@r8s/odoo 0.2.0 → 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,99 @@
+export interface OdooProps {
+    /** Resource name (defaults to 'odoo') */
+    name?: string;
+    /** Kubernetes namespace (defaults to 'default') */
+    namespace?: string;
+    /** Container image tag (defaults to '18' — pin a version in production) */
+    version?: string;
+    /** Public hostname for the ERP web UI (required) */
+    host: string;
+    /**
+     * Number of replicas. Must stay at 1 — the filestore PVC is
+     * ReadWriteOnce and cannot attach to multiple pods (defaults to 1).
+     */
+    replicas?: number;
+    /**
+     * Size of the filestore PersistentVolumeClaim (defaults to '20Gi').
+     * Odoo stores attachments and binary fields here.
+     */
+    filestore?: string;
+    /**
+     * Odoo process-level worker processes, rendered into odoo.conf
+     * (defaults to 2). Rule of thumb: (CPU threads * 2) + 1, accounting
+     * for cron workers.
+     */
+    workers?: number;
+    /**
+     * Name of an existing Secret containing key `masterPassword`. Odoo
+     * requires this to manage the super-admin (`/web/database/manager`).
+     *
+     * Required unless a secrets backend (openbao/vault) is configured on
+     * the surrounding Platform — the backend then provisions the password
+     * automatically. Plaintext passwords are not supported.
+     */
+    masterPasswordSecretName?: string;
+    /** Requested resources */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+}
+/**
+ * Odoo — open-source ERP / business applications suite.
+ *
+ * @title Odoo
+ * @category Business Applications
+ *
+ * Composes:
+ * - CNPG Postgres cluster (Odoo data model) via the Database recipe
+ * - Odoo Deployment + Service + Endpoint (port 8069 — HTTP mode serves
+ *   web and websockets on the same port in this image)
+ * - odoo.conf ConfigMap mounted at /etc/odoo/odoo.conf (proxy mode,
+ *   workers, memory-derived worker limits, request recycling)
+ * - Filestore PVC for attachments and binary fields
+ * - Master password provisioned through the Platform secrets backend
+ *   (openbao / vault), or referenced from an existing Secret
+ *
+ * The main app is a raw Deployment (not WebService) because Odoo needs
+ * the filestore PVC volume-mounted at /var/lib/odoo — the WebService
+ * recipe cannot express volume mounts.
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the MASTER_PASSWORD is provisioned for you. Without a backend you
+ * must point `masterPasswordSecretName` at a pre-created Secret.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Odoo } from '@r8s/odoo'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <Odoo name="erp" host="erp.example.com" workers={4} />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Odoo } from '@r8s/odoo'
+ *
+ * export default (
+ *   <Odoo
+ *     name="erp"
+ *     host="erp.example.com"
+ *     filestore="100Gi"
+ *     masterPasswordSecretName="odoo-master-password"
+ *   />
+ * )
+ */
+export declare function Odoo(props: OdooProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAYA,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,0BAA0B;IAC1B,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,sEAAsE;IACtE,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,SAAS,kCA+OpC"}

package/dist/index.js

@@ -0,0 +1,286 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Odoo = Odoo;
+const jsx_runtime_1 = require("@r8s/core/jsx-runtime");
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+const APP_PORT = 8069;
+const HEALTH_PATH = '/web/health';
+const MEMORY_UNIT_BYTES = {
+    '': 1,
+    B: 1,
+    K: 1_000,
+    KB: 1_000,
+    M: 1_000_000,
+    MB: 1_000_000,
+    G: 1_000_000_000,
+    GB: 1_000_000_000,
+    T: 1_000_000_000_000,
+    TB: 1_000_000_000_000,
+    P: 1_000_000_000_000_000,
+    PB: 1_000_000_000_000_000,
+    E: 1_000_000_000_000_000_000,
+    EB: 1_000_000_000_000_000_000,
+    KI: 1 << 10,
+    MI: 1 << 20,
+    GI: 1 << 30,
+    TI: 2 ** 40,
+    PI: 2 ** 50,
+    EI: 2 ** 60,
+};
+/** Parse a Kubernetes memory quantity ("2Gi", "512Mi", "1G") into bytes. */
+function memoryToBytes(memory) {
+    const match = /^(\d+(?:\.\d+)?)\s*([a-zA-Z]+)?$/.exec(memory.trim());
+    if (!match) {
+        throw new Error(`Odoo: cannot parse memory quantity "${memory}" — use quantities like "2Gi" or "512Mi"`);
+    }
+    const amount = Number(match[1]);
+    const unit = (match[2] ?? '').toUpperCase();
+    const multiplier = MEMORY_UNIT_BYTES[unit];
+    if (multiplier === undefined) {
+        throw new Error(`Odoo: unsupported memory unit in "${memory}" — use B, K/Ki, M/Mi, G/Gi, T/Ti, P/Pi or E/Ei`);
+    }
+    return Math.round(amount * multiplier);
+}
+/**
+ * Odoo — open-source ERP / business applications suite.
+ *
+ * @title Odoo
+ * @category Business Applications
+ *
+ * Composes:
+ * - CNPG Postgres cluster (Odoo data model) via the Database recipe
+ * - Odoo Deployment + Service + Endpoint (port 8069 — HTTP mode serves
+ *   web and websockets on the same port in this image)
+ * - odoo.conf ConfigMap mounted at /etc/odoo/odoo.conf (proxy mode,
+ *   workers, memory-derived worker limits, request recycling)
+ * - Filestore PVC for attachments and binary fields
+ * - Master password provisioned through the Platform secrets backend
+ *   (openbao / vault), or referenced from an existing Secret
+ *
+ * The main app is a raw Deployment (not WebService) because Odoo needs
+ * the filestore PVC volume-mounted at /var/lib/odoo — the WebService
+ * recipe cannot express volume mounts.
