The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →You can self-host OroCRM on a Linux VPS with either the release’s Docker Compose stack or a native Nginx and PHP-FPM installation. For a small, single-server deployment, Oro’s current documentation describes a starting point of 2 CPU cores, 2 GB of RAM, and fast SSD storage. That is a floor, not a guarantee of comfortable performance: active users, imports, integrations, database size, and Enterprise search or queue services all increase the requirement.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The reliable path is to select a supported Linux distribution, pin every dependency to the exact Oro release, put PostgreSQL and background workers under process supervision, point DNS at the VPS, and enable trusted HTTPS before making the CRM public. Docker Compose gives repeatable service definitions; native Nginx/PHP-FPM gives you more direct control over system services and filesystem permissions.
As an Amazon Associate I earn from qualifying purchases.
Choose the deployment shape before renting the VPS
Oro lists RedHat, Ubuntu, Debian, and Oracle Linux as production-ready Linux choices. Use the distribution supported by the exact Oro release you intend to install, rather than selecting an operating system because an older tutorial used it. Apache and Nginx are both compatible; the examples below use Nginx because it is a common reverse proxy for PHP-FPM.
Starting resources and when to scale
Oro’s “typical setup” baseline is a single server with at least 2 CPU cores, 2 GB of RAM, and a fast drive, with SSD recommended. Treat this as the smallest sensible starting point for a lightly used installation. It does not account for large imports, many concurrent users, scheduled jobs, integrations, or additional Enterprise services.
| Resource | Documented starting point | What changes the decision |
|---|---|---|
| CPU | 2 cores minimum for a typical single-server setup | Concurrent users, asset compilation, imports, queue workers, and search indexing need additional headroom. |
| Memory | 2 GB minimum for the typical setup | PHP workers, PostgreSQL, Elasticsearch, RabbitMQ, Redis, and build processes can make this insufficient. |
| Storage | Fast disk; SSD recommended | Database growth, uploaded files, logs, backups, and search indexes require capacity and sustained I/O. |
| Placement | One server is possible | Move PostgreSQL, search, or queue services to separate hosts when availability, load, or recovery objectives require it. |
Check the provider’s SSD IOPS, backup retention, network egress policy, and resize options—not just its advertised core and RAM count. A plan that can be enlarged without rebuilding the server is useful when imports or integrations outgrow the baseline.
Community and Enterprise service footprints
The edition changes what must run beside the application. Community’s default Compose setup includes PostgreSQL and MailCatcher. Enterprise adds Elasticsearch, RabbitMQ, Redis, and MailCatcher to its Compose-oriented service set. The general requirements also list Redis as an optional cache, so do not assume every Redis use is an Enterprise-only feature.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Edition or component | Services called out in the current setup material | Deployment implication |
|---|---|---|
| Community | PostgreSQL and MailCatcher by default | A small single host can run the application and database if it has enough memory and storage. |
| Enterprise | PostgreSQL plus Elasticsearch, RabbitMQ, Redis, and MailCatcher in the Compose service footprint | Allow substantially more memory and disk I/O, or plan separate database, search, and queue hosts. |
| Optional general services | Redis, Tidy, pngquant, jpegoptim, and Gotenberg | Add only the services required by your features; each creates another update, monitoring, and backup responsibility. |
Confirm your edition entitlement and the services required by the target release before you commit to a VPS size. Public setup pages do not establish a universal licensing entitlement for every deployment.
Pin the exact Oro release and its prerequisites
Do not mix package versions from a legacy Oro guide with a current release. Oro marks its older Community Edition guide as no longer maintained. Start from the documentation and Compose file shipped for the release you selected, then install only the versions that release specifies.
Core versions
| Component | Current requirement | Important qualification |
|---|---|---|
| PHP | 8.5 or newer | The command-line PHP and the PHP-FPM version used by the web server must match. Set date.timezone, disable detect_unicode, and provide a memory_limit of at least 1 GB. |
| PostgreSQL | 17.6 or newer | Enterprise PostgreSQL/EnterpriseDB 18.3 or newer is supported for Enterprise edition. |
| Node.js | 24.11.0 or newer, but below 25 | This range is used for JavaScript and SCSS asset work; do not silently install the next major version. |
| PNPM | 10.7.0 or newer | Use a version compatible with the selected Oro release when building assets. |
| Web server | Current Nginx or Apache mainline/stable | Terminate requests at the web server and pass PHP requests to the matching PHP-FPM service. |
| Process controller | Supervisor or an alternative | Workers and scheduled/background processes must be restarted and monitored rather than left in an SSH session. |
Required PHP extensions
Install the extensions named by Oro before running the installer: ctype, curl, fileinfo, gd, intl, json, mbstring, sodium, openssl, pgsql, pcre, simplexml, tokenizer, xml, zip, imap, soap, bcmath, and ldap. MongoDB 2.0 or newer is optional when you use OroGridFSConfigBundle.
