yyyyMMdd) installed into the Docker Hub image during its build, which makes the build several minutes longer; 'default' runs the image's own build. --odoo-release then picks the Docker Hub image (the image version). Kept for every later rebuild.
`--apt`	No	An extra APT package for the image, as APT names it. Repeat it for several; the list replaces the instance's, and the option with no value clears it.
`--pip`	No	An extra Python package for the image, optionally with a version. Repeat it for several; the list replaces the instance's, and the option with no value clears it.

Remote or local

$ ohm instance image build

ohm instance image list

List Odoo instance images.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-l`, `--limit`	No	Maximum number of results to return.

Remote or local

$ ohm instance image list

ohm instance image remove

Remove an Odoo instance image.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm instance image remove

ohm instance import

Import the Odoo instance from a backup archive.

Option	Required	Description
`-a`, `--archive`	No	Odoo instance backup archive.
`-p`, `--preset`	Yes	Odoo instance environment preset (dev, test, staging, dr, prod).
`--fqdn`	No	One or more Fully Qualified Domain Names (FQDNs) for the Odoo instance. The first FQDN serves as the primary or master domain for the Odoo instance.
`-g`, `--github-token`	No	GitHub access token.
`--git-auto-update`	No	Switch on automatic git updates for a Test or Staging preset (off by default).
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm instance import

ohm instance info

Show the Odoo instance information (URLs, paths, credentials).

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--show-secrets`	No	Reveal secrets (passwords, tokens) instead of masking them.

Local only

$ sudo ohm instance info

ohm instance install

Install an Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.
`-t`, `--image-tag`	No	Odoo Docker image tag to use.

Remote or local

$ ohm instance install

ohm instance list

List configured Odoo instance(s).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance list

ohm instance modules auto-update run

Move the pins and update the modules now.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-m`, `--modules`	No	Odoo instance modules (comma- or semicolon-separated).
`--commit`	No	The commit to move to; without it the remote is asked for the branch head.

Remote or local

$ ohm instance modules auto-update run

ohm instance modules auto-update set

Turn the automatic git update on or off, for the instance or for one module.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--enabled`	No	Whether a moved branch head updates this instance unattended.
`--module`	No	Set this one module's own answer instead of the instance-wide switch.
`--clear`	No	With --module, drop that module's own answer so it follows the instance.

Remote or local

$ ohm instance modules auto-update set

ohm instance modules auto-update show

Show the automatic git update switch and what the poll has seen.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance modules auto-update show

ohm instance modules install

Install selected Odoo instance modules.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-m`, `--modules`	No	Odoo instance modules (comma- or semicolon-separated).
`--latest`	No	Update to the latest module versions.
`--discard-changes`	No	Overwrite module checkouts that hold uncommitted or unpushed work, on a workstation or a development instance. Local runs only.

Remote or local

$ ohm instance modules install

ohm instance modules select

Select available Odoo instance modules for installation.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance modules select

ohm instance nginx config rebuild

Rebuild an Odoo instance Nginx configuration and reload Nginx.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance nginx config rebuild

ohm instance nginx install

Install the Odoo instance Nginx configuration.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.

Remote or local

$ ohm instance nginx install

ohm instance odoo install

Install or update Odoo Community and Enterprise addon modules for the instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.
`--latest`	No	Update to the latest module versions.

Remote or local

$ ohm instance odoo install

ohm instance pre-authentication credential add

Add a credential visitors sign in with.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--user-name`	No	The user name; generated when left out.
`--ask-password`	No	Type the password at a prompt instead of having one generated.
`--description`	No	Who or what the credential is for.
`--expires`	No	When the credential stops working (UTC, e.g. 2026-12-31T23:59).

Remote or local

$ ohm instance pre-authentication credential add

ohm instance pre-authentication credential password

Give a credential a new password.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--user-name`	Yes	The credential's user name.
`--ask-password`	No	Type the new password at a prompt instead of having one generated.

Remote or local

$ ohm instance pre-authentication credential password

ohm instance pre-authentication credential remove

Delete a credential visitors sign in with.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--user-name`	Yes	The credential's user name.
`--yes`	No	Do not ask for confirmation.