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the MASTER_PASSWORD is provisioned for you. Without a backend you
+ * must point `masterPasswordSecretName` at a pre-created Secret.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Odoo } from '@r8s/odoo'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <Odoo name="erp" host="erp.example.com" workers={4} />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { Odoo } from '@r8s/odoo'
+ *
+ * export default (
+ *   <Odoo
+ *     name="erp"
+ *     host="erp.example.com"
+ *     filestore="100Gi"
+ *     masterPasswordSecretName="odoo-master-password"
+ *   />
+ * )
+ */
+function Odoo(props) {
+    const { name = 'odoo', namespace = 'default', version = '18', host, replicas = 1, filestore = '20Gi', workers = 2, masterPasswordSecretName, resources = {
+        requests: { memory: '512Mi', cpu: '250m' },
+        limits: { memory: '2Gi', cpu: '1000m' },
+    }, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, } = props;
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const resources_ = [];
+    const dbHost = `${name}-rw`;
+    const dbCredentialsName = `${name}-db-credentials`;
+    const masterSecretName = masterPasswordSecretName ?? `${name}-master-password`;
+    const configMapName = `${name}-config`;
+    const filestoreClaim = `${name}-filestore`;
+    if (replicas > 1) {
+        throw new Error(`Odoo "${name}" cannot run with replicas: ${replicas}.\n` +
+            `\n` +
+            `The filestore PersistentVolumeClaim "${filestoreClaim}" is ReadWriteOnce ` +
+            `and can only attach to a single pod at a time — every pod beyond the first ` +
+            `stays Pending with a Multi-Attach error.\n` +
+            `\n` +
+            `Fix: keep replicas at 1 (the default), or provide read-write-many shared ` +
+            `storage for the filestore and override the claim's accessMode before scaling.`);
+    }
+    // --- Secret provisioning ---------------------------------------------------
+    // The Odoo master password unlocks /web/database/manager — never render
+    // it as plaintext. With a secrets backend it is provisioned through the
+    // backend (key `masterPassword`); otherwise reference a pre-created Secret.
+    if (!masterPasswordSecretName) {
+        if (!secretProvider ||
+            (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')) {
+            throw new Error(`Odoo "${name}" requires a master password.\n` +
+                `\n` +
+                `Odoo uses MASTER_PASSWORD to manage the super-admin — ` +
+                `it must not be rendered as plaintext.\n` +
+                `\n` +
+                `Fix: configure a secrets backend on the Platform:\n` +
+                `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+                `    <Odoo name="${name}" host="${host}" />\n` +
+                `  </Platform>\n` +
+                `\n` +
+                `Or reference a pre-created Secret (key: masterPassword):\n` +
+                `  <Odoo name="${name}" host="${host}" masterPasswordSecretName="${name}-master-password" />`);
+        }
+        const spec = {
+            ...(secretProvider.backend === 'vault'
+                ? { vaultAuthRef: secretProvider.authRef }
+                : { openbaoAuthRef: secretProvider.authRef }),
+            mount: secretProvider.mount,
+            type: 'kv-v2',
+            path: `${secretProvider.path ?? name}/${name}/master`,
+            destination: { create: true, name: masterSecretName },
+        };
+        resources_.push(secretProvider.backend === 'vault'
+            ? (0, core_1.jsx)('VaultStaticSecret', {
+                apiVersion: 'secrets.hashicorp.com/v1beta1',
+                kind: 'VaultStaticSecret',
+                metadata: { name: `${name}-master-password`, namespace },
+                spec,
+            })
+            : (0, core_1.jsx)('OpenBaoStaticSecret', {
+                apiVersion: 'secrets.openbao.org/v1beta1',
+                kind: 'OpenBaoStaticSecret',
+                metadata: { name: `${name}-master-password`, namespace },
+                spec,
+            }));
+    }
+    // --- Operators --------------------------------------------------------------
+    // None declared directly: cnpg comes from the <Database> recipe (which
+    // checks OperatorContext and dedupes), routing operators come from
+    // <Endpoint>.
+    // --- Env wiring ---------------------------------------------------------------
+    // Upstream odoo:18 entrypoint env names (DB_HOST/DB_PORT/DB_USER/DB_PASSWORD).
+    // Credentials are declared FIRST via secretKeyRef so plain env values could
+    // reference them with Kubernetes $(VAR) dependent expansion. No plaintext.
+    const env = [
+        {
+            name: 'MASTER_PASSWORD',
+            valueFrom: { secretKeyRef: { name: masterSecretName, key: 'masterPassword' } },
+        },
+        {
+            name: 'DB_PASSWORD',
+            valueFrom: { secretKeyRef: { name: dbCredentialsName, key: 'password' } },
+        },
+        { name: 'DB_HOST', value: dbHost },
+        { name: 'DB_PORT', value: '5432' },
+        { name: 'DB_USER', value: name },
+        { name: 'ODOO_DB', value: name },
+    ];
+    // --- odoo.conf -----------------------------------------------------------------
+    // worker memory limits are derived from the container memory limit so the
+    // aggregator cannot slowly OOM-kill the pod: soft limit (worker recycled)
+    // at 80% of hard (worker killed outright).
+    const limitMemoryHard = memoryToBytes(resources.limits?.memory ?? '2Gi');
+    const limitMemorySoft = Math.round(limitMemoryHard * 0.8);
+    const odooConf = [
+        '[options]',
+        'proxy_mode = True',
+        `workers = ${workers}`,
+        `limit_memory_hard = ${limitMemoryHard}`,
+        `limit_memory_soft = ${limitMemorySoft}`,
+        'max_requests = 80',
+        '',
+    ].join('\n');
+    const configMap = {
+        apiVersion: 'v1',
+        kind: 'ConfigMap',
+        metadata: { name: configMapName, namespace, labels: { app: name } },
+        data: { 'odoo.conf': odooConf },
+    };
+    resources_.push((0, core_1.jsx)('ConfigMap', configMap));
+    // --- Filestore PVC ------------------------------------------------------------
+    // Odoo stores attachments and binary fields in the filestore
+    // (/var/lib/odoo). This is the whole reason the app is a raw Deployment:
+    // WebService cannot mount volumes. ReadWriteOnce keeps a single writer,
+    // which is also why replicas must stay at 1 (enforced above).
+    const filestorePvc = {
+        apiVersion: 'v1',
+        kind: 'PersistentVolumeClaim',
+        metadata: { name: filestoreClaim, namespace, labels: { app: name } },
+        spec: {
+            accessModes: ['ReadWriteOnce'],
+            resources: { requests: { storage: filestore } },
+        },
+    };
+    resources_.push((0, core_1.jsx)('PersistentVolumeClaim', filestorePvc));
+    // --- Database + Odoo Deployment + Service --------------------------------------
+    // <Database> is the parent wrapper so the CNPG operator and the Cluster
+    // piggyback on the r8s Database recipe; the raw Deployment references the
+    // connection info by convention (host `${name}-rw`, credentials secret
+    // `${name}-db-credentials` key `password`).
