Instalasi Odoo pada sistem operasi Linux¶

cp -v /etc/nginx/nginx.conf{,.`date +%Y%m%d%H%M`}
cat << EOF > /etc/nginx/nginx.conf
user nginx;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    multi_accept on;
    worker_connections 65536;
}

http {
    charset                 utf-8;
    sendfile                on;
    tcp_nopush              on;
    tcp_nodelay             on;
    server_tokens           off;
    keepalive_timeout       65;
    types_hash_max_size     2048;

    # MIME
    include                 mime.types;
    default_type            application/octet-stream;

    # Logging
    access_log              /var/log/nginx/access.log;
    error_log               /var/log/nginx/error.log warn;

    # Limits
    limit_req_log_level     warn;
    limit_req_zone          \$binary_remote_addr zone=login:10m rate=10r/m;

    # SSL
#    ssl on;
    ssl_session_timeout     1d;
#    ssl_session_timeout     30m;
    ssl_session_cache       shared:SSL:10m;
    ssl_session_tickets     off;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam             /etc/nginx/dhparam.pem;

    # Mozilla Intermediate configuration
    ssl_protocols           TLSv1.2 TLSv1.3;
    ssl_ciphers             ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
#    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
#    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    ssl_stapling            on;
    ssl_stapling_verify     on;
    resolver                1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout        2s;

    # Load configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}
EOF

FQDN_INSTALASI="wow13.proxsis.com"
UPSTREAM="app07-wow13"
cat << EOF > /etc/nginx/conf.d/$FQDN_INSTALASI.conf
# app07-wow13 server
upstream $UPSTREAM {
    server 127.0.0.1:8069;
}
upstream $UPSTREAM-chat {
    server 127.0.0.1:8072;
}

server {
    listen 443 ssl http2;
    server_name $FQDN_INSTALASI;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/$FQDN_INSTALASI/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/$FQDN_INSTALASI/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/$FQDN_INSTALASI/chain.pem;

    # BEGIN SECURITY
    #include                 conf.d/security.conf;
    add_header X-Frame-Options           "SAMEORIGIN" always;
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # . files
    location ~ /\.(?!well-known) {
        deny all;
    }
    ## END SECURITY

    # logging
    access_log                          /var/log/nginx/$FQDN_INSTALASI.access.log;
    error_log                           /var/log/nginx/$FQDN_INSTALASI.error.log warn;

    ## BEGIN PROXY
    #include                 conf.d/proxy.conf
    proxy_http_version                  1.1;
    proxy_cache_bypass                  \$http_upgrade;

    # Add Headers for odoo proxy mode
    proxy_set_header Upgrade            \$http_upgrade;
    proxy_set_header Connection         "upgrade";
    proxy_set_header Host               \$host;
    proxy_set_header X-Real-IP          \$remote_addr;
    proxy_set_header X-Forwarded-For    \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto  \$scheme;
    proxy_set_header X-Forwarded-Host   \$host;
    proxy_set_header X-Forwarded-Port   \$server_port;

    # Proxy timeouts
    proxy_connect_timeout               720s;
    proxy_send_timeout                  720s;
    proxy_read_timeout                  720s;

    # additional proxy parameters
    proxy_next_upstream                 error timeout invalid_header http_500 http_502 http_503;

    # increase proxy buffer to handle some OpenERP web requests
    proxy_buffers                       16 64k;
    proxy_buffer_size                   128k;

    # by default, do not forward anything
    proxy_redirect                      off;
    proxy_buffering                     on;
    proxy_max_temp_file_size            0;

    # cache some static data in memory for 60mins.
    # under heavy load this should relieve stress on the OpenERP web interface a bit.
    location ~* /web/static/ {
        proxy_pass                      http://$UPSTREAM;
        proxy_buffering                 on;
        proxy_cache_valid               200 60m;
        expires                         864000;
    }

    # Specifies the maximum accepted body size of a client request,
    # as indicated by the request header Content-Length.
    client_max_body_size                512m;

    # IP Whitelist
    location /web/database/ {
        allow 159.89.200.13;
        deny all;
        proxy_pass http://$UPSTREAM;
    }

#    location /.well-known/acme-challenge/ {
#        proxy_pass http://$UPSTREAM;
#        allow all;
#    }

    # Redirect requests to odoo backend server
    location / {
        proxy_redirect off;
        proxy_pass http://$UPSTREAM;
    }

    # Redirect longpoll requests to odoo longpolling port
    location /longpolling {
        proxy_pass http://$UPSTREAM-chat;
    }
    ## END PROXY

    ## BEGIN GENERAL
    # favicon.ico
    location = /favicon.ico {
        log_not_found off;
        access_log    off;
    }

    # robots.txt
    location = /robots.txt {
        log_not_found off;
        access_log    off;
    }

    # common gzip
    gzip on;
    gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    ## END GENERAL
}

# subdomains redirect
server {
    listen                  443 ssl http2;
    server_name             *.$FQDN_INSTALASI;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/$FQDN_INSTALASI/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/$FQDN_INSTALASI/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/$FQDN_INSTALASI/chain.pem;
    return                  301 https://\$host\$request_uri;
}

# HTTP redirect
server {
    listen      80;
    server_name .$FQDN_INSTALASI;
#    rewrite ^(.*) https://\$host\$1 permanent;

    #include    conf.d/letsencrypt.conf;
    # ACME-challenge
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/_letsencrypt;
    }

    location / {
        return 301 https://\$host\$request_uri;
    }
}
EOF