ERP SaaS Dedicated Tenant Architecture & Roadmap

Overview

Dokumen ini menjelaskan roadmap transformasi ERP menjadi SaaS menggunakan pendekatan:

Single Codebase
Dedicated Application per Tenant
Dedicated Database per Tenant
DNS-based Tenant Isolation
SaaS Control Plane
Licensing Service per Tenant
Future Infrastructure as Code (IaC)

Pendekatan ini dipilih untuk meminimalkan perubahan pada existing ERP monolith dan memberikan isolasi tenant yang tinggi.

Lihat juga: Licensing Service Architecture Proposal — detail desain License Service, kontrak integrasi ERP, struktur license file, dan rencana ekspansi fitur.

Target Architecture

Design Principles

Setiap customer memiliki Application Instance sendiri.
Setiap customer memiliki Database sendiri.
Tenant diisolasi melalui DNS dan deployment.
ERP Application tidak perlu tenant-aware.
Tidak diperlukan Tenant Resolver.
Portal bertindak sebagai SaaS Control Plane.
Provisioning dilakukan melalui Portal.
Setiap tenant memiliki License Service sendiri — licensing adalah platform concern, bukan ERP business concern.
ERP hanya mengkonsumsi entitlement melalui ILicenseProvider; tidak mengetahui cara lisensi di-generate atau di-sign.
Portal terdiri dari beberapa service internal yang berbagi satu Portal Database.

Portal Services

Portal (portal.erp.com) adalah SaaS Control Plane yang terdiri dari service-service berikut, semua berbagi satu Portal Database:

Service	Tanggung Jawab
Tenant Management Service	Tenant registry, onboarding, status tenant
Article Management Service	Konten knowledge base, dokumentasi, announcement
License Management Service	Generate, sign, renew, revoke license
Subscription Management Service	Trial, monthly, annual, perpetual, support contract
Provision Management Service	Ticketing provisioning, koordinasi support team, tracking status

flowchart TD

    Portal[portal.erp.com]

    Portal --> TenantSvc[Tenant Management Service]
    Portal --> ArticleSvc[Article Management Service]
    Portal --> LicenseSvc[License Management Service]
    Portal --> SubSvc[Subscription Management Service]
    Portal --> ProvisionSvc[Provision Management Service]

    TenantSvc --> PortalDB[(Portal Database)]
    ArticleSvc --> PortalDB
    LicenseSvc --> PortalDB
    SubSvc --> PortalDB
    ProvisionSvc --> PortalDB

Semua service Portal membaca dan menulis ke satu Portal Database — tidak ada database terpisah per service pada tahap ini. Pemisahan dapat dilakukan di masa depan jika ada kebutuhan skalabilitas per service.

Phase 1 - SaaS Foundation

Objectives

Menyediakan onboarding customer.
Menyediakan tenant registry.
Menyediakan provisioning workflow.
Menjaga ERP existing tetap minim perubahan.
Mendeploy License Service per tenant saat provisioning.
Mengimplementasi Portal License Management (generate & sign license).

Architecture

flowchart TD

    Portal[portal.erp.com]

    subgraph Portal Services
        TenantSvc[Tenant Management Service]
        LicenseSvc[License Management Service]
        SubSvc[Subscription Management Service]
        ProvisionSvc[Provision Management Service]
        ArticleSvc[Article Management Service]
    end

    Portal --> TenantSvc
    Portal --> LicenseSvc
    Portal --> SubSvc
    Portal --> ProvisionSvc
    Portal --> ArticleSvc

    TenantSvc --> PortalDB[(Portal Database)]
    LicenseSvc --> PortalDB
    SubSvc --> PortalDB
    ProvisionSvc --> PortalDB
    ArticleSvc --> PortalDB

    ProvisionSvc --> Ticket[Provisioning Ticket]

    Ticket --> Support[Support Team]

    Support --> DNSA[Create DNS]
    Support --> APPA[Deploy ERP Instance]
    Support --> DBA[Create Database]
    Support --> LICA[Deploy License Service + license.lic]