+    const configMount = {
+        name: 'config',
+        mountPath: '/etc/odoo/odoo.conf',
+        subPath: 'odoo.conf',
+    };
+    const deployment = {
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name, namespace, labels: { app: name } },
+        spec: {
+            replicas,
+            selector: { matchLabels: { app: name } },
+            template: {
+                metadata: { labels: { app: name } },
+                spec: {
+                    containers: [
+                        {
+                            name: 'odoo',
+                            image: `odoo:${version}`,
+                            ports: [{ name: 'http', containerPort: APP_PORT }],
+                            env,
+                            resources,
+                            livenessProbe: {
+                                httpGet: { path: HEALTH_PATH, port: APP_PORT },
+                                initialDelaySeconds: 60,
+                                periodSeconds: 30,
+                            },
+                            readinessProbe: {
+                                httpGet: { path: HEALTH_PATH, port: APP_PORT },
+                                initialDelaySeconds: 30,
+                                periodSeconds: 10,
+                            },
+                            volumeMounts: [{ name: 'filestore', mountPath: '/var/lib/odoo' }, configMount],
+                        },
+                    ],
+                    volumes: [
+                        { name: 'filestore', persistentVolumeClaim: { claimName: filestoreClaim } },
+                        { name: 'config', configMap: { name: configMapName } },
+                    ],
+                },
+            },
+        },
+    };
+    const service = {
+        apiVersion: 'v1',
+        kind: 'Service',
+        metadata: { name, namespace, labels: { app: name } },
+        spec: {
+            type: 'ClusterIP',
+            selector: { app: name },
+            ports: [{ name: 'http', port: APP_PORT, targetPort: APP_PORT }],
+        },
+    };
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name,
+        namespace,
+        storage: '10Gi',
+        children: (0, core_1.jsx)(core_1.Fragment, {
+            children: [(0, core_1.jsx)('Deployment', deployment), (0, core_1.jsx)('Service', service)],
+        }),
+    }));
+    // --- Endpoint — public web UI ---------------------------------------------------
+    resources_.push((0, jsx_runtime_1.jsx)(recipes_1.Endpoint, { name: `${name}-endpoint`, namespace: namespace, host: host, serviceName: name, servicePort: APP_PORT, tls: tls }));
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAuJA,oBA+OC;;AAtYD,oCAAqD;AACrD,iDAAkD;AASlD,0CAAiD;AAgDjD,MAAM,QAAQ,GAAG,IAAI,CAAA;AACrB,MAAM,WAAW,GAAG,aAAa,CAAA;AAIjC,MAAM,iBAAiB,GAA2B;IAChD,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,KAAK;IACR,EAAE,EAAE,KAAK;IACT,CAAC,EAAE,SAAS;IACZ,EAAE,EAAE,SAAS;IACb,CAAC,EAAE,aAAa;IAChB,EAAE,EAAE,aAAa;IACjB,CAAC,EAAE,iBAAiB;IACpB,EAAE,EAAE,iBAAiB;IACrB,CAAC,EAAE,qBAAqB;IACxB,EAAE,EAAE,qBAAqB;IACzB,CAAC,EAAE,yBAAyB;IAC5B,EAAE,EAAE,yBAAyB;IAC7B,EAAE,EAAE,CAAC,IAAI,EAAE;IACX,EAAE,EAAE,CAAC,IAAI,EAAE;IACX,EAAE,EAAE,CAAC,IAAI,EAAE;IACX,EAAE,EAAE,CAAC,IAAI,EAAE;IACX,EAAE,EAAE,CAAC,IAAI,EAAE;IACX,EAAE,EAAE,CAAC,IAAI,EAAE;CACZ,CAAA;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,0CAA0C,CACxF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,iDAAiD,CAC7F,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,SAAgB,IAAI,CAAC,KAAgB;IACnC,MAAM,EACJ,IAAI,GAAG,MAAM,EACb,SAAS,GAAG,SAAS,EACrB,OAAO,GAAG,IAAI,EACd,IAAI,EACJ,QAAQ,GAAG,CAAC,EACZ,SAAS,GAAG,MAAM,EAClB,OAAO,GAAG,CAAC,EACX,wBAAwB,EACxB,SAAS,GAAG;QACV,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;QAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;KACxC,EACD,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GACvE,GAAG,KAAK,CAAA;IAET,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAA;IAC3B,MAAM,iBAAiB,GAAG,GAAG,IAAI,iBAAiB,CAAA;IAClD,MAAM,gBAAgB,GAAG,wBAAwB,IAAI,GAAG,IAAI,kBAAkB,CAAA;IAC9E,MAAM,aAAa,GAAG,GAAG,IAAI,SAAS,CAAA;IACtC,MAAM,cAAc,GAAG,GAAG,IAAI,YAAY,CAAA;IAE1C,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,+BAA+B,QAAQ,KAAK;YACvD,IAAI;YACJ,wCAAwC,cAAc,qBAAqB;YAC3E,6EAA6E;YAC7E,4CAA4C;YAC5C,IAAI;YACJ,2EAA2E;YAC3E,+EAA+E,CAClF,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,IACE,CAAC,cAAc;YACf,CAAC,cAAc,CAAC,OAAO,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,CAAC,EAC5E,CAAC;YACD,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,iCAAiC;gBAC5C,IAAI;gBACJ,wDAAwD;gBACxD,yCAAyC;gBACzC,IAAI;gBACJ,qDAAqD;gBACrD,4EAA4E;gBAC5E,mBAAmB,IAAI,WAAW,IAAI,QAAQ;gBAC9C,iBAAiB;gBACjB,IAAI;gBACJ,4DAA4D;gBAC5D,iBAAiB,IAAI,WAAW,IAAI,+BAA+B,IAAI,sBAAsB,CAChG,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG;YACX,GAAG,CAAC,cAAc,CAAC,OAAO,KAAK,OAAO;gBACpC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,OAAO,EAAE;gBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC;YAC/C,KAAK,EAAE,cAAc,CAAC,KAAK;YAC3B,IAAI,EAAE,OAAgB;YACtB,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS;YACrD,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACtD,CAAA;QACD,UAAU,CAAC,IAAI,CACb,cAAc,CAAC,OAAO,KAAK,OAAO;YAChC,CAAC,CAAC,IAAA,UAAG,EAAC,mBAAmB,EAAE;gBACvB,UAAU,EAAE,+BAA+B;gBAC3C,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,kBAAkB,EAAE,SAAS,EAAE;gBACxD,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,IAAA,UAAG,EAAC,qBAAqB,EAAE;gBACzB,UAAU,EAAE,6BAA6B;gBACzC,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,kBAAkB,EAAE,SAAS,EAAE;gBACxD,IAAI;aACL,CAAC,CACP,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,uEAAuE;IACvE,mEAAmE;IACnE,cAAc;IAEd,iFAAiF;IACjF,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,GAAG,GAAa;QACpB;YACE,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;SAC/E;QACD;YACE,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;SAC1E;QACD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;QAClC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;QAClC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;KACjC,CAAA;IAED,kFAAkF;IAClF,0EAA0E;IAC1E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,CAAA;IACxE,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,GAAG,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG;QACf,WAAW;QACX,mBAAmB;QACnB,aAAa,OAAO,EAAE;QACtB,uBAAuB,eAAe,EAAE;QACxC,uBAAuB,eAAe,EAAE;QACxC,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,SAAS,GAAc;QAC3B,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnE,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;KAChC,CAAA;IACD,UAAU,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IAE5C,iFAAiF;IACjF,6DAA6D;IAC7D,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,YAAY,GAA0B;QAC1C,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,eAAe,CAAC;YAC9B,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;SAChD;KACF,CAAA;IACD,UAAU,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,uBAAuB,EAAE,YAAY,CAAC,CAAC,CAAA;IAE3D,kFAAkF;IAClF,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,WAAW,GAA2B;QAC1C,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,WAAW;KACrB,CAAA;IAED,MAAM,UAAU,GAAe;QAC7B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACxC,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACnC,IAAI,EAAE;oBACJ,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE,QAAQ,OAAO,EAAE;4BACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;4BAClD,GAAG;4BACH,SAAS;4BACT,aAAa,EAAE;gCACb,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;gCAC9C,mBAAmB,EAAE,EAAE;gCACvB,aAAa,EAAE,EAAE;6BAClB;4BACD,cAAc,EAAE;gCACd,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;gCAC9C,mBAAmB,EAAE,EAAE;gCACvB,aAAa,EAAE,EAAE;6BAClB;4BACD,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,WAAW,CAAC;yBAC/E;qBACF;oBACD,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE;wBAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;qBACvD;iBACF;aACF;SACF;KACF,CAAA;IAED,MAAM,OAAO,GAAY;QACvB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,EAAE;YACJ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YACvB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;SAChE;KACF,CAAA;IAED,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI;QACJ,SAAS;QACT,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,IAAA,UAAG,EAAC,eAAQ,EAAE;YACtB,QAAQ,EAAE,CAAC,IAAA,UAAG,EAAC,YAAY,EAAE,UAAU,CAAC,EAAE,IAAA,UAAG,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;SACnE,CAAC;KACH,CAAC,CACH,CAAA;IAED,mFAAmF;IACnF,UAAU,CAAC,IAAI,CACb,uBAAC,kBAAQ,IACP,IAAI,EAAE,GAAG,IAAI,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,IAAI,EACjB,WAAW,EAAE,QAAQ,EACrB,GAAG,EAAE,GAAG,GACR,CACH,CAAA;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/odoo",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Odoo ERP — Postgres persistence, filestore PVC, worker tuning, master password via secrets backend",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -37,5 +37,8 @@
   "devDependencies": {
     "typescript": "^5.3.0",
     "vitest": "^1.0.0"
-  }
+  },
+  "files": [
+    "dist"
+  ]
 }

package/__tests__/odoo.test.ts

@@ -1,324 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { render, jsx } from '@r8s/core'
-import { OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
-import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
-import { operators } from '@r8s/crds'
-import type { r8sElement } from '@r8s/core'
-
-// Odoo recipe tests:
-//   1. Operator declarations (deduped via OperatorContext)
-//   2. Rendering: defaults, all props, gateway/ingress adaptation, odoo.conf
-//   3. Security: no plaintext credentials in rendered output
-//   4. Validation: replica constraint and missing secrets throw
-import { Odoo } from '../src/index'
-
-/** Render Odoo inside a Platform-like secrets backend (OpenBao). */
-function renderOdoo(props: Record<string, unknown>): ReturnType<typeof render> {
-  return render(
-    jsx(SecretContext.Provider, {
-      value: { backend: 'openbao', mount: 'kv', path: 'test' },
-      children: jsx(Odoo, props as never),
-    })
-  )
-}
-
-/** Render Odoo wrapped only in an OperatorContext (no secrets backend). */
-function renderOdooWithContext(operators_: any[], props: Record<string, unknown>): r8sElement {
-  return jsx(OperatorContext.Provider, {
-    value: operators_,
-    children: jsx(Odoo, props as never),
-  })
-}
-
-function findDeployment(result: ReturnType<typeof render>, name = 'odoo'): any {
-  return result.resources.find(
-    (r: any) => r.kind === 'Deployment' && r.metadata.name === name
-  ) as any
-}
-
-const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
-
-describe('operator declarations', () => {
-  it('declares the cnpg operator via the Database recipe', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(true)
-  })
-
-  it('deduplicates operators provided via context', () => {
-    const result = render(
-      renderOdooWithContext([operators['cnpg']()], {
-        host: 'erp.example.com',
-        masterPasswordSecretName: 'existing-master',
-      })
-    )
-    const names = result.operators.map((op) => op.name)
-    expect(names.filter((n) => n === 'cnpg')).toHaveLength(1)
-  })
-
-  it('allows version overrides through context operators', () => {
-    const result = render(
-      renderOdooWithContext([operators['cnpg']('1.25.0')], {
-        host: 'erp.example.com',
-        masterPasswordSecretName: 'existing-master',
-      })
-    )
-    const cnpg = result.operators.filter((op) => op.name === 'cnpg')
-    expect(cnpg).toHaveLength(1)
-    expect(cnpg[0].version).toBe('1.25.0')
-  })
-})
-
-describe('rendering defaults', () => {
-  it('renders deployment, odoo.conf configmap, filestore PVC, service, database and endpoint', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('Deployment')
-    expect(kinds).toContain('ConfigMap')
-    expect(kinds).toContain('PersistentVolumeClaim')
-    expect(kinds).toContain('Service')
