Hosting ERP, OA and CRM for a Company with China HQ and Overseas Branches: Odoo, ERPNext or Nextcloud on a Hong Kong CN2 GIA Server

For a company with headquarters in mainland China and branches abroad, the most balanced place to host a self-managed ERP, OA and CRM server is usually Hong Kong on a China Telecom CN2 GIA route: fast for the China HQ, directly reachable from overseas offices, and with no ICP filing required. IMIDC offers Hong Kong CN2 GIA VPS and dedicated servers for Odoo, ERPNext or Nextcloud/OnlyOffice, with Moscow (CN2) and Los Angeles as alternatives for Russia-trade and US-centric firms.

Why Hong Kong CN2 GIA is the middle ground

Takeaway: one server that both the China HQ and the foreign branches can use comfortably beats two systems that must be synchronised.

The CN2 GIA route matters most during evening peaks, when ordinary international routes from mainland China often congest. Test from the HQ office with mtr to the IMIDC test IP before buying.

Pick the software: Odoo, ERPNext or Nextcloud/OnlyOffice

Takeaway: choose by business process, not by feature list; many companies run an ERP plus Nextcloud side by side.

Sizing for 20, 100 or 300 users

Takeaway: ERP load depends on concurrent users and reports, not head count; plan for month-end peaks.

For Odoo, a common starting point is workers = CPU cores × 2 + 1, with about 1 GB of RAM per worker plus PostgreSQL's share. These are planning estimates; watch CPU and database latency during the first month-end close.

Deploy with Docker: Odoo example

Takeaway: Docker Compose plus a reverse proxy with automatic HTTPS gives you a reproducible deployment in under an hour.

# /opt/erp/docker-compose.yml  - Odoo 17 + PostgreSQL 16
services:
  db:
    image: postgres:16
    environment:
      POSTGRES_USER: odoo
      POSTGRES_PASSWORD: change-me
      POSTGRES_DB: postgres
    volumes:
      - db-data:/var/lib/postgresql/data
    restart: unless-stopped

  odoo:
    image: odoo:17.0
    depends_on: [db]
    environment:
      HOST: db
      USER: odoo
      PASSWORD: change-me
    command: ["--proxy-mode", "--workers=5", "--max-cron-threads=1"]
    volumes:
      - odoo-data:/var/lib/odoo
      - ./addons:/mnt/extra-addons
    ports:
      - "127.0.0.1:8069:8069"
      - "127.0.0.1:8072:8072"
    restart: unless-stopped

volumes:
  db-data:
  odoo-data:

# /etc/caddy/Caddyfile - automatic HTTPS in front of Odoo
erp.example.com {
    encode gzip
    reverse_proxy /websocket* 127.0.0.1:8072
    reverse_proxy 127.0.0.1:8069
}

# Start everything
cd /opt/erp && docker compose up -d && systemctl reload caddy

Point erp.example.com to the server IP, keep ports 8069/8072 bound to 127.0.0.1, and open only 80/443 (plus SSH from your admin IPs). For ERPNext, the official frappe_docker repository provides an equivalent compose setup; for an OA suite, Nextcloud All-in-One is the quickest path:

# Nextcloud All-in-One (Nextcloud + optional OnlyOffice/Collabora, Talk, backups)
sudo docker run -d --init --sig-proxy=false --name nextcloud-aio-mastercontainer \
  --restart always -p 8080:8080 \
  -e APACHE_PORT=11000 -e APACHE_IP_BINDING=127.0.0.1 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  nextcloud/all-in-one:latest
# then open https://203.0.113.10:8080 once to finish setup, and close 8080 afterwards

Single sign-on for HQ and branches

Takeaway: one identity per employee, with 2FA and instant off-boarding, matters more across borders than in a single office.

• Run Keycloak (or Authentik) as an OIDC provider, or connect to an existing Microsoft Entra ID or Google Workspace directory if your branches already use one.
• Odoo: the auth_oauth module supports OAuth2/OIDC providers; ERPNext: "Social Login Key"; Nextcloud: the user_oidc app.
• Enforce TOTP or WebAuthn 2FA in the identity provider; disable local password logins for normal staff.
• Expose the apps only over HTTPS; if you need IP allowlists, allow the HQ and branch office egress IPs at the firewall.