Remote or local

$ ohm instance pre-authentication credential remove

ohm instance pre-authentication credential update

Change a credential's description, expiry or switch.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--user-name`	Yes	The credential's user name.
`--description`	No	Who or what the credential is for.
`--expires`	No	When the credential stops working (UTC).
`--no-expiry`	No	Let the credential work until it is changed.
`--enabled`	No	Whether the credential may sign in.

Remote or local

$ ohm instance pre-authentication credential update

ohm instance pre-authentication disable

Stop asking visitors of the Odoo instance to sign in.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance pre-authentication disable

ohm instance pre-authentication enable

Ask visitors of the Odoo instance to sign in first.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance pre-authentication enable

ohm instance pre-authentication set

Change the pre-authentication settings of the Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--enabled`	No	Whether visitors are asked to sign in.
`--session-hours`	No	How long a sign-in lasts, in hours (1 to 720).
`--exempt-path`	No	A path reached without signing in (/payment/, /web/health). Repeatable; replaces the list.
`--exempt-address`	No	An address or CIDR range never asked to sign in. Repeatable; replaces the list.
`--exempt-hostname`	No	A host name whose current addresses are never asked to sign in; re-resolved continuously. Repeatable; replaces the list.
`--exempt-country`	No	A country (ISO 3166 code, such as BE) whose visitors are never asked to sign in, as GeoIP places them. Repeatable; replaces the list.
`--exempt-continent`	No	A continent (AF, AN, AS, EU, NA, OC, SA) whose visitors are never asked to sign in. Repeatable; replaces the list.
`--clear-exempt-paths`	No	Remove every exempt path.
`--clear-exempt-addresses`	No	Remove every exempt address.
`--clear-exempt-hostnames`	No	Remove every exempt host name.
`--clear-exempt-locations`	No	Remove every exempt country and continent.

Remote or local

$ ohm instance pre-authentication set

ohm instance pre-authentication show

Show the pre-authentication of the Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance pre-authentication show

ohm instance quota set

Set the container limits of an Odoo instance, and its Auto tuning's overrides.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--mode`	No	Mode: auto (derive from the tuning), manual (the values below) or off (no limits).
`--cpus`	No	CPUs the container may use (manual mode). 0.25 to 256.
`--memory`	No	Memory ceiling (manual mode), e.g. 4GiB. At least 512MiB.
`--pids`	No	Tasks ceiling (manual mode). At least 128.
`--storage-threshold`	No	Storage above which the disk-usage job reports the instance, e.g. 20GiB. 'none' removes it. Not a cap.
`--override-workers`	No	Workers to use instead of the Auto value. 0 uses the calculated value.
`--override-limit-request`	No	Limit requests to use instead of the Auto value. 0 uses the calculated value.
`--override-limit-cpu`	No	Limit CPU time, in seconds, to use instead of the Auto value. 0 uses the calculated value.
`--override-limit-real`	No	Limit real time, in seconds, to use instead of the Auto value. 0 uses the calculated value.
`--override-memory-soft`	No	Memory soft limit to use instead of the Auto value, e.g. 1GiB. 0 uses the calculated value.
`--override-memory-hard`	No	Memory hard limit to use instead of the Auto value, e.g. 2GiB. 0 uses the calculated value.
`--override-connections`	No	Max DB connections to use instead of the Auto value. 0 uses the calculated value.

Remote or local

$ ohm instance quota set

ohm instance quota show

Show the container limits of an Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance quota show

ohm instance remove

Remove an Odoo instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--keep-config`	No	Keep the instance configuration file and its backups. By default they are deleted with the instance.
`--delete-config`	No	No longer needed: the configuration is deleted by default. Accepted for one release; it does nothing.
`--confirm`	No	The instance's exact name, which confirms the removal without a prompt; needed when there is no terminal. A name that does not match refuses the removal.