-    expect(kinds).toContain('Ingress')
-    expect(kinds).toContain('Cluster')
-  })
-
-  it('renders a ReadWriteOnce filestore PVC with the default 20Gi size', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const pvc = result.resources.find((r: any) => r.kind === 'PersistentVolumeClaim') as any
-    expect(pvc.metadata.name).toBe('odoo-filestore')
-    expect(pvc.spec.accessModes).toEqual(['ReadWriteOnce'])
-    expect(pvc.spec.resources.requests.storage).toBe('20Gi')
-  })
-
-  it('mounts the filestore at /var/lib/odoo and probes /web/health on 8069', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const deployment = findDeployment(result)
-    const container = deployment.spec.template.spec.containers[0]
-    expect(container.livenessProbe.httpGet).toEqual({ path: '/web/health', port: 8069 })
-    expect(container.livenessProbe.initialDelaySeconds).toBe(60)
-    expect(container.readinessProbe.httpGet).toEqual({ path: '/web/health', port: 8069 })
-    expect(container.readinessProbe.initialDelaySeconds).toBe(30)
-  })
-
-  it('exposes only the http port 8069 (no gevent 8072 declaration)', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const deployment = findDeployment(result)
-    expect(deployment.spec.template.spec.containers[0].ports).toEqual([
-      { name: 'http', containerPort: 8069 },
-    ])
-    const service = result.resources.find(
-      (r: any) => r.kind === 'Service' && r.metadata.name === 'odoo'
-    ) as any
-    expect(service.spec.ports).toEqual([{ name: 'http', port: 8069, targetPort: 8069 }])
-  })
-
-  it('wires upstream odoo entrypoint env vars by default', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const env = findDeployment(result).spec.template.spec.containers[0].env
-    const byName = (v: string) => env.find((e: any) => e.name === v)
-    expect(byName('DB_HOST').value).toBe('odoo-rw')
-    expect(byName('DB_PORT').value).toBe('5432')
-    expect(byName('DB_USER').value).toBe('odoo')
-    expect(byName('ODOO_DB').value).toBe('odoo')
-  })
-
-  it('does not emit the legacy ODOO_* env names or ODOO_WORKERS', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const env = findDeployment(result).spec.template.spec.containers[0].env
-    const names = env.map((e: any) => e.name)
-    expect(names).not.toContain('ODOO_DB_HOST')
-    expect(names).not.toContain('ODOO_DB_PORT')
-    expect(names).not.toContain('ODOO_DB_USER')
-    expect(names).not.toContain('ODOO_DB_PASSWORD')
-    expect(names).not.toContain('ODOO_MASTER_PASSWORD')
-    expect(names).not.toContain('ODOO_WORKERS')
-  })
-
-  it('renders a ConfigMap with the expected odoo.conf markers', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const configMap = result.resources.find(
-      (r: any) => r.kind === 'ConfigMap' && r.metadata.name === 'odoo-config'
-    ) as any
-    expect(configMap).toBeDefined()
-    const conf = configMap.data['odoo.conf']
-    expect(conf).toContain('[options]')
-    expect(conf).toContain('proxy_mode = True')
-    expect(conf).toContain('workers = 2')
-    expect(conf).toContain(`limit_memory_hard = ${2 * 1024 ** 3}`)
-    expect(conf).toContain(`limit_memory_soft = ${Math.round(2 * 1024 ** 3 * 0.8)}`)
-    expect(conf).toContain('max_requests = 80')
-  })
-
-  it('mounts the odoo.conf ConfigMap at /etc/odoo/odoo.conf', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const deployment = findDeployment(result)
-    const container = deployment.spec.template.spec.containers[0]
-    expect(container.volumeMounts).toEqual([
-      { name: 'filestore', mountPath: '/var/lib/odoo' },
-      { name: 'config', mountPath: '/etc/odoo/odoo.conf', subPath: 'odoo.conf' },
-    ])
-    expect(deployment.spec.template.spec.volumes).toEqual([
-      { name: 'filestore', persistentVolumeClaim: { claimName: 'odoo-filestore' } },
-      { name: 'config', configMap: { name: 'odoo-config' } },
-    ])
-  })
-
-  it('renders gateway resources when platform uses gateway routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'gateway', gatewayClassName: 'eg' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(Odoo, { host: 'erp.example.com' }),
-        }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('HTTPRoute')
-  })
-
-  it('renders a valid Ingress when platform uses ingress routing', () => {
-    const result = render(
-      jsx(RoutingContext.Provider, {
-        value: { mode: 'ingress' },
-        children: jsx(SecretContext.Provider, {
-          value: openbao as never,
-          children: jsx(Odoo, { host: 'erp.example.com' }),
-        }),
-      })
-    )
-    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
-    expect(ingress).toBeDefined()
-    expect(ingress.spec.rules[0].host).toBe('erp.example.com')
-  })
-
-  it('passes resource validation', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    for (const resource of result.resources) {
-      expect(validateResource(resource)).toEqual([])
-    }
-  })
-})
-
-describe('rendering with all props', () => {
-  it('accepts the full prop surface at the maximum replica count of 1', () => {
-    const result = renderOdoo({
-      name: 'erp',
-      namespace: 'erp',
-      version: '17.0',
-      host: 'erp.example.com',
-      filestore: '50Gi',
-      workers: 4,
-      resources: {
-        requests: { memory: '1Gi', cpu: '500m' },
-        limits: { memory: '4Gi', cpu: '2000m' },
-      },
-      tls: { secretName: 'erp-tls', clusterIssuer: 'letsencrypt-prod' },
-    })
-    expect(result.resources.length).toBeGreaterThan(0)
-    const deployment = findDeployment(result, 'erp')
-    expect(deployment.spec.replicas).toBe(1)
-    expect(deployment.spec.template.spec.containers[0].image).toBe('odoo:17.0')
-    expect(deployment.spec.template.spec.containers[0].resources.limits.memory).toBe('4Gi')
-    const configMap = result.resources.find(
-      (r: any) => r.kind === 'ConfigMap' && r.metadata.name === 'erp-config'
-    ) as any
-    const conf = configMap.data['odoo.conf']