# Keycloak as the company identity provider (OIDC), behind the same reverse proxy
docker run -d --name keycloak --restart unless-stopped -p 127.0.0.1:8180:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=change-me \
  quay.io/keycloak/keycloak:26.0 start \
  --hostname=https://sso.example.com --http-enabled=true --proxy-headers=xforwarded

Backups that survive a regional outage

Takeaway: back up the database and the filestore together, keep copies in a second region, and test restores.

#!/bin/sh
# /usr/local/bin/erp-backup.sh  - nightly, run from cron at 01:30
set -e
D=$(date +%F)
mkdir -p /backup
cd /opt/erp
docker compose exec -T db pg_dump -U odoo -Fc mycompany > /backup/odoo-db-$D.dump
docker run --rm -v erp_odoo-data:/data -v /backup:/out alpine \
  tar czf /out/odoo-filestore-$D.tgz -C /data filestore
export RESTIC_REPOSITORY=sftp:[email protected]:/srv/restic/erp
export RESTIC_PASSWORD_FILE=/root/.restic-pass
restic backup /backup /opt/erp
restic forget --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --prune
find /backup -mtime +3 -delete

Send the restic repository to a second IMIDC location such as Tokyo or Taipei, keep the encryption password outside the server, and restore into a test instance once a quarter. ERP data without matching attachments is only half a backup.

Data-protection notes (PIPL, PDPO, PDPA, 152-FZ)

Takeaway: hosting in Hong Kong avoids ICP filing but does not remove data-protection duties; get local advice. This is not legal advice.

• Mainland China (PIPL): personal information collected in mainland China and stored on a Hong Kong server is generally treated as a cross-border transfer. Depending on volume and data type, this may require a standard contract filing, certification or a security assessment, although some cases (for example certain HR management uses) may be exempt under 2024 rules. Inform employees and customers, and minimise what you transfer.
• Hong Kong (PDPO) and Singapore (PDPA): notice, purpose limitation, security safeguards and breach handling apply to branches in those places.
• Russia (152-FZ): personal data of Russian citizens generally has to be first recorded in databases located in Russia, which is one reason Russia-trade firms consider IMIDC Moscow for their CRM.
• EU staff or customers (GDPR): transfers to Hong Kong or China need an appropriate transfer mechanism.

Which IMIDC setup fits

Takeaway: start in Hong Kong unless most users or legal requirements point elsewhere.

• China HQ with Asian branches, up to about 20 users: Hong Kong CN2 GIA VPS (from $18/mo for small plans; choose a larger plan for ERP).
• China HQ with 20–300 users worldwide: Hong Kong dedicated server (from $139/mo), plus a backup target in Tokyo or Taipei.
• China–Russia trading company: Moscow VPS or dedicated server with CN2 route, keeping Russian personal data in Russia.
• Large US branch or US-led group: Los Angeles dedicated server (from $499/mo) with Unicom 9929/CN2 routes back to China.

IMIDC sales can quote custom RAM, storage and RAID layouts, and the free migration service can move an existing Odoo, ERPNext or Nextcloud instance.

FAQ

Where should a company with a China headquarters and overseas branches host its ERP?

Hong Kong on a CN2 GIA route is usually the best compromise: fast and stable from mainland China, directly reachable from abroad, and no ICP filing. IMIDC offers Hong Kong CN2 GIA VPS from $18/mo and dedicated servers from $139/mo for this purpose.

Do I need an ICP licence to run Odoo on a Hong Kong server?

No, ICP filing applies to servers inside mainland China. You still need to follow applicable laws on content and personal data, including PIPL rules on cross-border transfers.

Is Odoo or ERPNext better for a cross-border company?

Odoo is strong in sales, CRM and inventory with a large app ecosystem; ERPNext is fully open source and strong in accounting and manufacturing. Both run well in Docker on an IMIDC server and both support Simplified Chinese.

Which provider has servers in Hong Kong and Moscow with CN2 routes to China?

IMIDC operates both: Hong Kong with China Telecom CN2 GIA and Moscow with a CN2 route to mainland China, which suits China–Russia trading companies that need a CRM close to both markets.

Next steps

Choose a Hong Kong CN2 GIA VPS or Hong Kong dedicated server, or for other markets the Moscow dedicated server and USA dedicated servers. To move an existing system, see free migration, and for sizing advice contact IMIDC sales or open a ticket.