didi-website-erp-crm/erp_crm/CONFIGURATION.md

Configurare ERP/CRM DiDi

Variabile de mediu, credentiale, integrari externe.

Fisier .env

Localizat la ~/erp_crm/.env. NU se commiteaza in git.

# MariaDB
MYSQL_ROOT_PASSWORD=<schimba-ma>
DB_PASSWORD=<schimba-ma>

# ERPNext
ERPNEXT_VERSION=v15
FRAPPE_VERSION=v15
SITE_NAME=didi-erp
ADMIN_PASSWORD=<schimba-ma>

# Redis (intern, container DNS)
REDIS_CACHE=redis-cache:6379
REDIS_QUEUE=redis-queue:6379
REDIS_SOCKETIO=redis-queue:6379

# Network
ERPNEXT_PORT=8080

Variabile critice de schimbat la productie

Variabila	De ce	Recomandare
MYSQL_ROOT_PASSWORD	Acces total la DB	32+ caractere random
ADMIN_PASSWORD	Login ERPNext Administrator	Min 12 caractere, schimbare la prima logare
DB_PASSWORD	Conexiune Frappe la DB	Generat random la bench new-site

Genereaza parole:

openssl rand -base64 24
# sau
pwgen -s 32 1

Configurare in DB (post-install)

Anumite valori sunt setate doar in DB, nu in .env.

Global Defaults

Camp	Valoare implicita	Unde se schimba
default_company	TOP CLOSSERS SRL	UI: Setup > Global Defaults
default_currency	RON	UI: Setup > Global Defaults
country	Romania	UI: Setup > Global Defaults

System Settings

Camp	Valoare implicita
time_zone	Europe/Bucharest
language	ro
setup_complete	1
host_name	http://didi-erpnext:8080
country	Romania

Website Settings

Camp	Valoare
home_page	login (sau pagina ce vrei)
disable_signup	1 (sign-up doar prin Stripe checkout)

Company config

Company-ul TOP CLOSSERS SRL are urmatoarele conturi default (din planul de conturi RO):

Setting	Cont
default_receivable_account	Clienti - facturi de intocmit - TC
default_income_account	704 - Venituri din servicii prestate - TC
default_cash_account	Casa in lei - TC
default_bank_account	Conturi la banci in lei - TC
round_off_account	Round Off - TC
cost_center	Main - TC

Tax templates

Template	Cota	Cont colectata
TVA 21%	21%	4427 - 4427 - TVA colectata - TC

TVA 21% e cota standard RO de la 01.08.2025. Pentru cote reduse (5%, 9%), se creeaza template-uri suplimentare.

Custom Fields

Adaugate de scripts/setup/02-doctypes.py:

Customer

• didi_user_id (Data) - UUID Keycloak, link la userul DiDi
• iam_role (Data) - free_tier / paid_tier / enterprise_tier
• active_plan (Data) - cheia planului curent (paid-monthly, etc.)
• plan_activation_date (Date) - data activarii

Lead

• source_form (Data) - formularul de origine (contact, demo, etc.)
• page_origin (Data) - pagina de origine
• utm_source, utm_medium, utm_campaign (Data)

Sales Invoice

• analysis_consumed (Check) - daca analiza din factura a fost folosita
• analysis_session_id (Data) - ID-ul sesiunii de analiza in DiDi

Payment Log

• stripe_session_id (Data, indexed) - ID Stripe Checkout Session

Custom DocTypes (didi_custom)

DocType	Scop
Analysis Report	Raport rezultate analiza cu PDF atasat
Payment Log	Log evenimente webhook Stripe
Service Agreement	Acord servicii la activarea unui plan
Website Content	CMS pentru paginile publice (homepage, services, etc.)

Integrari externe

SendGrid (email tranzactional)

Setting	Valoare
Email Account	DiDi Outgoing
SMTP Server	smtp.sendgrid.net:587
TLS	DA
Username (login_id)	apikey (literal)
Password	API key SendGrid (SG.xxxxxxxx...)
Default outgoing	DA
Send notifications	DA
From	office@clossers.com (Sender Identity verificat)

API key se genereaza din: SendGrid > Settings > API Keys > Create

Sender Identity se verifica din: SendGrid > Settings > Sender Authentication > Verify Single Sender (sau Domain Authentication pentru deliverability mai buna).