    DNSA --> ClientA[client-a.app.erp.com]

    ClientA --> AppA[ERP Instance A]

    AppA --> LicenseA[License Service A]
    AppA --> DbA[(ERP Client A DB)]

    LicenseSvc --> LicenseA

    DNSB[Create DNS]
    APPB[Deploy ERP Instance]
    DBB[Create Database]
    LICB[Deploy License Service + license.lic]

    Support --> DNSB
    Support --> APPB
    Support --> DBB
    Support --> LICB

    DNSB --> ClientB[client-b.app.erp.com]

    ClientB --> AppB[ERP Instance B]

    AppB --> LicenseB[License Service B]
    AppB --> DbB[(ERP Client B DB)]

    LicenseSvc --> LicenseB

Licensing in Phase 1

Setiap tenant deployment menyertakan:

License Service — sidecar/local service per tenant yang membaca dan memverifikasi license.lic
license.lic — file lisensi yang di-sign oleh Portal menggunakan private key
ILicenseProvider — kontrak yang digunakan ERP untuk mengkonsumsi entitlement

flowchart LR

    ERP[ERP Instance]
    LS[License Service]
    LIC[license.lic]
    DB[(ERP Database)]

    ERP --> LS
    LS --> LIC
    ERP --> DB

Portal License Management mengelola:

Generate license payload per tenant
Sign license dengan private key
Distribusi license.lic ke License Service tenant

Phase 1 tidak mengimplementasikan: online activation, machine fingerprint enforcement, concurrent user enforcement.

Detail lengkap: Licensing Service Architecture

Runtime Access Flow

sequenceDiagram

    participant User
    participant DNS
    participant ERP
    participant Database

    User->>DNS: client-a.app.erp.com

    DNS->>ERP: Route Request

    ERP->>Database: ERP Client A Database

    Database-->>ERP: Data

    ERP-->>User: Response

Tenant Registry Structure

Tenant Registry

- Tenant ID
- Tenant Code
- Company Name
- Subscription Plan
- DNS URL
- Application Instance
- Database Name
- Status
- Created Date

Example:

Tenant	URL	Application	Database
client-a	client-a.app.erp.com	erp-app-a	erp_client_a
client-b	client-b.app.erp.com	erp-app-b	erp_client_b

Phase 2 - Automated Provisioning

Objectives

Menghilangkan provisioning manual.
Mengurangi keterlibatan support team.
Mempercepat onboarding customer.
Mengotomasi generate, sign, dan deploy license saat provisioning.
Mendukung subscription lifecycle (trial, renewal, revoke) dari Portal.

Architecture

flowchart TD

    Portal[portal.erp.com]

    subgraph Portal Services
        TenantSvc[Tenant Management Service]
        LicenseSvc[License Management Service]
        SubSvc[Subscription Management Service]
        ProvisionSvc[Provision Management Service]
        ArticleSvc[Article Management Service]
    end

    Portal --> TenantSvc
    Portal --> LicenseSvc
    Portal --> SubSvc
    Portal --> ProvisionSvc
    Portal --> ArticleSvc

    TenantSvc --> PortalDB[(Portal Database)]
    LicenseSvc --> PortalDB
    SubSvc --> PortalDB
    ProvisionSvc --> PortalDB
    ArticleSvc --> PortalDB

    ProvisionSvc --> Queue[Provisioning Queue]

    Queue --> Provisioner[Provisioning Service]

    Provisioner --> PortalDB

    Provisioner --> Database[Create Database]

    Provisioner --> Migration[Run Migration]

    Provisioner --> Deploy[Deploy ERP Instance]

    Provisioner --> DNS[Create DNS Record]

    Provisioner --> Admin[Create Admin User]

    Provisioner --> LicDeploy[Generate + Deploy License]

    LicenseSvc --> LicDeploy

    Provisioner --> Notification[Provisioning Result]