-    expect(conf).toContain('workers = 4')
-    expect(conf).toContain(`limit_memory_hard = ${4 * 1024 ** 3}`)
-    expect(conf).toContain(`limit_memory_soft = ${Math.round(4 * 1024 ** 3 * 0.8)}`)
-    const pvc = result.resources.find((r: any) => r.kind === 'PersistentVolumeClaim') as any
-    expect(pvc.metadata.name).toBe('erp-filestore')
-    expect(pvc.spec.resources.requests.storage).toBe('50Gi')
-  })
-
-  it('throws a descriptive error when replicas > 1 (RWO filestore)', () => {
-    expect(() => renderOdoo({ host: 'erp.example.com', replicas: 2 })).toThrow(
-      /filestore.*ReadWriteOnce/
-    )
-    expect(() => renderOdoo({ host: 'erp.example.com', name: 'erp', replicas: 3 })).toThrow(
-      /Fix: keep replicas at 1/
-    )
-  })
-
-  it('throws when the memory limit cannot be parsed', () => {
-    expect(() =>
-      renderOdoo({
-        host: 'erp.example.com',
-        masterPasswordSecretName: 'existing-master',
-        resources: { limits: { memory: 'lots' } },
-      })
-    ).toThrow(/cannot parse memory quantity/)
-  })
-})
-
-describe('secrets handling', () => {
-  it('accepts an explicit masterPasswordSecretName without a backend', () => {
-    expect(() =>
-      render(jsx(Odoo, { host: 'erp.example.com', masterPasswordSecretName: 'existing-master' }))
-    ).not.toThrow()
-  })
-
-  it('provisions the master password through a secrets backend', () => {
-    const result = renderOdoo({ host: 'erp.example.com' })
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('OpenBaoStaticSecret')
-    const secret = result.resources.find((r: any) => r.kind === 'OpenBaoStaticSecret') as any
-    expect(secret.metadata.name).toBe('odoo-master-password')
-    expect(secret.spec.path).toBe('test/odoo/master')
-    expect(secret.spec.destination).toEqual({ create: true, name: 'odoo-master-password' })
-  })
-
-  it('provisions the master password through Vault', () => {
-    const result = render(
-      jsx(SecretContext.Provider, {
-        value: { backend: 'vault', mount: 'kv', path: 'apps' },
-        children: jsx(Odoo, { host: 'erp.example.com' }),
-      })
-    )
-    const kinds = result.resources.map((r) => r.kind)
-    expect(kinds).toContain('VaultStaticSecret')
-    const secret = result.resources.find((r: any) => r.kind === 'VaultStaticSecret') as any
-    expect(secret.spec.path).toBe('apps/odoo/master')
-  })
-
-  it('wires credentials via upstream env names and secretKeyRef (never plaintext)', () => {
-    const result = renderOdoo({
-      host: 'erp.example.com',
-      masterPasswordSecretName: 'existing-master',
-    })
-    const env = findDeployment(result).spec.template.spec.containers[0].env
-    const masterPassword = env.find((e: any) => e.name === 'MASTER_PASSWORD')
-    const dbPassword = env.find((e: any) => e.name === 'DB_PASSWORD')
-    expect(masterPassword.valueFrom.secretKeyRef.name).toBe('existing-master')
-    expect(masterPassword.valueFrom.secretKeyRef.key).toBe('masterPassword')
-    expect(dbPassword.valueFrom.secretKeyRef.name).toBe('odoo-db-credentials')
-    expect(dbPassword.valueFrom.secretKeyRef.key).toBe('password')
-    expect(masterPassword.value).toBeUndefined()
-    expect(dbPassword.value).toBeUndefined()
-  })
-
-  it('renders no plaintext credentials anywhere', () => {
-    const result = renderOdoo({ host: 'erp.example.com', filestore: '50Gi', workers: 4 })
-    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
-    if (!passed) {
-      console.error('Plaintext credential violations:', errors)
-    }
-    expect(passed).toBe(true)
-  })
-})
-
-describe('validation errors', () => {
-  it('throws when no secrets backend and no master password secret', () => {
-    expect(() => render(jsx(Odoo, { host: 'erp.example.com' }))).toThrow(/master password/)
-  })
-
-  it('throws for unknown secrets backends', () => {
-    expect(() =>
-      render(
-        jsx(SecretContext.Provider, {
-          value: { backend: 'unknown' as never },
-          children: jsx(Odoo, { host: 'erp.example.com' }),
-        })
-      )
-    ).toThrow(/master password/)
-  })
-})

package/examples/basic.tsx

@@ -1,8 +0,0 @@
-import { Platform } from '@r8s/recipes'
-import { Odoo } from '@r8s/odoo'
-
-export default (
-  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
-    <Odoo name="erp" host="erp.example.com" workers={4} />
-  </Platform>
-)

package/src/index.tsx

@@ -1,391 +0,0 @@
-import { jsx, Fragment, useContext } from '@r8s/core'
-import { SecretContext } from '@r8s/core/defaults'
-import type {
-  ConfigMap,
-  Deployment,
-  EnvVar,
-  PersistentVolumeClaim,
-  Service,
-  VolumeMount,
-} from '@r8s/k8s-types'
-import { Database, Endpoint } from '@r8s/recipes'
-
-export interface OdooProps {
-  /** Resource name (defaults to 'odoo') */
-  name?: string
-  /** Kubernetes namespace (defaults to 'default') */
-  namespace?: string
-  /** Container image tag (defaults to '18' — pin a version in production) */
-  version?: string
-  /** Public hostname for the ERP web UI (required) */
-  host: string
-  /**
-   * Number of replicas. Must stay at 1 — the filestore PVC is
-   * ReadWriteOnce and cannot attach to multiple pods (defaults to 1).
-   */
-  replicas?: number
-  /**
-   * Size of the filestore PersistentVolumeClaim (defaults to '20Gi').
-   * Odoo stores attachments and binary fields here.
-   */
-  filestore?: string
-  /**
-   * Odoo process-level worker processes, rendered into odoo.conf
-   * (defaults to 2). Rule of thumb: (CPU threads * 2) + 1, accounting
-   * for cron workers.
-   */
-  workers?: number
-  /**
-   * Name of an existing Secret containing key `masterPassword`. Odoo
-   * requires this to manage the super-admin (`/web/database/manager`).
-   *
-   * Required unless a secrets backend (openbao/vault) is configured on
-   * the surrounding Platform — the backend then provisions the password
-   * automatically. Plaintext passwords are not supported.
