Deploy Odoo 18 on Vultr Cloud: Complete 2025 Production Guide

```yaml
services:
  odoo-db:
    image: postgres:16
    container_name: odoo-db
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_INITDB_ARGS: "-E UTF8"
    volumes:
      - odoo-db-data:/var/lib/postgresql/data
    networks:
      - odoo-network
    restart: unless-stopped
    command: >
      postgres
      -c shared_buffers=1024MB
      -c effective_cache_size=3GB
      -c maintenance_work_mem=256MB
      -c checkpoint_completion_target=0.9
      -c wal_buffers=16MB
      -c default_statistics_target=100
      -c random_page_cost=1.1
      -c effective_io_concurrency=200
      -c work_mem=10485kB
      -c min_wal_size=1GB
      -c max_wal_size=4GB
      -c max_worker_processes=2
      -c max_parallel_workers_per_gather=1
      -c max_parallel_workers=2
      -c max_parallel_maintenance_workers=1
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  odoo-web:
    image: odoo:18.0
    container_name: odoo-web
    depends_on:
      odoo-db:
        condition: service_healthy
    environment:
      HOST: odoo-db
      USER: ${POSTGRES_USER}
      PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - odoo-web-data:/var/lib/odoo
      - ./addons:/mnt/extra-addons
      - ./config:/etc/odoo
    networks:
      - odoo-network
    ports:
      - "127.0.0.1:8069:8069"
    restart: unless-stopped
    command: >
      --
      --workers=5
      --max-cron-threads=1
      --limit-memory-hard=2684354560
      --limit-memory-soft=2147483648
      --limit-request=8192
      --limit-time-cpu=600
      --limit-time-real=1200
      --db_host=odoo-db
      --db_port=5432
      --db_user=${POSTGRES_USER}
      --db_password=${POSTGRES_PASSWORD}
      --dbfilter=^%d$
      --proxy-mode
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8069/web/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

volumes:
  odoo-db-data:
    driver: local
  odoo-web-data:
    driver: local

networks:
  odoo-network:
    driver: bridge
```

**Configuration Explanation:**

- **PostgreSQL tuning**: `shared_buffers=1024MB` allocates 25% of 4GB RAM for database caching. `effective_cache_size=3GB` tells PostgreSQL how much RAM is available for caching. `random_page_cost=1.1` is optimized for NVMe SSDs (default 4.0 is for spinning disks).

- **Odoo workers**: `--workers=5` follows the formula `1 + (vCPU * 2)` for 2-core instances. This enables multiprocess mode for better concurrency. `--max-cron-threads=1` ensures scheduled tasks don't compete with web requests.

- **Memory limits**: `--limit-memory-hard=2684354560` (2.5GB) prevents memory leaks from crashing the server. `--limit-memory-soft=2147483648` (2GB) triggers worker recycling before hard limit.

- **Security**: Port 8069 is bound to `127.0.0.1` only—not accessible from internet. `--proxy-mode` enables Odoo to trust X-Forwarded-For headers from Nginx. `--dbfilter=^%d$` prevents database enumeration attacks.

- **Health checks**: PostgreSQL health check ensures database is ready before Odoo starts. Odoo health check monitors web service availability for container orchestration.

```nginx
# Upstream configuration for Odoo
upstream odoo {
    server 127.0.0.1:8069;
}

upstream odoo-chat {
    server 127.0.0.1:8072;  # Odoo longpolling for chat/notifications
}

# Rate limiting zone to prevent abuse
limit_req_zone $binary_remote_addr zone=odoo_limit:10m rate=10r/s;

# HTTP to HTTPS redirect
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;

    # Allow Let's Encrypt validation
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # Redirect all other HTTP traffic to HTTPS
    location / {
        return 301 https://$server_name$request_uri;
    }
}

# HTTPS server configuration
server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    # SSL certificates (managed by Certbot)
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # SSL optimization
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Proxy settings
    proxy_read_timeout 720s;
    proxy_connect_timeout 720s;
    proxy_send_timeout 720s;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_redirect off;

    # Gzip compression
    gzip on;
    gzip_types text/css text/scss text/plain text/xml application/xml application/json application/javascript;
    gzip_min_length 1000;
    gzip_proxied any;
    gzip_comp_level 6;

    # File upload size limit (adjust based on your needs)
    client_max_body_size 100M;

    # Block access to database manager in production
    location ~* /web/database {
        deny all;
        return 403;
    }

    # Odoo longpolling for real-time features
    location /longpolling {
        proxy_pass http://odoo-chat;
        proxy_buffering off;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # Static files with aggressive caching
    location ~* /web/static/ {
        proxy_cache_valid 200 304 60m;
        proxy_buffering on;
        expires 864000;
        add_header Cache-Control "public, immutable";
        proxy_pass http://odoo;
    }

    # User-uploaded content with moderate caching
    location ~* /web/content/ {
        expires 7d;
        add_header Cache-Control "public";
        proxy_pass http://odoo;
    }

    # Main Odoo application with rate limiting
    location / {
        limit_req zone=odoo_limit burst=20 nodelay;
        proxy_pass http://odoo;
    }

    # Logging
    access_log /var/log/nginx/odoo-access.log;
    error_log /var/log/nginx/odoo-error.log;
}
```

**Configuration Highlights:**

- **Database manager blocking**: The `location ~* /web/database` block prevents public access to Odoo's database management interface, a critical security measure for production.

- **Static file caching**: `/web/static/` files (CSS, JS, images) are cached for 10 days with `immutable` flag. This reduces Odoo worker load by 30-40% for returning visitors.

- **Rate limiting**: `limit_req_zone` allows 10 requests per second per IP with a burst buffer of 20. Prevents brute-force attacks on login forms.

- **SSL hardening**: Only TLS 1.2+ with strong ciphers. HSTS header ensures browsers always use HTTPS for 1 year after first visit.

- **Longpolling**: Odoo 18's real-time features (chat, notifications) use WebSocket-like connections on port 8072. This requires a separate upstream to avoid timeout issues.