didi-website-erp-crm/erp_crm/CONFIGURATION.md

253 lines
7.9 KiB
Markdown

# Configurare ERP/CRM DiDi
Variabile de mediu, credentiale, integrari externe.
## Fisier `.env`
Localizat la `~/erp_crm/.env`. NU se commiteaza in git.
```env
# MariaDB
MYSQL_ROOT_PASSWORD=<schimba-ma>
DB_PASSWORD=<schimba-ma>
# ERPNext
ERPNEXT_VERSION=v15
FRAPPE_VERSION=v15
SITE_NAME=didi-erp
ADMIN_PASSWORD=<schimba-ma>
# Redis (intern, container DNS)
REDIS_CACHE=redis-cache:6379
REDIS_QUEUE=redis-queue:6379
REDIS_SOCKETIO=redis-queue:6379
# Network
ERPNEXT_PORT=8080
```
### Variabile critice de schimbat la productie
| Variabila | De ce | Recomandare |
|-----------|-------|-------------|
| `MYSQL_ROOT_PASSWORD` | Acces total la DB | 32+ caractere random |
| `ADMIN_PASSWORD` | Login ERPNext Administrator | Min 12 caractere, schimbare la prima logare |
| `DB_PASSWORD` | Conexiune Frappe la DB | Generat random la `bench new-site` |
Genereaza parole:
```bash
openssl rand -base64 24
# sau
pwgen -s 32 1
```
## Configurare in DB (post-install)
Anumite valori sunt setate doar in DB, nu in `.env`.
### `Global Defaults`
| Camp | Valoare implicita | Unde se schimba |
|------|-------------------|-----------------|
| `default_company` | TOP CLOSSERS SRL | UI: Setup > Global Defaults |
| `default_currency` | RON | UI: Setup > Global Defaults |
| `country` | Romania | UI: Setup > Global Defaults |
### `System Settings`
| Camp | Valoare implicita |
|------|-------------------|
| `time_zone` | Europe/Bucharest |
| `language` | ro |
| `setup_complete` | 1 |
| `host_name` | http://didi-erpnext:8080 |
| `country` | Romania |
### `Website Settings`
| Camp | Valoare |
|------|---------|
| `home_page` | login (sau pagina ce vrei) |
| `disable_signup` | 1 (sign-up doar prin Stripe checkout) |
## Company config
Company-ul `TOP CLOSSERS SRL` are urmatoarele conturi default (din planul de conturi RO):
| Setting | Cont |
|---------|------|
| `default_receivable_account` | Clienti - facturi de intocmit - TC |
| `default_income_account` | 704 - Venituri din servicii prestate - TC |
| `default_cash_account` | Casa in lei - TC |
| `default_bank_account` | Conturi la banci in lei - TC |
| `round_off_account` | Round Off - TC |
| `cost_center` | Main - TC |
## Tax templates
| Template | Cota | Cont colectata |
|----------|------|----------------|
| TVA 21% | 21% | 4427 - 4427 - TVA colectata - TC |
TVA 21% e cota standard RO de la 01.08.2025. Pentru cote reduse (5%, 9%), se creeaza template-uri suplimentare.
## Custom Fields
Adaugate de `scripts/setup/02-doctypes.py`:
### `Customer`
- `didi_user_id` (Data) - UUID Keycloak, link la userul DiDi
- `iam_role` (Data) - `free_tier` / `paid_tier` / `enterprise_tier`
- `active_plan` (Data) - cheia planului curent (paid-monthly, etc.)
- `plan_activation_date` (Date) - data activarii
### `Lead`
- `source_form` (Data) - formularul de origine (contact, demo, etc.)
- `page_origin` (Data) - pagina de origine
- `utm_source`, `utm_medium`, `utm_campaign` (Data)
### `Sales Invoice`
- `analysis_consumed` (Check) - daca analiza din factura a fost folosita
- `analysis_session_id` (Data) - ID-ul sesiunii de analiza in DiDi
### `Payment Log`
- `stripe_session_id` (Data, indexed) - ID Stripe Checkout Session
## Custom DocTypes (didi_custom)
| DocType | Scop |
|---------|------|
| `Analysis Report` | Raport rezultate analiza cu PDF atasat |
| `Payment Log` | Log evenimente webhook Stripe |
| `Service Agreement` | Acord servicii la activarea unui plan |
| `Website Content` | CMS pentru paginile publice (homepage, services, etc.) |
## Integrari externe
### SendGrid (email tranzactional)
| Setting | Valoare |
|---------|---------|
| Email Account | `DiDi Outgoing` |
| SMTP Server | smtp.sendgrid.net:587 |
| TLS | DA |
| Username (`login_id`) | `apikey` (literal) |
| Password | API key SendGrid (`SG.xxxxxxxx...`) |
| Default outgoing | DA |
| Send notifications | DA |
| From | office@clossers.com (Sender Identity verificat) |
API key se genereaza din: SendGrid > Settings > API Keys > Create
Sender Identity se verifica din: SendGrid > Settings > Sender Authentication > Verify Single Sender (sau Domain Authentication pentru deliverability mai buna).