Remote or local

$ ohm instance remove

ohm instance repair filesystem

Repair Odoo instance filesystem permissions.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance repair filesystem

ohm instance restore

Restore the Odoo instance from a backup archive, or from another instance.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-f`, `--force`	No	Force the command to execute, ignoring errors or conflicts.
`-a`, `--archive`	No	Odoo instance backup archive.
`--from-instance`	No	Restore from another instance, by its id, instead of from an archive. The source is not stopped or changed; this instance keeps its identity and takes the source's data, version, edition, git setup and modules.
`--from-server`	No	With --from-instance: the environment registered on this instance's server that the source is on. Needs the management API (--server); a local run restores only from this server.
`--database-filter`	No	Which of the source's databases to restore, as a regular expression (default: all).
`--copy-from`	No	FreshBackup (default) or LatestLocalBackup; the latest local backup is only for a source on this server.
`--max-age-days`	No	With the latest local backup: the oldest it may be, in whole days (default: any age).
`--fallback`	No	With the latest local backup, when none is recent enough: FreshBackup (take a fresh backup, the default) or Fail (fail without touching the instance).
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm instance restore

ohm instance restore-config set

Set the Odoo instance restore mode, storage providers and Instance sources.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--mode`	No	Mode: Disabled, Manual or Automatic. Omit to keep the current mode.
`--provider`	No	Provider type to add or update: Lfs, Ftp, S3 or AzureBlob - and, on restore-config, Instance (another instance to restore from).
`--name`	No	Name of the provider entry to add or update (required with --provider).
`--enable`	No	Enable the provider entry.
`--disable`	No	Disable the provider entry.
`--remote-path`	No	Remote path (Lfs, Ftp).
`--hostname`	No	FTP host name.
`--port`	No	FTP port.
`--username`	No	FTP user name.
`--password`	No	FTP password. Omit to be prompted (or to keep the stored one with --no-prompt); pass an empty string to clear it.
`--encryption`	No	FTP encryption mode: None, Implicit, Explicit or Auto.
`--bucket`	No	S3 bucket name.
`--access-key`	No	S3 access key id, or the Azure storage key/SAS token (the Azure value is a secret).
`--secret-key`	No	S3 secret key. Omit to be prompted (or to keep the stored one with --no-prompt); pass an empty string to clear it.
`--region`	No	S3 region.
`--service-url`	No	S3 endpoint for S3-compatible storage (e.g. MinIO), or the Azure service URI.
`--storage-account`	No	Azure storage account name.
`--container`	No	Azure blob container.
`--prefix`	No	Object prefix (S3, AzureBlob).
`--no-prompt`	No	Never prompt for a secret; leave the stored one unchanged.
`--source-instance`	No	Instance source: the id of the instance to restore from.
`--source-server`	No	Instance source: the environment registered on this instance's server that the source is on ('this' for this server, the default). Needs the management API (--server).
`--database-filter`	No	Which of the source's databases to restore, as a regular expression (default: all).
`--copy-from`	No	FreshBackup (default) or LatestLocalBackup; the latest local backup is only for a source on this server.
`--max-age-days`	No	With the latest local backup: the oldest it may be, in whole days (default: any age).
`--fallback`	No	With the latest local backup, when none is recent enough: FreshBackup (take a fresh backup, the default) or Fail (fail without touching the instance).
`--remove`	No	Instance source: remove the entry named by --name.

Remote or local

$ ohm instance restore-config set

ohm instance restore-config show

Show the Odoo instance restore configuration.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance restore-config show

ohm instance size

Show the aggregate size of an Odoo instance (databases + directory tree).

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance size

ohm instance upgrade prepare

Create a prepared instance at a newer Odoo version, linked to this one.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--target`	Yes	The Odoo version to move to, for example 18.0.
`--preset`	No	What the rehearsals' databases are: Test (the default) or Staging.
`--fqdn`	No	The names the prepared instance answers; none gives it a generated one.

Remote or local

$ ohm instance upgrade prepare

ohm instance upgrade production

Upgrade production, once a full rehearsal stands for it. This takes it offline.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--mode`	No	How production moves: Promote (the default) or InPlace.
`--confirm-odoo-transfer`	No	Confirm that an Enterprise database is sent to Odoo S.A. Asked once per upgrade.

