Env file reference

The keys recognised in the configuration file passed with --config <FILE>. Unknown keys produce a warning and are ignored — that is not an error.

Declarative parsing (and why it is safe)

The file is read line by line as KEY=VALUE: comments (#) and blank lines are ignored, and quotes around the value are stripped. No code execution: a value like $(rm -rf /) stays a literal string and is never run. That is the key difference from the old Bash version, which sourced the file — a code-execution vector running as root.

Recognised keys

Key	CLI equivalent	Default
ODOO_VERSION	--version	18.0
ODOO_USER	--odoo-user	odoo
DB_USER	--db-user	= ODOO_USER
DB_PASSWORD	--db-password	empty → peer auth
ODOO_PORT	--port	8069
DB_NAME	--db-name	odoo
ODOO_INSTALL_DIR	--install-dir	/opt/odoo/odoo<N>
ODOO_ADMIN_PASSWD	--admin-passwd	admin (discouraged)
ODOO_LOGFILE	--logfile	absent → journal/stdout
WITH_NGINX	--with-nginx	false
NGINX_SERVER_NAME	--server-name	_
NGINX_OPEN_HTTPS_PORT	--open-https-port	false
NGINX_ENABLE_SSL	(legacy name of the previous key)	false

ODOO_HOME is the constant /opt/odoo: if present in the file it is ignored, with a warning.

Boolean values (WITH_NGINX, NGINX_OPEN_HTTPS_PORT): true/1/yes/on mean true.

NGINX_ENABLE_SSL is the name the key was born with, and it keeps working: it lives in .env files already handed out, and breaking those over a naming question would do more damage than the name does. The new name says what it actually does — it opens 443 on the firewall, it does not configure TLS.

Example

# production.env
ODOO_VERSION=18
ODOO_USER=odoo
DB_NAME=odoo
ODOO_PORT=8069
WITH_NGINX=true
NGINX_SERVER_NAME=odoo.example.com
# NGINX_OPEN_HTTPS_PORT=true          # opens 443; for TLS run `certbot --nginx` afterwards
# ODOO_ADMIN_PASSWD=a-strong-password # do NOT use 'admin' in production

sudo invok --config production.env

A CLI value takes precedence over the one in the .env. See CLI reference and Non-interactive use and CI.

Protecting secrets: lock down the .env file if it contains ODOO_ADMIN_PASSWD/DB_PASSWORD. The password goes into the final config file (0640 odoo:odoo) and is never logged.