# InvenTree — Cloudron Package

[InvenTree](https://github.com/inventree/InvenTree) v1.5.2 — open-source
inventory management: parts and stock, BOMs, suppliers, purchase/build
orders, plugins, REST API. Django + PostgreSQL + Redis(RQ). Packaged as
an **official-image wrapper** around `inventree/inventree:1.5.2`
(digest-pinned). Upstream runs server and worker as separate compose
services; Cloudron is one container, so start.sh backgrounds
`invoke worker` gated on the web port (same pattern as NetBox).

## Authentication (auth gate: ✅ OIDC preferred)

django-allauth is built into core; `INVENTREE_SOCIAL_PROVIDERS`
(settings.py:1002) carries provider config. start.sh builds the
`openid_connect` provider from the Cloudron platform env:

```json
{"openid_connect": {"OAUTH_PKCE_ENABLED": true, "APPS": [{
  "provider_id": "cloudron", "name": "Cloudron SSO",
  "server_url": "<CLOUDRON_OIDC_ISSUER>", "client_id": "...", "secret": "..."
}]}}
```

- SSO login route: `https://<app-domain>/accounts/oidc/cloudron/login/`
- LDAP is also available in core (`INVENTREE_LDAP_*`) as an alternative.
- Local login remains for the admin.

**First-boot admin**: a local `admin` account is seeded with a
generated password stored at `/app/data/.admin_password` (read it via
the Cloudron file manager). Change it after first login, or set
`INVENTREE_ADMIN_EMAIL`/`INVENTREE_ADMIN_PASSWORD` app env vars to
control the seed yourself.

## Runtime layout

| Concern | How |
|---------|-----|
| Database | Cloudron `postgresql` addon |
| Cache/queues | Cloudron `redis` addon (cache DB 1; RQ default DB 0) |
| Schema + static | `invoke update` on every boot (migrations + collectstatic) |
| Worker | `invoke worker` backgrounded, gated on web port (post-migration) |
| Persistence | `/app/data` (localstorage): media/, static/, config.yaml, secret key, admin password |
| Health | `/api/system/health/` (upstream's own unauthenticated endpoint) |

## Notes

- Version upgrades: bump tag+digest, rebuild — `invoke update` migrates
  on first boot.
- The image ENTRYPOINT's venv logic is bypassed (deps are baked in the
  image); start.sh controls ordering instead.
- Package pattern + verification: repo `JOURNAL.md`, InvenTree section.