Verify both contexts independently: run the PHP module check from the shell and inspect the PHP-FPM configuration used by Nginx. It is common to install an extension for the CLI binary while the web worker still runs a different PHP version.
Optional helpers
- Redis 8.4 or newer: can improve caching and is part of the Enterprise Compose service footprint.
- Tidy: supports HTML-to-text conversion.
- pngquant and jpegoptim: optimize stored images.
- Gotenberg 8.5.x or newer: supports PDF generation.
Prepare the VPS safely
Perform the following preparation as a separate administrative account, not as the application’s runtime user. Commands differ between distributions; the sequence is what matters.
- Create a non-root administrator with sudo access. Use a named account for installation and updates, protect it with SSH keys, and disable routine root logins once you have confirmed that sudo access works.
- Apply operating-system security updates. Reboot when the kernel or other critical services require it, then confirm that SSH still accepts the administrative account.
- Configure a default-deny firewall. Permit SSH from your administration network where practical, and allow only the public HTTP and HTTPS ports needed for certificate issuance and web traffic. Do not expose PostgreSQL, RabbitMQ, Elasticsearch, or Redis directly to the internet.
- Attach or select SSD-backed storage. Reserve room for PostgreSQL data, uploaded files, logs, temporary asset builds, and at least one local backup staging area. Keep provider snapshots separate from application-consistent database backups.
- Set the server clock and timezone policy. Oro requires PHP’s
date.timezone; use the same intentional timezone in PHP, the operating system, and scheduled-job documentation. - Record the release and secrets plan. Keep the exact Oro version, package-lock files, Compose file, database credentials, encryption secrets, and TLS renewal method in a protected operations record.
Create DNS early, even if the first installation is private. Using the eventual hostname avoids rebuilding application URLs and cookie settings after installation.
Deploy with the release’s Docker Compose workflow
Compose is the most reproducible choice when the target release supplies a maintained file. It can define PostgreSQL and, depending on edition, Elasticsearch, RabbitMQ, Redis, and MailCatcher alongside the application. Treat that file as part of the release: do not substitute a Compose file copied from an older Oro version.
Bring up the services
- Obtain the application source and the Compose files for the exact release and edition. Keep them in a dedicated directory owned by the administrative account.
- Review environment values and persistent volumes. Confirm database passwords, application secrets, hostnames, exposed ports, and where PostgreSQL data and uploaded files will persist. Bind only the ports that must be reachable from outside the Docker network.
- Start the defined services:
docker compose up -d. Check container health and logs before attempting the installer. - Install PHP dependencies inside the documented application environment:
symfony composer install -n. Use the Symfony tooling and container context specified by the release rather than running Composer against an unrelated host PHP binary. - Run the Oro installer with real values. Oro’s documented pattern is:
symfony console oro:install -vvv --sample-data=y --application-url=https://127.0.0.1:8000 --user-name=admin [email protected] --user-firstname=John --user-lastname=Doe --user-password=admin --organization-name=Oro --timeout=0 --env=prod -nReplace the loopback URL, account details, organization name, and sample-data choice. Never use the example password; generate a unique administrator secret and store it in your password manager. If you do not want demonstration records, change the sample-data option according to the release’s installer syntax.
Do not publish the development web server
The Docker and Symfony instructions use Symfony Local Web Server as a convenient development path. Oro explicitly says that server is not intended for production. In production, place Nginx or Apache in front of PHP-FPM, expose only the web server’s HTTPS endpoint, and keep Docker’s internal services on private networks.
Make Compose persistent and recoverable
- Use named volumes or host paths for PostgreSQL data and Oro uploads; ephemeral containers must never be the only copy.
- Back up the database and uploaded files independently so a database restore does not depend on a container still existing.
- Pin image tags or digests where the release permits it, and test an upgrade in a clone before changing production containers.
- Capture container logs centrally or rotate them so a busy worker cannot fill the VPS disk.
Build a native Nginx and PHP-FPM installation
A native stack is appropriate when your team already operates Linux services directly or needs precise control over TLS, permissions, monitoring, and upgrade sequencing. The shape of Oro’s older native guide is still useful, but its CentOS, PHP, and database versions are obsolete; substitute the current requirements above.