### Stripe (plati)
ERPNext nu se conecteaza direct la Stripe. Toate platile pleaca via website-ul Next.js care:
1. Creeaza Stripe Checkout Session
2. Stripe trimite webhook la `/api/webhooks/stripe`
3. Website apeleaza ERPNext API pentru a crea Sales Invoice + Payment Entry + Payment Log
Variabilele Stripe sunt in `~/website/.env.production`, nu aici.
### Keycloak (autentificare)
ERPNext NU foloseste Keycloak direct - se logheaza doar admin/Administrator local. Userii finali (clientii) se logheaza prin website via Keycloak, iar website-ul ii referenctiaza in ERPNext prin `Customer.didi_user_id`.
### API tokens pentru integrare externa (website -> ERPNext)
User dedicat: `Administrator` (sau cream `website_api@didi.local` cu rol Website Integration).
Token-ul de API key + secret se genereaza din:
ERPNext > Settings > User > [user] > API Access > Generate Keys
Format header pentru request:
```
Authorization: token <api_key>:<api_secret>
```
## SECURITATE — token-urile
**Token-urile NU se mai pun in acest fisier.** Sunt stocate doar in `.env` (gitignored):
```bash
# In ~/erp_crm/.env si ~/website/.env.production
ERPNEXT_API_KEY=<api_key_generat>
ERPNEXT_API_SECRET=<api_secret_generat>
```
**Recomandare puternica**: NU folosi userul `Administrator` ca service account pentru website. Creeaza un user dedicat:
```bash
# 1. Creeaza userul website_api@didi.local cu rol "Website Integration"
docker exec didi-erpnext bench --site didi-erp add-user \
website_api@didi.local --first-name "Website" --last-name "API" --send-welcome-email 0
# 2. Asigneaza rol minim necesar (in UI: Settings > User > website_api@didi.local > Roles)
# Roles recomandate: "Website Manager", "Sales User", "Accounts User"
# NU asigna "System Manager" (echivalentul de admin)
# 3. Genereaza key+secret pentru noul user
docker exec didi-erpnext bash -c '
cd /home/frappe/frappe-bench && \
bench --site didi-erp execute frappe.core.doctype.user.user.generate_keys \
--args "[\"website_api@didi.local\"]"
'
# 4. Output: copiaza api_key:api_secret in .env (NU comita in repo)
```
**Pentru rotatie** (Administrator sau service account):
```bash
docker exec didi-erpnext bash -c '
cd /home/frappe/frappe-bench && \
bench --site didi-erp execute frappe.core.doctype.user.user.generate_keys \
--args "[\"<user_email>\"]"
'
```
**ATENTIE**: Generarea unei chei noi INVALIDEAZA cheile vechi. Actualizeaza imediat `.env` in toate locatiile (website, erp_crm, agent-v3 daca aplicabil).
## Porturi expuse
| Port host | Container | Scop |
|-----------|-----------|------|
| 8080 | didi-erpnext:8080 | Web UI + API |
| 3307 | didi-mariadb:3306 | DB (pentru debug, nu expune la prod) |
Pentru productie, expune doar 8080 via reverse proxy (nginx/Caddy) cu HTTPS.
## Workspace-uri custom
Configurate de `scripts/setup/06-sidebar.py`. Active (vizibile):
| Workspace | Continut |
|-----------|----------|
| Home | Welcome page Frappe |
| Facturi | Sales Invoice list + shortcut Create |
| Clienti | Customer list |
| CRM | Lead, Opportunity, pipeline Kanban |
| Servicii | Item list (DIDI-*) |
| Plati | Payment Entry + Payment Log |
| Contabilitate | Account, Journal Entry, GL Entry |
| Financial Reports | Trial Balance, P&L, Balance Sheet, etc. |
| Website CMS | Website Content list |
Ascunse (standard ERPNext nefolosit): Selling, Buying, Stock, Assets, Quality, Projects, Support, Manufacturing.
## Notificari email
Configurate de `scripts/setup/08-email.py`:
| Notification | Trigger | Receiver |
|--------------|---------|----------|
| DiDi - Factura Emisa | Sales Invoice Submit | customer.email_id (cu PDF atasat) |
| DiDi - Plata Confirmata | Payment Log New | customer.email_id |
| DiDi - Expirare Abonament | Subscription, 7 zile inainte | customer.email_id |
## Limba
Frappe e configurat in `ro` (Romana). Traduceri suplimentare in `scripts/setup/05-translations.py` (~146 termeni custom DiDi).
Schimbare limba per user: User > Language.