Remote or local

$ ohm instance upgrade production

ohm instance upgrade rehearse

Rehearse the upgrade on a fresh copy of production; production is never touched.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`--copy-from`	No	Where the copy comes from: FreshBackup (the default) or LatestLocalBackup. A production on another server always gives a fresh copy.
`--max-age-days`	No	The oldest a local backup may be, in days. Without it any age is taken. A production on another server always gives a fresh copy.
`--confirm-odoo-transfer`	No	Confirm that an Enterprise database is sent to Odoo S.A. Asked once per upgrade.

Remote or local

$ ohm instance upgrade rehearse

ohm instance upgrade rerun

Run the custom modules again on the stored dump; this is no full rehearsal.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance upgrade rerun

ohm instance upgrade rollback

Take a production upgrade back. What was written since is not carried over.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance upgrade rollback

ohm instance upgrade status

Show an instance's upgrade plan, its runs and whether production can move.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.

Remote or local

$ ohm instance upgrade status

ohm instance uptime

Show this instance's availability as probed through nginx.

Option	Required	Description
`-i`, `--instance`	No	Odoo instance selector: id, name, HTTP port, or description.
`-p`, `--period`	No	The period: 24h, 7d, 30d, 90d or 1y.

Remote or local

$ ohm instance uptime

Backup archives

Working with a backup archive as a file, on any computer and without a server: decrypting an encrypted backup with its key file.

ohm backup decrypt

Decrypt an encrypted backup archive (.zip.age) with its key file into the plain zip. Works offline.

Local only

This command has no remote form. Run it on the server itself.

Argument	Required	Description
`<archive>`	Yes	The encrypted backup archive, for example instance-backup-acme-20261011-020000.zip.age.

Option	Required	Description
`--key`, `-k`	Yes	The key file: the server's backup key or the instance key, as downloaded from the console (AGE-SECRET-KEY-1...).
`--output`, `-o`	No	Where to write the plain zip. Defaults to the archive's name without '.age', beside it.
`--force`	No	Overwrite the output file when it exists.

Local only

$ ohm backup decrypt

Developer workstation

A workstation installed with 'ohm install --workstation' pulls one customer instance at a time down as a local working copy. A profile binds the two; the customer's own git and backup credentials never travel with it.

ohm dev repo - Repositories for this profile's add-ons.

ohm dev add

Create a developer profile for one customer instance.

Option	Required	Description
`-n`, `--name`	No	The profile name.
`-e`, `--environment`	No	The registered environment to pull from, by name or id.
`-i`, `--instance`	No	The customer instance to copy, by id or host name.
`--git-token`	No	Your own git token for the add-on repositories. Prompted for when absent.
`--no-git-token`	No	Create the profile without a git token; a pull then refuses until one is set.
`--git-provider`	No	The git provider the token belongs to (default: builtin).
`--debug`	No	Run this profile under debugpy (the same as --debug-mode Debug).
`--debug-mode`	No	Normal, Debug or DebugReload.
`--ide`	No	vscode or pycharm.
`--expires`	No	Days until the profile expires (default 30).
`--no-expiry`	No	The profile never expires: the customer's data stays here indefinitely.
`--no-purge`	No	Report the expiry rather than purging the profile on it.
`--allow-restricted`	No	Allow a Restricted customer instance to be pulled onto this machine.
`--notes`	No	Free text kept on the profile.
`--pull`	No	Pull the profile as soon as it is created.

Remote or local

$ ohm dev add

ohm dev connect

Option	Required	Description
`-n`, `--name`	No	The profile name.
`-u`, `--url`	No	The customer server's management API address, e.g. https://host:5312.
`-k`, `--key`	No	The customer server's OPERATOR API key. Prompted for when absent.
`--group`	No	The group to file the environment under.
`--trust-certificate`	No	The SHA-256 fingerprint of the server's certificate, when it is self-signed.

Remote or local

$ ohm dev connect

ohm dev list

List the developer profiles on this workstation.

Option	Required	Description
`--json`	No	Write the answer as JSON.

Remote or local

$ ohm dev list

ohm dev open

Open the editor on this profile's container.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`--ide`	No	vscode or pycharm.
`--print`	No	Print the launch command and the files instead of starting the editor.

