CLI reference

Every real flag of the invok binary (from src/cli.rs), with its default. Resolution priority is CLI → .env → interactive prompt → default.

sudo invok [OPTIONS]

Flag	Value	Default	Notes
--version	16 | 17 | 18 | 19 (or NN.0)	18.0	normalised to NN.0; NN is the short form used in file, unit and service names
--instance	^[a-z][a-z0-9_-]{0,25}$	—	names a second installation on the same machine. Absent means the historical, unnamed one. Validated against the intersection of the five grammars it ends up in — unit, path, PostgreSQL identifier, server_name, Unix user — and capped at 26 characters because the derived user is odoo-<name> and Unix stops at 32
--odoo-user	identifier	odoo, or odoo-<instance>	system user
--db-user	identifier	= --odoo-user	PostgreSQL role; an explicit value decouples the two. It follows the user because pg_hba.conf usually says peer over the local socket, which authenticates by operating-system user
--db-password	string	empty	empty → peer authentication (no password)
--port	1–65535	8069	Odoo's HTTP port. It moves --gevent-port with it
--gevent-port	1–65535	--port + 3 (so 8072)	the longpolling/websocket port. Overridable for a machine that already uses that number; it may not equal --port
--db-name	identifier	odoo, or odoo-<instance>	database name
--install-dir	absolute path	/opt/odoo/odoo<N>, or /opt/odoo/odoo-<instance>	must live under /opt/odoo
--admin-passwd	string	admin	Odoo master password; admin is discouraged (see below)
--logfile	path	—	Odoo log file; absent → journal/stdout
--with-nginx	flag	off	configures Nginx as a reverse proxy
--server-name	string	_	server_name of the Nginx vhost (catch-all by default)
--open-https-port	flag	off	opens 443 on the firewall ahead of TLS. It does not configure TLS — that is certbot --nginx, which rewrites the vhost itself. Legacy alias: --enable-ssl
--config <FILE>	path	—	loads a .env file (declarative parsing)
--dry-run	flag	off	prints the plan without mutating anything. Works without sudo too, but unprivileged some steps cannot inspect the system and the plan comes out incomplete — the installer says so
--aggressive-rollback	flag	off	on rollback, also purges packages and PostgreSQL that would normally stay
--force	flag	off	installs even if a manifest exists, archiving it instead of overwriting
-V / --installer-version	flag	—	prints the installer's version and exits (--version is Odoo's)
--help	flag	—	help message

Subcommand list — the instances installed on this machine, their state, database and directory, followed by the manifest each one lives in. Needs root, because the manifests are 0600 root: a listing that silently came up empty for lack of privileges would be worse than a refusal.

Subcommand rollback (alias uninstall) — see The rollback model:

Flag	Value	Default	Notes
--instance <NAME>	instance name, or default for the unnamed one	—	which one to undo. With more than one installed and no selector, rollback lists them and stops: it does not guess when the choice is destructive
--all	flag	off	every instance, in two passes — each one's own artifacts first, then what they had in common. Mutually exclusive with --instance and --state
--state <FILE>	path	/var/lib/invok/state.json	manifest to consume; if absent, the historical path /opt/odoo/.installer-state.json is tried. Cannot be combined with --instance: one names a file, the other an instance
--dry-run	flag	off	lists what would be removed without touching anything; no sudo needed
--aggressive-rollback	flag	off	as above
--yes / -y	flag	off	skips the confirmation; required with no terminal

Notes:

• ODOO_HOME is the constant /opt/odoo and cannot be changed from the CLI.
• An instance is created by naming it, from three places in this order: --instance, the interactive form — which asks for it first, with an empty default meaning the historical instance — and ODOO_INSTANCE in a .env. Re-running the installer does not add one by itself. The question comes first because the answers below it are named after it: asked at the end, a second instance would inherit the first one's user, database and port.
• Re-running the installer on an already-installed instance fails, with a message naming the three ways on — --instance <name> --port <free port> to add a second one beside it, rollback to remove this one, --force to install over it: the uninstall manifest is never silently overwritten. On an interrupted installation, a re-run resumes it — with the same parameters, otherwise the installer stops and says which field does not match.
• Ports are checked against the other manifests, not only against the system: an instance that is merely stopped holds no socket, so its ports would look free and the collision would surface at the first simultaneous start, naming neither of them.
• Ctrl-C rolls the installation back and restores the system. It takes effect between steps: the one in progress is carried to completion, because stopping an apt halfway is worse than waiting. The three commands that talk to the network run in a process group of their own — so that a timeout can kill the worker rather than the sudo in front of it — and are therefore finished rather than interrupted; the log says so when it happens. A second Ctrl-C exits at once (code 130), and from there the cleanup is yours, with sudo invok rollback.
• --admin-passwd admin: interactively it requires an explicit confirmation; non-interactively the installer stops (set a different password). The password never reaches the logs.
• --aggressive-rollback: handle with care — it removes more on rollback (common bootstrap utilities, PostgreSQL). The PostgreSQL purge is still declined if the cluster hosts other databases. See Security.

Configuration from a file: .env file reference.