Module Architecture

flowchart TD
    OC["Odoo Core\nbase · mail · web · queue_job"]

    RS["sadeem.root.server\nSSH root server\nmonitoring · code server"]
    PG["sadeem.postgresql.server\nremote DB connection config"]
    ML["sadeem.root.server.monitor.log\nCPU · RAM · Disk · Network logs"]
    GA["sadeem.saas.git.account\nGitHub credentials\nAPI token"]
    GR["sadeem.saas.git.repository\nbranch management\nwebhook · code push"]
    GC["sadeem.saas.git.commit\ncommit records\nbranch · message"]
    BS["sadeem.saas.backup.server\nremote backup API\nAPI key auth"]
    CA["sadeem.saas.backup.cloud.account\nS3 / cloud accounts\nsynced from backup server"]
    NT["sadeem.ntfy.server\nntfy / Firebase FCM\ntoken management"]
    WH["sadeem.saas.webhook\ninbound webhook endpoint\ntrigger record actions"]
    LG["sadeem.saas.action.log\naudit trail\nSSH command results"]

    OC --> RS
    OC --> GA
    OC --> BS
    OC --> NT

    RS --> A1([action_confirm\ntest SSH connection])
    RS --> A2([action_run_cmd\nexecute remote command])
    RS --> A3([action_start_monitor\nstart cron monitoring])
    RS --> A4([action_install_code_server\ndeploy VS Code via SSH])
    RS --> A5([action_setup_dir_structure\ninitialize server directories])
    RS --> ML
    RS --> PG

    GA --> GR
    GR --> GC
    GR --> A6([action_push_code\npush addons via SSH])
    GR --> A7([action_register_webhook\nregister GitHub webhook])

    BS --> A8([action_test_connection\nHTTP ping backup API])
    BS --> A9([action_sync_cloud_accounts\nfetch S3 accounts from remote])
    BS --> CA

    NT --> A10([action_send_notification\npush to ntfy / FCM])

    WH --> A11([action_trigger\ncall record method on event])
    RS --> LG
    WH --> LG

Module Description

SAAS Base is the foundation of the Sadeem SAAS Package. It provides all shared infrastructure that every other SAAS module builds on.

Dependencies

• mail — chatter, tracking, activity mixin
• queue_job — asynchronous job queue (used for background SSH operations)

Security Groups

Menus

SAAS Management
├─ Git
⎢   ├─ Accounts
⎢   ├─ Repositories
⎢   └─ Git Commits
├─ Infrastructure
⎢   ├─ Servers
⎢   ⎢   ├─ Root Servers
⎢   ⎢   └─ Root Servers Dashboard
⎢   ├─ Database Servers
⎢   ⎢   └─ PostgreSQL Servers
⎢   └─ Backup Servers
⎢       └─ Backup Servers
├─ Notification Servers
└─ Configuration
    └─ Settings

Configuration

Settings available under SAAS Management > Configuration > Settings

Key Fields

Root Server (sadeem.root.server)

PostgreSQL Server (sadeem.postgresql.server)

Backup Server (sadeem.saas.backup.server)

Backup Cloud Account (sadeem.saas.backup.cloud.account)

Notification Server (sadeem.ntfy.server)

Git Account (sadeem.saas.git.account)

Git Repository (sadeem.saas.git.repository)

Git Commit (sadeem.saas.git.commit)

Webhook (sadeem.saas.webhook)

Action Log (sadeem.saas.action.log)

Lifecycle & States

Root Server States

Transitions: - draft → confirmed: action_confirm — tests SSH connection via paramiko; raises UserError if no credentials or connection fails - confirmed → draft: action_reset_draft - confirmed → cancel: action_cancel

Git Repository States

Transitions: - draft → active: action_link_git_webhook — registers GitHub webhook via API - active → draft: action_delete_git_webhook — removes GitHub webhook

Key Actions

Warnings & Important Notes

• SSH credentials required: action_confirm raises UserError if neither password nor key is provided.
• SSH connection failure: action_confirm raises UserError with the SSH error message if paramiko cannot connect.
• Repository deletion blocked: Cannot delete a sadeem.saas.git.repository while a webhook is still registered — raises ValidationError instructing the user to unlink the webhook first.
• Repository webhook registration: Requires a non-empty access_token on the git account and both name and branch_name on the repository — ValidationError otherwise.
• ntfy URL required: @api.constrains raises ValidationError if provider is ntfy and no URL is set, or URL does not start with http:// or https://.
• FCM credentials required: @api.constrains raises ValidationError if provider is fcm and none of fcm_server_key, fcm_project_id, or fcm_service_account_json is set; also validates the JSON structure if service account JSON is provided.
• ntfy auto-generate requires admin credentials: @api.constrains raises ValidationError if auto_generate_tokens is enabled without admin_username and admin_password.
• ntfy auth validation: @api.constrains checks that auth credentials match the configured auth_method; raises ValidationError for missing password, token, or username.
• Token expiry range: token_expiry_days must be between 1 and 3650; @api.constrains enforces this.
• Root server UUID uniqueness: _sql_constraints enforces UNIQUE(uuid) on sadeem.root.server.
• Webhook token uniqueness: _sql_constraints enforces UNIQUE(token) on sadeem.saas.webhook.
• ntfy server uniqueness: _sql_constraints enforces one default notification server per company.
• Post-install hook: On installation, a secret key is generated via sadeem_post_init_hook_secret_key — used for encrypting sensitive fields.