diff options
Diffstat (limited to 'doc/setup/deploy.rst')
| -rw-r--r-- | doc/setup/deploy.rst | 33 |
1 files changed, 20 insertions, 13 deletions
diff --git a/doc/setup/deploy.rst b/doc/setup/deploy.rst index 9879117b607..ed1825298e2 100644 --- a/doc/setup/deploy.rst +++ b/doc/setup/deploy.rst @@ -71,7 +71,8 @@ in ``/etc/odoo.conf`` set: Once it is correctly working and only matching a single database per hostname, it is strongly recommended to block access to the database manager screens, and to use the ``--no-database-list`` startup paramater to prevent listing - your databases. See also security_. + your databases, and to block access to the database management screens. + See also security_. PostgreSQL @@ -213,10 +214,6 @@ Instead you must have a proxy redirecting requests whose URL starts with ``/longpolling/`` to the longpolling port. Other request should be proxied to the :option:`normal HTTP port <odoo-bin --http-port>` -.. warning:: The livechat worker requires the ``psycogreen`` Python module, - which is not always included with all installation packages. - It can be manually installed with ``pip install psycogreen``. - Configuration sample -------------------- @@ -427,10 +424,14 @@ security-related topics: - Use appropriate database filters ( :option:`--db-filter <odoo-bin --db-filter>`) to restrict the visibility of your databases according to the hostname. See :ref:`db_filter`. - -- Once your ``db_filter`` is configured and only matches a single database per hostname, - you should set ``list_db`` configuration option to ``False``, to prevent listing databases - entirely (this is also exposed as the :option:`--no-database-list <odoo-bin --no-database-list>` + You may also use :option:`-d <odoo-bin -d>` to provide your own (comma-separated) + list of available databases to filter from, instead of letting the system fetch + them all from the database backend. + +- Once your ``db_name`` and ``db_filter`` are configured and only match a single database + per hostname, you should set ``list_db`` configuration option to ``False``, to prevent + listing databases entirely, and to block access to the database management screens + (this is also exposed as the :option:`--no-database-list <odoo-bin --no-database-list>` command-line option) - Make sure the PostgreSQL user (:option:`--db_user <odoo-bin --db_user>`) is *not* a super-user, @@ -473,10 +474,16 @@ Database Manager Security This setting is used on all database management screens (to create, delete, dump or restore databases). -If the management screens must not be accessible, or must only be accessible -from a selected set of machines, use the proxy server's features to block -access to all routes starting with ``/web/database`` except (maybe) -``/web/database/selector`` which displays the database-selection screen. +If the management screens must not be accessible at all, you should set ``list_db`` +configuration option to ``False``, to block access to all the database selection and +management screens. But be sure to setup an appropriate ``db_name`` parameter +(and optionally, ``db_filter`` too) so that the system can determine the target database +for each request, otherwise users will be blocked as they won't be allowed to choose the +database themselves. + +If the management screens must only be accessible from a selected set of machines, +use the proxy server's features to block access to all routes starting with ``/web/database`` +except (maybe) ``/web/database/selector`` which displays the database-selection screen. If the database-management screen should be left accessible, the ``admin_passwd`` setting must be changed from its ``admin`` default: this |