Install and align the runtime
- Install the supported PHP 8.5-or-newer release, PHP-FPM, the complete extension list, Composer tooling required by the release, Node.js 24.11.0 through 24.x, and PNPM 10.7.0 or newer.
- Configure the CLI binary and the FPM pool to use the same PHP version. Confirm with the shell’s
php --versionand the FPM service configuration rather than relying on a package name. - Set
date.timezone, disabledetect_unicode, and setmemory_limit = 1Gor higher in the configuration actually loaded by FPM. Restart FPM after changing it. - Install PostgreSQL 17.6 or newer, create a dedicated database and role with a strong password, and restrict database listening and firewall access to the application network.
- Install Nginx and configure it to serve Oro’s public document root, not the project’s private source directories.
Nginx request handling
Your server block should map the real hostname to the application’s public directory, route non-file requests to the front controller, pass only the intended front-controller script to PHP-FPM, and reject arbitrary PHP files elsewhere in the tree. The PHP-FPM socket path is distribution-specific, so use the socket belonging to the same PHP version as the CLI.
server {
listen 80;
server_name crm.example.com;
root /srv/orocrm/public;
location / {
try_files $uri /index.php$is_args$args;
}
location ~ ^/index.php(/|$) {
fastcgi_pass unix:/run/php/php8.5-fpm.sock;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
location ~ .php$ {
return 404;
}
}The paths and socket name above are an example layout, not a universal package default. Replace them with your release directory and the actual FPM socket, then validate the configuration before reloading Nginx.
Build assets and run background work
Use the release’s Node.js and PNPM versions to install and compile JavaScript and SCSS assets. Do not compile with Node 25 merely because it is newer; the documented range ends before that major version. Run workers and scheduled processes under Supervisor or an equivalent controller with automatic restart, bounded logs, and a dedicated runtime account.
Configure PostgreSQL, queues, search, and mail safely
PostgreSQL is the required database service. Keep its data directory on SSD, monitor free space and connection saturation, and include both database dumps and uploaded files in your recovery plan. A database dump without the CRM’s uploaded documents is an incomplete restore.
Enterprise search and messaging
Enterprise’s service footprint may include Elasticsearch and RabbitMQ in addition to PostgreSQL. Provision and secure those services before enabling features that depend on them. Bind them to private interfaces, use authentication where supported, and monitor queue depth, search-index health, and disk usage. Redis can provide cache support and is included in the Enterprise Compose services.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Mail delivery
MailCatcher appears in the documented Compose setups and is useful for catching messages during development or controlled testing. A public production CRM needs a deliberate outbound-mail configuration and a monitored mail relay; do not assume that a local MailCatcher container delivers mail to customers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Point DNS at the VPS and enforce HTTPS
- Create an A record for the CRM hostname pointing to the VPS IPv4 address. Add an AAAA record only if the server is correctly configured for IPv6 and the firewall covers it.
- Wait for the record to resolve from outside the VPS. Check both the hostname and any administrative subdomain you intend to use.
- Set the application URL to the real HTTPS hostname during installation or in the release’s environment configuration. Do not leave the example loopback URL.
- Install a trusted certificate for every public hostname and configure automatic renewal. Keep the private key readable only by the services that need it.
- Redirect HTTP to HTTPS and ensure proxy headers preserve the original scheme and host. Test login, redirects, cookies, API callbacks, and generated links after the change.
- Recheck firewall exposure. The internet should see the web listener, not the database, cache, queue, or search ports.
Oro’s Community environment guidance strongly recommends HTTPS for production public websites and requires DNS to point the domain at the server for remote access. Apply that requirement before inviting users or importing CRM data.
Separate administrative and runtime access
Use the sudo-enabled account for operating-system updates, dependency installation, migrations, and controlled deployments. Run Nginx, PHP-FPM, workers, and scheduled jobs as a restricted runtime account that cannot modify the whole VPS. Make the project files and writable directories explicit instead of granting broad ownership to every process.
- Keep environment files, database credentials, encryption keys, and TLS private keys outside public document roots.
- Grant write access only to directories Oro must use for cache, logs, uploads, and generated files.
- Do not run Composer, database migrations, or release updates as root.
- Record which account owns each deployment artifact so a later update does not create root-owned files that the runtime user cannot read.
Backups, monitoring, and upgrades
Back up what a restore actually needs
Schedule PostgreSQL backups, copy uploaded files, and protect both sets with encryption and access controls. Keep at least one copy outside the VPS. Test restoring to an isolated server before a migration or major upgrade; a backup that has never been restored is only an assumption.
Free tools Windows power users keep installed
One-click scans. No signup required.