Remote or local

$ ohm dev open

ohm dev publish

Publish the local module pins back to the customer instance.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`-m`, `--module`	No	A module to publish; repeat for several. Omitted publishes every changed one.
`--install`	No	Queue a module install on the customer instance after publishing.
`--dry-run`	No	Report what would be published and call nothing.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm dev publish

ohm dev pull

Pull the customer instance onto this workstation.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`--backup`	No	latest (default), fresh, or the path of an archive on the source.
`--discard-changes`	No	Overwrite local checkouts that hold uncommitted or unpushed work.
`--allow-older-postgres`	No	Pull even though this workstation runs an older PostgreSQL major than the source.
`--fresh-timeout`	No	Minutes to wait for a fresh backup on the source (default 120).
`--git-token`	No	Your own git token for the add-on repositories. Prompted for when absent.
`--switch`	No	Switch to the profile once the pull has finished.
`--open`	No	Open the editor on the profile afterwards.

Remote or local

$ ohm dev pull

ohm dev remove

Remove a developer profile and its local working copy.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`--keep-instance`	No	Remove the profile row only; the local instance and its data stay.
`--discard-changes`	No	Overwrite local checkouts that hold uncommitted or unpushed work.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm dev remove

ohm dev repo create

Create a repository and scaffold an add-on into it.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`--git-provider`	No	The git provider the token belongs to (default: builtin).
`--workspace`	No	The account or organisation the repository is created under.
`-n`, `--name`	No	The profile name.
`--public`	No	Create the repository PUBLIC. It is private by default, and should be.
`--module`	No	The technical module name (default: the repository name).
`--summary`	No	A one-line summary for the module manifest.
`--no-scaffold`	No	Create the repository empty; write and enable no module.
`--git-token`	No	Your own git token for the add-on repositories. Prompted for when absent.

Remote or local

$ ohm dev repo create

ohm dev set

Change the settings of a developer profile.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`-n`, `--name`	No	The profile name.
`--debug-mode`	No	Normal, Debug or DebugReload.
`--debug`	No	Run this profile under debugpy (the same as --debug-mode Debug).
`--ide`	No	vscode or pycharm.
`--expires`	No	Days until the profile expires (default 30).
`--no-expiry`	No	The profile never expires: the customer's data stays here indefinitely.
`--purge`	No	Purge the profile when it expires (the default).
`--no-purge`	No	Report the expiry rather than purging the profile on it.
`--allow-restricted`	No	Allow a Restricted customer instance to be pulled onto this machine.
`--no-allow-restricted`	No	Withdraw the allowance for a Restricted source.
`--git-token`	No	Your own git token for the add-on repositories. Prompted for when absent.
`--clear-git-token`	No	Forget the stored git token.
`--git-provider`	No	The git provider the token belongs to (default: builtin).
`--notes`	No	Free text kept on the profile.

Remote or local

$ ohm dev set

ohm dev status

Show the state of this profile's add-on checkouts.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`--refresh`	No	Re-read the checkouts before showing them.
`--json`	No	Write the answer as JSON.

Remote or local

$ ohm dev status

ohm dev switch

Make this profile the running one; stop the others.

Argument	Required	Description
`<profile>`	No	The profile, by name, id or source host name. Omitted means the active one.

Option	Required	Description
`--open`	No	Open the editor on the profile afterwards.
`--no-ide`	No	Do not regenerate the editor files as part of the switch.

Remote or local

$ ohm dev switch

ohm dev workstation

Show what this developer workstation is.

Option	Required	Description
`--json`	No	Write the answer as JSON.

Remote or local

$ ohm dev workstation

Odoo Management Plane

Enrolling this server with an Odoo Management Plane, which then rents, reports on and manages it from one place: enrol, status, leave.

ohm omp enrol

Enrol this server with the Odoo Management Plane its enrolment token names (local only).

Local only

This command has no remote form. Run it on the server itself.

Argument	Required	Description
`<token>`	Yes	The enrolment token from the OMP's Servers > Enrol a server page.

