OBM

Documentation

Operate OBM CE well

Schedules, keep-rules retention, verification, downloads, backing up OBM itself, lockout recovery, reverse-proxy HTTPS, and the version-check opt-out.

CE is deliberately boring to operate: one container, one data directory, a handful of environment variables. This page covers the day-2 topics — how retention and verification actually behave, how to keep OBM itself safe, and how to get back in when you're locked out. For the install itself, start with the quickstart.

Schedules

Every database gets its own schedule: daily, weekly, monthly, or a cron expression — each with its own timezone, so "2 AM" means the client's 2 AM. Backups run through a global concurrency limit (GLOBAL_CONCURRENCY, default 2), so a fleet of schedules firing at midnight doesn't stampede your Odoo servers. Long dumps are expected: the read timeout defaults to an hour (READ_TIMEOUT=3600).

Retention: keep-rules

Two rules per database, usable together: keep N days and keep last N copies. They combine as a union — a backup survives as long as either rule still wants it — and the newest backup is never deleted, whatever the rules say. OBM prunes to these rules automatically, and a daily reconciliation pass cleans up any orphaned files on disk.

Verification

A backup doesn't count until it's verified. .zip archives get a CRC check of every member plus a manifest check; db-only .dump files get their pg_dump header checked. The archive's SHA-256 is then computed and recorded, and its size is compared against previous runs so a suspiciously small backup stands out on the dashboard. Corrupt archives are rejected, not quietly archived.

Downloads

Every stored backup can be downloaded from its database's page: the .zip (database + filestore, restorable via Odoo's own database manager) or the smaller .dump (database only, for pg_restore). OBM records a SHA-256 for every archive — compare it with sha256sum after downloading if you want end-to-end assurance. The restore paths are covered in Restore a backup.

Back up OBM itself

A backup tool that can't survive its own host dying is an irony nobody needs. Three things matter: 

# everything OBM CE needs to come back from zero:
.env             # config incl. FERNET_KEY — keep a copy in your password manager
data/app.db      # state: customers, instances, schedules, backup catalog
data/backups/    # the backup archives themselves
  • .env, and above all FERNET_KEY — it encrypts every stored master password. Losing it means re-entering every master password by hand. Keep a copy in your password manager, and keep the file out of ./data so backups of the data directory never contain the key that unlocks them.
  • data/app.db — the SQLite state: customers, instances, schedules, and the catalog of every backup taken.
  • data/backups/ — the payload. Sync it wherever your storage policy wants (rsync, restic, object storage…).

Recovery is: new host, clone the repo, restore .env and ./data, docker compose up -d. Database migrations run automatically on start.

Locked out: ADMIN_FORCE_RESET

If you lose the admin password — or suspect a session has leaked:

# in .env — one-shot recovery
ADMIN_FORCE_RESET=true

docker compose up -d    # re-applies ADMIN_PASSWORD_HASH, revokes all sessions

# then remove the line again

The flag is one-shot by intent: on startup it re-applies whatever ADMIN_PASSWORD_HASH says (generate a fresh hash with scripts/hash_password.py — single quotes, as in the quickstart) and revokes existing sessions. Unset it afterwards so a later restart doesn't silently reset the password again.

Reverse proxy & HTTPS

CE serves plain HTTP on port 8300 and expects your reverse proxy (Caddy, nginx, Traefik…) to terminate TLS. Two variables matter once a proxy is in front: 

COOKIE_SECURE=true              # session cookie only over HTTPS
FORWARDED_ALLOW_IPS=<proxy-ip>  # trust X-Forwarded-For from the proxy only
  • COOKIE_SECURE=true marks the session cookie Secure, so browsers only send it over HTTPS.
  • FORWARDED_ALLOW_IPS tells OBM to trust X-Forwarded-For from your proxy's address, so the login rate limiter keys on the real client IP instead of the proxy's. Only widen it when a proxy is actually in front.

The update check

Once a day, CE asks obm.projomania.com whether a newer release exists. The request carries the edition and version string — nothing else — and it is the only phone-home in the product. Opt out any time: 

VERSION_CHECK=false

Next steps

  • Restore a backup — rehearse it before an incident makes you.
  • CE vs Pro — alerts with a dead-man's switch, restore drills, GFS retention and off-site storage live in the hosted edition.