Project

General

Profile

Actions
Copy link

Feature #56

open
AS

Feature #33: Canofy Control Centre Backend Development

Feature #46: Canofy Control Centre Onboarding Process

# [CANOFY-110] Install Frappe Bench & Create Site

Feature #56: # [CANOFY-110] Install Frappe Bench & Create Site

Added by Akshath Shettigara about 1 month ago. Updated about 1 month ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
07/23/2026
Due date:
% Done:

0%

Estimated time:

Description

[CANOFY-110] Install Frappe Bench & Create Site

Type: Story
Epic: New Client Onboarding — Automated AWS + Frappe Provisioning
Stage key: frappe_install (pipeline stage 10 of 15)
Component: utils/onboarding_executor.py

User Story

As an operations engineer,
I want the Frappe bench and the client's site created automatically
with securely generated credentials,
so that every client site starts from an identical, correctly
initialized base with no manually chosen or reused passwords.

Description

Via SSM: pip3 install frappe-bench, bench init (pinned to the target
Frappe version), then bench new-site <site_name> using the MariaDB root
password from stage 9.

  • Generate a fresh Administrator password (independent from the MariaDB
    root password) at this stage.
  • Both the DB root password and the Administrator password must be:
    • Stored in AWS Secrets Manager.
    • Recorded in the Credential vault (DB Password, Admin Password
      types) linked to the site, for later reveal by authorized roles.
    • Never written anywhere in plaintext outside of those two encrypted
      stores (not in Onboarding Request fields, not in logs).

Configuration / Prerequisites

  • Depends on stage 9 (MariaDB root password, base packages).
  • Target Frappe version must be specified/pinned somewhere in the request
    or platform config — an unpinned bench init could pull a different
    version than intended between two onboarding runs.

Acceptance Criteria

  • Bench initializes at the target Frappe version.
  • Site is created and its database exists in MariaDB.
  • A fresh, random Administrator password is generated (not a fixed
    default, not reused from any other client).
  • Both passwords land in Secrets Manager AND the Credential vault,
    correctly linked to this site/client.
  • Neither password appears in plaintext in any log, error message, or
    Onboarding Request field.

Test Cases

ID Scenario Steps Expected Result
TC-1 Happy path Run stage after successful bootstrap Site created; logging in as Administrator with the vaulted password succeeds
TC-2 Credential vault linkage Query Credential for this site after the stage Exactly one DB Password and one Admin Password record exist, linked to the correct site
TC-3 No plaintext leakage Grep all logs/error_log/Onboarding Request fields for either generated password Not found in plaintext anywhere
TC-4 Password uniqueness Onboard two different clients, compare their generated Admin passwords Different, no reuse
TC-5 Version pinning Run stage twice on different days without changing config Both produce the same target Frappe version, not "whatever's latest today"
TC-6 Site creation failure Simulate a bench new-site failure (e.g. DB connection refused) Stage fails with the real underlying error surfaced, not swallowed

No data to display

Actions
Copy link

Also available in: PDF Atom