Local only

$ sudo ohm omp enrol

ohm omp leave

Leave the Odoo Management Plane: this server carries on stand-alone.

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm omp leave

ohm omp status

Show the Odoo Management Plane that manages this server.

Remote or local

$ ohm omp status

Users

Break-glass repair of the management console accounts, from the host.

ohm user list

List the management-UI user accounts.

Remote or local

$ ohm user list

ohm user password-reset

Reset an account password to a generated one (break-glass).

Argument	Required	Description
`<username>`	Yes	The login name of the account.

Remote or local

$ ohm user password-reset

ohm user totp-disable

Disable MFA for an account (break-glass).

Argument	Required	Description
`<username>`	Yes	The login name of the account.

Remote or local

$ ohm user totp-disable

ohm user unlock

Clear the lockout and re-enable an account (break-glass).

Argument	Required	Description
`<username>`	Yes	The login name of the account.

Remote or local

$ ohm user unlock

API keys

Issuing, listing and revoking the keys that scripts, a remote ohm and other callers use. The console's own key is under 'ohm server apikey'.

ohm apikey create

Issue an API key. The key is shown once.

Option	Required	Description
`-n`, `--name`	No	What the key is for. Required: it is what a later operator judges whether it can be revoked by.
`--surface`	No	A surface the key may reach: api or geoip. Repeat it for several. Omitted, the key reaches api.
`--read-only`	No	The key may only read.
`--instance`	No	An instance the key is limited to, by its id. Repeat it for several. Omitted, the key covers all of them.
`--expires`	No	When the key stops being accepted, such as 2027-01-31, read as UTC. Omitted, it never expires.
`--json`	No	Write the answer as JSON.

Remote or local

$ ohm apikey create

ohm apikey list

List the API keys. A key itself is never shown.

Option	Required	Description
`--json`	No	Write the answer as JSON.

Remote or local

$ ohm apikey list

ohm apikey revoke

Revoke an API key.

Argument	Required	Description
`<key>`	Yes	The key's id, prefix or exact name, as ohm apikey list shows it.

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm apikey revoke

AI assistants

A read-only Model Context Protocol server for an AI assistant such as Claude Desktop or Claude Code, over a stored connection and a read-only API key. The assistant starts it; see AI assistants in the manual.

ohm mcp

Serve this server's read-only diagnostics to an AI assistant such as Claude Desktop, over the Model Context Protocol on standard input and output. Give it a read-only API key.

Local only

This command has no remote form. Run it on the server itself.

Local only

$ ohm mcp

License

The license agreement: reading it, accepting it, and seeing who accepted what.

ohm license agreement - Show and accept the license agreement.
ohm license suspensions - List what the license switched off because it no longer carries it.

ohm license activate

Activate a license on this server online, or move one that is active on another machine here.

Option	Required	Description
`--key`	Yes	The license key, XXXX-XXXX-XXXX-XXXX-XXXX.
`--email`	Yes	The e-mail address the license was issued to.
`--comment`	No	A comment recorded with the activation or the move.
`--move`	No	Move the license here when it is active on another machine: the license server e-mails the address it was issued to a link to confirm, and the same command run again once it is confirmed moves it here. Exit code 2 while the confirmation is outstanding.

Remote or local

$ ohm license activate

ohm license agreement accept

Accept the license agreement and record the acceptance.

Option	Required	Description
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm license agreement accept

ohm license agreement show

Show the license agreement.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--raw`	No	Write the Markdown as it stands, without styling or a header.
`--output`	No	Write the document to this file, byte for byte as it is hashed.

Local only

$ ohm license agreement show

ohm license agreement status

Show which license agreement is in force and who accepted it.

Option	Required	Description
`--limit`	No	How many recorded acceptances to list (default 20).

Remote or local

$ ohm license agreement status

ohm license features

List every feature of the catalogue and whether the installed license carries it.

Remote or local

$ ohm license features

ohm license notices

Show the third-party notices: the open-source components built into this product and their licenses.

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--output`	No	Write the notices to this file instead of the console.

Local only

$ ohm license notices

ohm license presence

Show the daily report this server sends the license server while it has no license.

