Prepare a Server on Azure
This guide gets a virtual machine ready for Bring Your Own Server, with its firewall, fixed IP and backup storage. Skysize installs everything else on the server.
Each step has two tabs: click through the Console, or paste from Command line. Your choice applies to the whole page.
Commands run in Cloud Shell (Bash), the terminal icon at the top of the Azure portal, so there is nothing to install. Keep the same tab open: each block reuses the values from step 1.
1. Choose your values
Pick the location closest to your users, and the size for your use.
| Use | Size | vCPU | RAM | Disk |
|---|---|---|---|---|
| One production and one staging | Standard_D2s_v5 | 2 | 8 GB | 128 GB |
| Production with staging and development branches | Standard_D4s_v5 | 4 | 16 GB | 256 GB |
Avoid sizes with a p after the number, such as D2ps_v5: they are ARM, and the installer refuses to run on them. Avoid the B-series for production: it slows down under sustained load.
- Console
- Command line
Open Resource groups → Create, name the group skysize-odoo, and choose your location. Use the same group and location in every step.
LOCATION=eastus
NAME=skysize-odoo
SIZE=Standard_D2s_v5
DISK_GB=128
STORAGE=skysizeodoo$RANDOM
az group create --name "$NAME" --location "$LOCATION"
2. Create the network security group
The server needs these inbound rules, and no others:
| Service | Port | Source | Why |
|---|---|---|---|
| SSH | 22 | Any | Your access to the server, with an SSH key only |
| HTTP | 80 | Any | Certificates and redirects |
| HTTPS | 443 | Any | Your Odoo sites |
Skysize itself needs no inbound port. Once you know the address you connect from, you can limit the SSH rule to it. Leave PostgreSQL (5432) closed unless you use read-only database access. Outbound traffic is allowed by default, and the server needs it.
- Console
- Command line
There is nothing to create yet: you set these rules while creating the VM in the next step.
az network nsg create --resource-group "$NAME" --name "$NAME"
az network nsg rule create --resource-group "$NAME" --nsg-name "$NAME" \
--name ssh --priority 1000 --protocol Tcp --destination-port-ranges 22 --access Allow
az network nsg rule create --resource-group "$NAME" --nsg-name "$NAME" \
--name web --priority 1010 --protocol Tcp --destination-port-ranges 80 443 --access Allow
3. Create the VM with a fixed IP
Use Ubuntu 24.04 for x86, a static public IP so your DNS records keep working, and a managed identity for backups. Note the IP: your DNS records will point to it.
- Console
- Command line
Open Virtual machines → Create → Azure virtual machine, and set:
| Tab | Setting | Value |
|---|---|---|
| Basics | Resource group | skysize-odoo |
| Basics | Virtual machine name | skysize-odoo |
| Basics | Image | Ubuntu Server 24.04 LTS, x64 |
| Basics | Size | The size from step 1 |
| Basics | Authentication type | SSH public key, username azureuser |
| Basics | Public inbound ports | Allow selected ports: SSH (22), HTTP (80), HTTPS (443) |
| Disks | OS disk | Premium SSD, with the size from step 1 |
| Networking | Public IP | Keep the new one it proposes, which is static |
| Management | Enable system assigned managed identity | On |
Click Review + create, then Create, and download the SSH key when asked.
az vm create --resource-group "$NAME" --name "$NAME" \
--image Canonical:ubuntu-24_04-lts:server:latest \
--size "$SIZE" \
--os-disk-size-gb "$DISK_GB" --storage-sku Premium_LRS \
--admin-username azureuser --generate-ssh-keys \
--nsg "$NAME" --public-ip-sku Standard \
--assign-identity
az vm show --resource-group "$NAME" --name "$NAME" --show-details --query publicIps --output tsv
4. Create the backup storage
Skysize makes no backups until a project has a backup target. This creates a private storage account and lets the server's managed identity use it, with no secret to store. Note the storage account's name.
- Console
- Command line
Storage account
- Open Storage accounts → Create.
- Choose the group
skysize-odoo, and a name that is unique across Azure: lowercase letters and digits only. - Set Redundancy to LRS.
- On the Advanced tab, turn off Allow enabling anonymous access on individual containers.
- Click Review + create, then Create.
Container and access
- In the storage account, open Containers, and add one named
backups. - Open Access Control (IAM) → Add → Add role assignment.
- Choose Storage Blob Data Contributor, then under Members choose Managed identity and select your VM.
- Click Review + assign.
- Repeat with Storage Blob Delegator.
az storage account create --resource-group "$NAME" --name "$STORAGE" \
--location "$LOCATION" --sku Standard_LRS --allow-blob-public-access false
az storage container create --account-name "$STORAGE" --name backups --auth-mode key
PRINCIPAL=$(az vm show --resource-group "$NAME" --name "$NAME" --query identity.principalId --output tsv)
SCOPE=$(az storage account show --resource-group "$NAME" --name "$STORAGE" --query id --output tsv)
az role assignment create --assignee-object-id "$PRINCIPAL" --assignee-principal-type ServicePrincipal \
--role "Storage Blob Data Contributor" --scope "$SCOPE"
az role assignment create --assignee-object-id "$PRINCIPAL" --assignee-principal-type ServicePrincipal \
--role "Storage Blob Delegator" --scope "$SCOPE"
echo "Storage account: $STORAGE"
5. Connect to the server
This is where you paste the Skysize install command.
- Console
- Command line
From a terminal on your computer, with the key you downloaded:
ssh -i skysize-odoo_key.pem azureuser@YOUR_PUBLIC_IP
From the same Cloud Shell, which holds the SSH key:
ssh azureuser@YOUR_PUBLIC_IP
6. Set the backup target
Once your project exists, open its Settings → Backup Target, click Add Target, and fill in:
| Field | Value |
|---|---|
| Type | Azure Blob Storage |
| Storage account | Your storage account's name |
| Container | backups |
| Prefix | The project name |
| Authentication | Managed identity |
Click Test to check it from your server. New roles can take a few minutes to apply, so try again if the first test fails.
Sending email from Odoo
Azure blocks outgoing port 25 on most subscription types. Use an authenticated SMTP relay on port 587. See Configure Outgoing Email.
Connect the server to Skysize
Your server is ready. Follow Set Up Your Own Server, starting at the step that registers the server. In short: register it in the dashboard, connect to it over SSH, and paste the install command. The status changes to Online within a minute of the installer finishing.
Once your first project runs, add your domain.
If something goes wrong
The dashboard says ports 80 and 443 are not reachable. Check the firewall rules above, and that the public IP in the server's settings is the one you noted. Then click Check again.
The server stays Offline. The server connects out to Skysize, so no inbound rule fixes this. Run these on the server:
sudo systemctl status skysize-agent
sudo journalctl -u skysize-agent -n 50
nc -zv cp.skysize.io 50051
If the installer did not finish, or the join token was already used, use Regenerate join token on the server's page and run the install command again.
Still stuck? Open Support in the dashboard and include the output of those commands.