-   */
-  masterPasswordSecretName?: string
-  /** Requested resources */
-  resources?: {
-    requests?: { cpu?: string; memory?: string }
-    limits?: { cpu?: string; memory?: string }
-  }
-  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
-  tls?: {
-    secretName: string
-    clusterIssuer: string
-  }
-}
-
-const APP_PORT = 8069
-const HEALTH_PATH = '/web/health'
-
-type VolumeMountWithSubPath = VolumeMount & { subPath?: string }
-
-const MEMORY_UNIT_BYTES: Record<string, number> = {
-  '': 1,
-  B: 1,
-  K: 1_000,
-  KB: 1_000,
-  M: 1_000_000,
-  MB: 1_000_000,
-  G: 1_000_000_000,
-  GB: 1_000_000_000,
-  T: 1_000_000_000_000,
-  TB: 1_000_000_000_000,
-  P: 1_000_000_000_000_000,
-  PB: 1_000_000_000_000_000,
-  E: 1_000_000_000_000_000_000,
-  EB: 1_000_000_000_000_000_000,
-  KI: 1 << 10,
-  MI: 1 << 20,
-  GI: 1 << 30,
-  TI: 2 ** 40,
-  PI: 2 ** 50,
-  EI: 2 ** 60,
-}
-
-/** Parse a Kubernetes memory quantity ("2Gi", "512Mi", "1G") into bytes. */
-function memoryToBytes(memory: string): number {
-  const match = /^(\d+(?:\.\d+)?)\s*([a-zA-Z]+)?$/.exec(memory.trim())
-  if (!match) {
-    throw new Error(
-      `Odoo: cannot parse memory quantity "${memory}" — use quantities like "2Gi" or "512Mi"`
-    )
-  }
-  const amount = Number(match[1])
-  const unit = (match[2] ?? '').toUpperCase()
-  const multiplier = MEMORY_UNIT_BYTES[unit]
-  if (multiplier === undefined) {
-    throw new Error(
-      `Odoo: unsupported memory unit in "${memory}" — use B, K/Ki, M/Mi, G/Gi, T/Ti, P/Pi or E/Ei`
-    )
-  }
-  return Math.round(amount * multiplier)
-}
-
-/**
- * Odoo — open-source ERP / business applications suite.
- *
- * @title Odoo
- * @category Business Applications
- *
- * Composes:
- * - CNPG Postgres cluster (Odoo data model) via the Database recipe
- * - Odoo Deployment + Service + Endpoint (port 8069 — HTTP mode serves
- *   web and websockets on the same port in this image)
- * - odoo.conf ConfigMap mounted at /etc/odoo/odoo.conf (proxy mode,
- *   workers, memory-derived worker limits, request recycling)
- * - Filestore PVC for attachments and binary fields
- * - Master password provisioned through the Platform secrets backend
- *   (openbao / vault), or referenced from an existing Secret
- *
- * The main app is a raw Deployment (not WebService) because Odoo needs
- * the filestore PVC volume-mounted at /var/lib/odoo — the WebService
- * recipe cannot express volume mounts.
- *
- * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
- * the MASTER_PASSWORD is provisioned for you. Without a backend you
- * must point `masterPasswordSecretName` at a pre-created Secret.
- *
- * @example
- * import { Platform } from '@r8s/recipes'
- * import { Odoo } from '@r8s/odoo'
- *
- * export default (
- *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
- *     <Odoo name="erp" host="erp.example.com" workers={4} />
- *   </Platform>
- * )
- *
- * @example
- * import { Odoo } from '@r8s/odoo'
- *
- * export default (
- *   <Odoo
- *     name="erp"
- *     host="erp.example.com"
- *     filestore="100Gi"
- *     masterPasswordSecretName="odoo-master-password"
- *   />
- * )
- */
-export function Odoo(props: OdooProps) {
-  const {
-    name = 'odoo',
-    namespace = 'default',
-    version = '18',
-    host,
-    replicas = 1,
-    filestore = '20Gi',
-    workers = 2,
-    masterPasswordSecretName,
-    resources = {
-      requests: { memory: '512Mi', cpu: '250m' },
-      limits: { memory: '2Gi', cpu: '1000m' },
-    },
-    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
-  } = props
-
-  const secretProvider = useContext(SecretContext)
-  const resources_: ReturnType<typeof jsx>[] = []
-
-  const dbHost = `${name}-rw`
-  const dbCredentialsName = `${name}-db-credentials`
-  const masterSecretName = masterPasswordSecretName ?? `${name}-master-password`
-  const configMapName = `${name}-config`
-  const filestoreClaim = `${name}-filestore`
-
-  if (replicas > 1) {
-    throw new Error(
-      `Odoo "${name}" cannot run with replicas: ${replicas}.\n` +
-        `\n` +
-        `The filestore PersistentVolumeClaim "${filestoreClaim}" is ReadWriteOnce ` +
-        `and can only attach to a single pod at a time — every pod beyond the first ` +
-        `stays Pending with a Multi-Attach error.\n` +
-        `\n` +
-        `Fix: keep replicas at 1 (the default), or provide read-write-many shared ` +
-        `storage for the filestore and override the claim's accessMode before scaling.`
-    )
-  }
-
-  // --- Secret provisioning ---------------------------------------------------
-  // The Odoo master password unlocks /web/database/manager — never render
-  // it as plaintext. With a secrets backend it is provisioned through the
-  // backend (key `masterPassword`); otherwise reference a pre-created Secret.
-  if (!masterPasswordSecretName) {
-    if (
-      !secretProvider ||
-      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
-    ) {
-      throw new Error(
-        `Odoo "${name}" requires a master password.\n` +
-          `\n` +
-          `Odoo uses MASTER_PASSWORD to manage the super-admin — ` +
-          `it must not be rendered as plaintext.\n` +
-          `\n` +
-          `Fix: configure a secrets backend on the Platform:\n` +
-          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
-          `    <Odoo name="${name}" host="${host}" />\n` +
-          `  </Platform>\n` +
-          `\n` +
-          `Or reference a pre-created Secret (key: masterPassword):\n` +
-          `  <Odoo name="${name}" host="${host}" masterPasswordSecretName="${name}-master-password" />`
-      )
-    }
-
-    const spec = {
-      ...(secretProvider.backend === 'vault'
-        ? { vaultAuthRef: secretProvider.authRef }
-        : { openbaoAuthRef: secretProvider.authRef }),
-      mount: secretProvider.mount,
-      type: 'kv-v2' as const,
-      path: `${secretProvider.path ?? name}/${name}/master`,
-      destination: { create: true, name: masterSecretName },
-    }
-    resources_.push(
-      secretProvider.backend === 'vault'
-        ? jsx('VaultStaticSecret', {
-            apiVersion: 'secrets.hashicorp.com/v1beta1',
-            kind: 'VaultStaticSecret',
-            metadata: { name: `${name}-master-password`, namespace },
-            spec,
-          })
-        : jsx('OpenBaoStaticSecret', {
-            apiVersion: 'secrets.openbao.org/v1beta1',
-            kind: 'OpenBaoStaticSecret',
-            metadata: { name: `${name}-master-password`, namespace },
-            spec,
-          })
-    )
-  }
-
-  // --- Operators --------------------------------------------------------------
-  // None declared directly: cnpg comes from the <Database> recipe (which
-  // checks OperatorContext and dedupes), routing operators come from
-  // <Endpoint>.