Remote or local

$ ohm license presence

ohm license status

Show the license situation, the edition and how much the license has switched off.

Remote or local

$ ohm license status

ohm license suspensions dismiss

Take an entry the operator re-does off the list of what the license switched off.

Argument	Required	Description
`<id>`	Yes	The entry's id, as 'ohm license suspensions' lists it.

Remote or local

$ ohm license suspensions dismiss

Master database

Bringing the master database's schema up to the build that is running. Local only, and the way past a console that refuses to start after an upgrade.

ohm database upgrade

Upgrade the master database to this build's schema (local only).

Local only

This command has no remote form. Run it on the server itself.

Option	Required	Description
`--dry-run`	No	Print what the upgrade would do and change nothing.
`--export-to`	No	Where to write the pre-upgrade export (default: the server's backup directory).
`--no-export`	No	Skip the pre-upgrade export. Only for a database you can afford to lose.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Local only

$ sudo ohm database upgrade

ohm database upgrade-export

Bring an older Master data export forward so it can be imported (local only).

Local only

This command has no remote form. Run it on the server itself.

Argument	Required	Description
`<file>`	Yes	The older export: a .sql script, or a .zip carrying the encryption keys.

Option	Required	Description
`--output`, `-o`	No	The file to write (default: beside the export, named after the new schema).
`--passphrase-file`	No	A file holding the passphrase of an export that carries its encryption keys.

Local only

$ sudo ohm database upgrade-export

System

The master-database provider and host housekeeping.

ohm system database - Manage the application ("master") database.

ohm system assemblies

list loaded assemblies and their versions.

Local only

This command has no remote form. Run it on the server itself.

Local only

$ sudo ohm system assemblies

ohm system commands

List all available commands and their descriptions.

Local only

This command has no remote form. Run it on the server itself.

Argument	Required	Description
`<filter>`	No	Optional filter: only commands whose full name contains this value are listed.

Local only

$ sudo ohm system commands

ohm system database export

Export the application database, optionally with its encryption keys.

Option	Required	Description
`--dialect`	No	The engine the script is written for (PostgreSQL or SqlServer; default: this server's).
`--with-keys`	No	Carry the encryption keys in the export, sealed under a passphrase you are asked for.
`--passphrase-file`	No	A file holding the passphrase to seal the encryption keys under. Implies --with-keys.
`--output`, `-o`	No	Also download the export to this file.

Remote or local

$ ohm system database export

ohm system database import

Replace the application database with an export (irreversible).

Argument	Required	Description
`<file>`	Yes	The export: a .sql script, or a .zip carrying the encryption keys.

Option	Required	Description
`--passphrase-file`	No	A file holding the passphrase of an export that carries its encryption keys.
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm system database import

ohm system database migrate

Migrate the application database to the other provider (drops and re-imports the destination).

Option	Required	Description
`--to`	Yes	Destination database provider (PostgreSQL or SqlServer).
`-y`, `--yes`	No	Assume 'yes' to all prompts and run non-interactively.

Remote or local

$ ohm system database migrate

ohm system maintenance

Remove stale temporary files and expire old log files.

Option	Required	Description
`--temp-age-days`	No	Maximum age in days of temporary files to remove from /tmp and /var/tmp (0 = skip).
`--log-age-days`	No	Maximum age in days of timestamped Odoo log files to remove (0 = skip).

Remote or local

$ ohm system maintenance

Release notes

What changed in this build.

ohm release-notes

Show the release notes for this build.

Option	Required	Description
`--all`	No	Show every version the notes carry instead of only the running one.
`--release`	No	Show the notes for one specific version, for example '1.2.3'.
`--under-the-hood`	No	Include the "Under the hood" section, which lists internal changes the console folds away.