Watch the failure signals
- Disk free space and SSD I/O latency, especially during imports and search indexing.
- RAM pressure and swap activity when PHP workers or Enterprise services are busy.
- PostgreSQL connections, slow queries, and failed authentication attempts.
- Supervisor restarts, queue depth, scheduled-job failures, and growing application logs.
- TLS certificate expiry and DNS changes.
Upgrade deliberately
Read the target release’s upgrade instructions, compare its PHP, PostgreSQL, Node.js, PNPM, and service versions, and rehearse the process on a copy. Preserve the previous application release and a verified database backup until the new version has passed login, permissions, email, import, search, and background-job checks.
Docker Compose or native Nginx/PHP-FPM?
| Decision factor | Docker Compose | Native installation |
|---|---|---|
| Reproducibility | Service definitions and versions are captured in the release’s Compose files. | You must document package repositories, service units, PHP modules, and configuration yourself. |
| Upgrade control | Image and volume changes can be staged as a set, but a changed image may alter several services at once. | Each OS package and daemon can be upgraded independently, with more manual coordination. |
| Operational familiarity | Best for teams comfortable with Compose networks, volumes, image logs, and container recovery. | Best for teams already operating Nginx, PHP-FPM, PostgreSQL, and Supervisor directly. |
| Backup strategy | Back up named volumes and application uploads; containers themselves are disposable. | Back up service data directories or logical exports plus the application’s uploaded files. |
| Isolation | Private container networks separate database, queue, search, and application services by default. | Firewall rules, bind addresses, Unix users, and systemd/Supervisor policies provide the isolation. |
Choose Compose for repeatability and a defined multi-service stack. Choose native deployment when your operations team needs host-level observability or already has standardized Nginx, PHP-FPM, PostgreSQL, and backup tooling. Neither option removes the need for release pinning, HTTPS, least privilege, and tested restores.
Quick Recap
Troubleshoot the problems that stop first deployments
| Symptom | Likely cause | Fix |
|---|---|---|
| The installer reports missing PHP functions or modules. | The required extension is absent, or CLI PHP differs from FPM PHP. | Compare the CLI version with the FPM pool, install the complete extension list, restart FPM, and rerun the checks. |
| The application works from localhost but not from the domain. | DNS, firewall, Nginx server name, or application URL still points to a loopback address. | Verify A/AAAA resolution, open only HTTP/HTTPS, set the real hostname, and reload the web server. |
| Requests fail with gateway errors. | Nginx is pointing at the wrong PHP-FPM socket or the FPM service is stopped. | Check the socket path and service status, then inspect Nginx and FPM logs. |
| Background jobs stop after disconnecting SSH. | Workers were started interactively instead of under a process controller. | Configure Supervisor or an equivalent manager with restart policies and log limits. |
| Search, queues, or cache features fail in Enterprise. | Elasticsearch, RabbitMQ, or Redis is missing, unreachable, or undersized. | Start the release-defined services, keep them on private networks, verify credentials and health, and monitor memory and disk. |
| Uploads or cache writes return permission errors. | Deployment commands created root-owned files or the runtime account lacks access to required writable directories. | Correct ownership and narrowly scoped permissions; do not make the entire project world-writable. |
| The VPS fills during an import. | Insufficient SSD capacity, retained logs, temporary build files, or search indexes. | Measure each data category, rotate logs, remove safe temporary files, expand storage, and reassess the one-host design. |
Production readiness checklist
- Supported Linux distribution selected for the exact Oro release.
- VPS sized above the 2-core, 2-GB starting point when users, integrations, imports, or Enterprise services require it.
- SSD storage sized for PostgreSQL, uploads, logs, indexes, and backups.
- PHP 8.5 or newer with the required extensions, matching CLI/FPM versions, correct timezone, and at least 1 GB memory limit.
- PostgreSQL 17.6 or newer, or the supported Enterprise PostgreSQL/EnterpriseDB version.
- Node.js 24.11.0 through 24.x and PNPM 10.7.0 or newer for asset builds.
- Nginx or Apache serving the public document root, with the development Symfony server excluded from production.
- Supervisor or another process controller managing workers and scheduled jobs.
- Enterprise Elasticsearch, RabbitMQ, and Redis provisioned when the selected features and edition require them.
- DNS A/AAAA records verified, trusted TLS installed, and HTTP redirected to HTTPS.
- Non-root administrative and restricted runtime users separated.
- Secrets protected, database and uploaded-file backups encrypted, and a restore test completed.
- Release-specific upgrade and licensing details recorded before importing live CRM data.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