-
-  // --- Env wiring ---------------------------------------------------------------
-  // Upstream odoo:18 entrypoint env names (DB_HOST/DB_PORT/DB_USER/DB_PASSWORD).
-  // Credentials are declared FIRST via secretKeyRef so plain env values could
-  // reference them with Kubernetes $(VAR) dependent expansion. No plaintext.
-  const env: EnvVar[] = [
-    {
-      name: 'MASTER_PASSWORD',
-      valueFrom: { secretKeyRef: { name: masterSecretName, key: 'masterPassword' } },
-    },
-    {
-      name: 'DB_PASSWORD',
-      valueFrom: { secretKeyRef: { name: dbCredentialsName, key: 'password' } },
-    },
-    { name: 'DB_HOST', value: dbHost },
-    { name: 'DB_PORT', value: '5432' },
-    { name: 'DB_USER', value: name },
-    { name: 'ODOO_DB', value: name },
-  ]
-
-  // --- odoo.conf -----------------------------------------------------------------
-  // worker memory limits are derived from the container memory limit so the
-  // aggregator cannot slowly OOM-kill the pod: soft limit (worker recycled)
-  // at 80% of hard (worker killed outright).
-  const limitMemoryHard = memoryToBytes(resources.limits?.memory ?? '2Gi')
-  const limitMemorySoft = Math.round(limitMemoryHard * 0.8)
-  const odooConf = [
-    '[options]',
-    'proxy_mode = True',
-    `workers = ${workers}`,
-    `limit_memory_hard = ${limitMemoryHard}`,
-    `limit_memory_soft = ${limitMemorySoft}`,
-    'max_requests = 80',
-    '',
-  ].join('\n')
-
-  const configMap: ConfigMap = {
-    apiVersion: 'v1',
-    kind: 'ConfigMap',
-    metadata: { name: configMapName, namespace, labels: { app: name } },
-    data: { 'odoo.conf': odooConf },
-  }
-  resources_.push(jsx('ConfigMap', configMap))
-
-  // --- Filestore PVC ------------------------------------------------------------
-  // Odoo stores attachments and binary fields in the filestore
-  // (/var/lib/odoo). This is the whole reason the app is a raw Deployment:
-  // WebService cannot mount volumes. ReadWriteOnce keeps a single writer,
-  // which is also why replicas must stay at 1 (enforced above).
-  const filestorePvc: PersistentVolumeClaim = {
-    apiVersion: 'v1',
-    kind: 'PersistentVolumeClaim',
-    metadata: { name: filestoreClaim, namespace, labels: { app: name } },
-    spec: {
-      accessModes: ['ReadWriteOnce'],
-      resources: { requests: { storage: filestore } },
-    },
-  }
-  resources_.push(jsx('PersistentVolumeClaim', filestorePvc))
-
-  // --- Database + Odoo Deployment + Service --------------------------------------
-  // <Database> is the parent wrapper so the CNPG operator and the Cluster
-  // piggyback on the r8s Database recipe; the raw Deployment references the
-  // connection info by convention (host `${name}-rw`, credentials secret
-  // `${name}-db-credentials` key `password`).
-  const configMount: VolumeMountWithSubPath = {
-    name: 'config',
-    mountPath: '/etc/odoo/odoo.conf',
-    subPath: 'odoo.conf',
-  }
-
-  const deployment: Deployment = {
-    apiVersion: 'apps/v1',
-    kind: 'Deployment',
-    metadata: { name, namespace, labels: { app: name } },
-    spec: {
-      replicas,
-      selector: { matchLabels: { app: name } },
-      template: {
-        metadata: { labels: { app: name } },
-        spec: {
-          containers: [
-            {
-              name: 'odoo',
-              image: `odoo:${version}`,
-              ports: [{ name: 'http', containerPort: APP_PORT }],
-              env,
-              resources,
-              livenessProbe: {
-                httpGet: { path: HEALTH_PATH, port: APP_PORT },
-                initialDelaySeconds: 60,
-                periodSeconds: 30,
-              },
-              readinessProbe: {
-                httpGet: { path: HEALTH_PATH, port: APP_PORT },
-                initialDelaySeconds: 30,
-                periodSeconds: 10,
-              },
-              volumeMounts: [{ name: 'filestore', mountPath: '/var/lib/odoo' }, configMount],
-            },
-          ],
-          volumes: [
-            { name: 'filestore', persistentVolumeClaim: { claimName: filestoreClaim } },
-            { name: 'config', configMap: { name: configMapName } },
-          ],
-        },
-      },
-    },
-  }
-
-  const service: Service = {
-    apiVersion: 'v1',
-    kind: 'Service',
-    metadata: { name, namespace, labels: { app: name } },
-    spec: {
-      type: 'ClusterIP',
-      selector: { app: name },
-      ports: [{ name: 'http', port: APP_PORT, targetPort: APP_PORT }],
-    },
-  }
-
-  resources_.push(
-    jsx(Database, {
-      name,
-      namespace,
-      storage: '10Gi',
-      children: jsx(Fragment, {
-        children: [jsx('Deployment', deployment), jsx('Service', service)],
-      }),
-    })
-  )
-
-  // --- Endpoint — public web UI ---------------------------------------------------
-  resources_.push(
-    <Endpoint
-      name={`${name}-endpoint`}
-      namespace={namespace}
-      host={host}
-      serviceName={name}
-      servicePort={APP_PORT}
-      tls={tls}
-    />
-  )
-
-  return jsx(Fragment, { children: resources_ })
-}

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true
-  },
-  "include": ["src/**/*"],
-  "references": [
-    { "path": "../core" },
-    { "path": "../k8s-types" },
-    { "path": "../crds" },
-    { "path": "../recipes" }
-  ]
-}