Stripe (plati)

ERPNext nu se conecteaza direct la Stripe. Toate platile pleaca via website-ul Next.js care:

1. Creeaza Stripe Checkout Session
2. Stripe trimite webhook la /api/webhooks/stripe
3. Website apeleaza ERPNext API pentru a crea Sales Invoice + Payment Entry + Payment Log

Variabilele Stripe sunt in ~/website/.env.production, nu aici.

Keycloak (autentificare)

ERPNext NU foloseste Keycloak direct - se logheaza doar admin/Administrator local. Userii finali (clientii) se logheaza prin website via Keycloak, iar website-ul ii referenctiaza in ERPNext prin Customer.didi_user_id.

API tokens pentru integrare externa (website -> ERPNext)

User dedicat: Administrator (sau cream website_api@didi.local cu rol Website Integration).

Token-ul de API key + secret se genereaza din: ERPNext > Settings > User > [user] > API Access > Generate Keys

Format header pentru request:

Authorization: token <api_key>:<api_secret>

SECURITATE — token-urile

Token-urile NU se mai pun in acest fisier. Sunt stocate doar in .env (gitignored):

# In ~/erp_crm/.env si ~/website/.env.production
ERPNEXT_API_KEY=<api_key_generat>
ERPNEXT_API_SECRET=<api_secret_generat>

Recomandare puternica: NU folosi userul Administrator ca service account pentru website. Creeaza un user dedicat:

# 1. Creeaza userul website_api@didi.local cu rol "Website Integration"
docker exec didi-erpnext bench --site didi-erp add-user \
  website_api@didi.local --first-name "Website" --last-name "API" --send-welcome-email 0

# 2. Asigneaza rol minim necesar (in UI: Settings > User > website_api@didi.local > Roles)
#    Roles recomandate: "Website Manager", "Sales User", "Accounts User"
#    NU asigna "System Manager" (echivalentul de admin)

# 3. Genereaza key+secret pentru noul user
docker exec didi-erpnext bash -c '
cd /home/frappe/frappe-bench && \
bench --site didi-erp execute frappe.core.doctype.user.user.generate_keys \
  --args "[\"website_api@didi.local\"]"
'

# 4. Output: copiaza api_key:api_secret in .env (NU comita in repo)

Pentru rotatie (Administrator sau service account):

docker exec didi-erpnext bash -c '
cd /home/frappe/frappe-bench && \
bench --site didi-erp execute frappe.core.doctype.user.user.generate_keys \
  --args "[\"<user_email>\"]"
'

ATENTIE: Generarea unei chei noi INVALIDEAZA cheile vechi. Actualizeaza imediat .env in toate locatiile (website, erp_crm, agent-v3 daca aplicabil).

Porturi expuse

Port host	Container	Scop
8080	didi-erpnext:8080	Web UI + API
3307	didi-mariadb:3306	DB (pentru debug, nu expune la prod)

Pentru productie, expune doar 8080 via reverse proxy (nginx/Caddy) cu HTTPS.

Workspace-uri custom

Configurate de scripts/setup/06-sidebar.py. Active (vizibile):

Workspace	Continut
Home	Welcome page Frappe
Facturi	Sales Invoice list + shortcut Create
Clienti	Customer list
CRM	Lead, Opportunity, pipeline Kanban
Servicii	Item list (DIDI-*)
Plati	Payment Entry + Payment Log
Contabilitate	Account, Journal Entry, GL Entry
Financial Reports	Trial Balance, P&L, Balance Sheet, etc.
Website CMS	Website Content list

Ascunse (standard ERPNext nefolosit): Selling, Buying, Stock, Assets, Quality, Projects, Support, Manufacturing.

Notificari email

Configurate de scripts/setup/08-email.py:

Notification	Trigger	Receiver
DiDi - Factura Emisa	Sales Invoice Submit	customer.email_id (cu PDF atasat)
DiDi - Plata Confirmata	Payment Log New	customer.email_id
DiDi - Expirare Abonament	Subscription, 7 zile inainte	customer.email_id

Limba

Frappe e configurat in ro (Romana). Traduceri suplimentare in scripts/setup/05-translations.py (~146 termeni custom DiDi).

Schimbare limba per user: User > Language.