Zero-trust agent bridge
Run your clients' Odoo servers with AI — without handing anyone root SSH.
Devnix Copilot diagnoses, updates and repairs Odoo ERP servers through an outbound agent tunnel. Port 22 stays closed, 8069 stays private, and every destructive action is stopped by a permission engine written in code — not in a prompt.
- No inbound SSH
- No exposed 8069
- AES-256 credential vault
- Every action audited
$ curl -sSL https://odoo.devnix-solutions.com/install.sh | bash -s -- --token=YOUR_TOKEN
[devnix] Installing dependencies
[devnix] Creating the agent user
[devnix] Fetching agent 1.0.0
[devnix] Enrolling with odoo.devnix-solutions.com
[devnix] Detected Odoo 17.0 (community) · 3 databases
[devnix] Writing the sudo policy — 4 command aliases, no root shell
[devnix] Agent is running.
[devnix] Local UI: http://10.0.4.19:8050 (same view, served locally)
$
One line, run once, as root. The agent opens a single outbound WSS connection and registers the server. Nothing listens on the public internet — including the local dashboard on :8050.
Connect one cloud account per workspace
Link the provider you already bill through and Devnix can provision new Odoo hosts or adopt existing ones. Keys are stored AES-256 encrypted and are used only for the calls you authorise — one account per workspace, so “which credentials created this machine” always has exactly one answer.
- Live
Hetzner Cloud
Provision CX/CPX servers, attach volumes, read snapshots.
- Live
DigitalOcean
Link Droplets, read metrics, take snapshots before an update.
- Live
OVHcloud
Connect VPS and bare-metal, read billing and instance state.
- Live
Amazon Web Services
Attach EC2 instances via IAM role, read CloudWatch health.
Servers you already own need no provider at all — run the installer and they enrol themselves.
Built for agencies who are responsible for servers they don't own
- curl -sSL … | bash
Zero-trust CLI bridge
The agent dials out over WSS and holds the connection open. No inbound SSH, no firewall exception, no port 8069 on the public internet. Revoking a server is one click and the tunnel dies within a token lifetime.
- rbac.evaluate()
Granular RBAC, enforced in code
Twenty-six capabilities, three preset roles, per-member overrides and per-server scoping. The engine runs after the model and before execution — no prompt can widen it, because it never reads one.
- ws://…/workspace
Synced web and local interface
The dashboard and the server's own :8050 port are the same build subscribed to the same event stream. Confirm a restart in one and it appears in the other. When the platform is unreachable, the local console degrades to read-only diagnostics.
- health.check
Automated Odoo health checks
Service state, worker count, DB connectivity, disk and swap pressure, and the longest-running queries — on a heartbeat, not on a page refresh. Degraded servers surface before your client notices.
- requires_confirmation
Destructive actions are code-blocked
Drop a database, uninstall a module, reboot a host: each needs the capability, a human confirmation of the exact preview text, and — if the workspace requires it — a second factor. Typing the database name is checked server-side.
- AES-256-GCM
Encrypted Odoo credential vault
Master password, admin login and cloud API keys are sealed with AES-256-GCM and bound to their own column, so a value lifted into another field simply fails to decrypt. No endpoint returns them.
The model proposes. The permission engine decides.
Pick a role and ask for something dangerous. The refusal you see is computed by the same rules the server runs — a deterministic check that never reads the conversation, so no phrasing, jailbreak or injected log line can talk its way past it.
Signed in as
Grants
- Read Odoo & system logs
- Check server and Odoo health
- Generate reports over Odoo data
- List databases
Pick a question below to see what Reporter is allowed to do.
Try asking