Remote or local

$ ohm release-notes

Installing
- ohm install
Connections
Server
Instances
Backup archives
- ohm backup decrypt
Developer workstation
Odoo Management Plane
Users
API keys
AI assistants
- ohm mcp
License
Master database
- ohm database upgrade
- ohm database upgrade-export
System
Release notes
- ohm release-notes

Installing​

ohm install​

Connections​

ohm connection add​

ohm connection default​

ohm connection list​

ohm connection remove​

Server​

ohm server agentimage upgrade​

ohm server agentimage verify​

ohm server agentkey rotate​

ohm server agentkey show​

ohm server alerts channels add​

ohm server alerts channels list​

ohm server alerts channels remove​

ohm server alerts channels resume​

ohm server alerts channels test​

ohm server alerts channels update​

ohm server alerts deliveries​

ohm server alerts events​

ohm server alerts rules add​

ohm server alerts rules defaults​

ohm server alerts rules list​

ohm server alerts rules remove​

ohm server alerts rules update​

ohm server alerts types​

ohm server analytics access​

ohm server analytics install​

ohm server analytics remove​

ohm server analytics set​

ohm server analytics show​

ohm server analytics status​

ohm server analytics sync​

ohm server apikey rotate​

ohm server audit​

ohm server certificate custom​

ohm server config domain clear​

ohm server config domain set​

ohm server config domain show​

ohm server config export​

ohm server config import​

ohm server config proxy clear​

ohm server config proxy set​

ohm server config proxy show​

ohm server config proxy test​

ohm server config rebuild​

ohm server config validate-dns​

ohm server database list​

ohm server fail2ban ban​

ohm server fail2ban config install​

ohm server fail2ban config remove​

ohm server fail2ban install​

ohm server fail2ban list​

ohm server fail2ban remove​

ohm server fail2ban unban​

ohm server info​

ohm server install​

ohm server manifest apply​

ohm server manifest export​

ohm server pgbouncer install​

ohm server pgbouncer remove​

ohm server pgbouncer status​

ohm server pgbouncer sync​

ohm server portainer install​

ohm server portainer remove​

ohm server postgres image build​

ohm server postgres image list​

ohm server postgres image remove​

ohm server postgres reindex​

ohm server postgres shell​

ohm server postgres slow-queries list​

ohm server postgres slow-queries reset​

ohm server postgres slow-queries status​

ohm server postgres vacuum​

ohm server rename​

ohm server replica install​

ohm server replica promote​

ohm server replica remove​

ohm server replica status​

ohm server rollback​

Installing

ohm install

Connections

ohm connection add

ohm connection default

ohm connection list

ohm connection remove

Server

ohm server agentimage upgrade

ohm server agentimage verify

ohm server agentkey rotate

ohm server agentkey show

ohm server alerts channels add

ohm server alerts channels list

ohm server alerts channels remove

ohm server alerts channels resume

ohm server alerts channels test

ohm server alerts channels update

ohm server alerts deliveries

ohm server alerts events

ohm server alerts rules add

ohm server alerts rules defaults

ohm server alerts rules list

ohm server alerts rules remove

ohm server alerts rules update

ohm server alerts types

ohm server analytics access

ohm server analytics install

ohm server analytics remove

ohm server analytics set

ohm server analytics show

ohm server analytics status

ohm server analytics sync

ohm server apikey rotate

ohm server audit

ohm server certificate custom

ohm server config domain clear

ohm server config domain set

ohm server config domain show

ohm server config export

ohm server config import

ohm server config proxy clear

ohm server config proxy set

ohm server config proxy show

ohm server config proxy test

ohm server config rebuild

ohm server config validate-dns

ohm server database list

ohm server fail2ban ban

ohm server fail2ban config install

ohm server fail2ban config remove

ohm server fail2ban install

ohm server fail2ban list

ohm server fail2ban remove

ohm server fail2ban unban

ohm server info

ohm server install

ohm server manifest apply

ohm server manifest export

ohm server pgbouncer install

ohm server pgbouncer remove

ohm server pgbouncer status

ohm server pgbouncer sync

ohm server portainer install

ohm server portainer remove

ohm server postgres image build

ohm server postgres image list

ohm server postgres image remove

ohm server postgres reindex

ohm server postgres shell

ohm server postgres slow-queries list

ohm server postgres slow-queries reset

ohm server postgres slow-queries status

ohm server postgres vacuum

ohm server rename

ohm server replica install

ohm server replica promote

ohm server replica remove

ohm server replica status

ohm server rollback