Provisioning Flow

sequenceDiagram

    participant Customer
    participant Portal
    participant Queue
    participant Provisioner
    participant LicenseSvc as License Management Service

    Customer->>Portal: Create Tenant

    Portal->>Queue: Provision Request

    Queue->>Provisioner: Start Provisioning

    Provisioner->>Provisioner: Create Database

    Provisioner->>Provisioner: Run Migration

    Provisioner->>Provisioner: Deploy ERP Instance

    Provisioner->>Provisioner: Create DNS

    Provisioner->>Provisioner: Create Admin User

    Provisioner->>LicenseSvc: Request License Generation

    LicenseSvc->>LicenseSvc: Generate + Sign license.lic

    LicenseSvc-->>Provisioner: license.lic

    Provisioner->>Provisioner: Deploy License Service + license.lic

    Provisioner-->>Portal: Completed

    Portal-->>Customer: Tenant Ready

Licensing in Phase 2

License di-generate dan di-sign secara otomatis oleh License Management Service saat provisioning
Subscription Management Service menangani: trial, monthly, annual, perpetual
Portal dapat me-renew atau revoke license per tenant tanpa re-provisioning ERP
License Service per tenant menerima update license.lic terbaru dari Portal
Semua state subscription dan license tersimpan di Portal Database

Phase 3 - Infrastructure as Code (IaC)

Objectives

Fully automated provisioning.
Self-service onboarding.
Standardized infrastructure deployment.
License Service dikelola sebagai bagian dari IaC template per tenant.

Architecture

flowchart TD

    Portal[portal.erp.com]

    Portal --> Provisioning[Provisioning Service]

    Provisioning --> Terraform[Terraform]

    Terraform --> DNS[DNS Provider]

    Terraform --> Container[Container Platform]

    Terraform --> Database[Database Platform]

    Terraform --> SSL[SSL Certificate]

    Terraform --> Monitoring[Monitoring]

    Terraform --> Backup[Backup Policy]

    Terraform --> LicService[License Service Deploy]

    Terraform --> Registry[(Tenant Registry)]

IaC template per tenant menyertakan License Service sebagai komponen standar — setiap tenant provisioning otomatis mendapatkan License Service yang terkonfigurasi dengan license.lic yang relevan.

Recommended Deployment Model

Current Stage

flowchart LR

    ClientA[client-a.app.erp.com]
    ClientB[client-b.app.erp.com]
    ClientC[client-c.app.erp.com]

    ClientA --> AppA[ERP Instance A]
    ClientB --> AppB[ERP Instance B]
    ClientC --> AppC[ERP Instance C]

    AppA --> DBA[(DB A)]
    AppB --> DBB[(DB B)]
    AppC --> DBC[(DB C)]

Future Containerized Deployment

flowchart LR

    Portal[portal.erp.com]

    Portal --> Provisioner

    Provisioner --> TenantA[Container A]
    Provisioner --> TenantB[Container B]
    Provisioner --> TenantC[Container C]

    TenantA --> DBA[(DB A)]
    TenantB --> DBB[(DB B)]
    TenantC --> DBC[(DB C)]

SaaS Evolution Roadmap

timeline

    title ERP SaaS Evolution

    Phase 1 : Tenant Portal
            : Tenant Registry
            : Manual Provisioning
            : Dedicated App per Tenant
            : Dedicated DB per Tenant
            : License Management (Portal)
            : License Service per Tenant
            : Feature Entitlement API

    Phase 2 : Provisioning Service
            : Queue Processing
            : Automated Database Creation
            : Automated Deployment
            : Automated DNS
            : Automated License Generation
            : Subscription Management
            : License Renewal & Revoke

    Phase 3 : Terraform / IaC
            : Self-Service Provisioning
            : Automated SSL
            : Monitoring
            : Backup Automation
            : IaC License Service Template
            : Machine Fingerprint (optional)
            : Online License Activation (optional)

    Phase 4 : SaaS Platform
            : ERP
            : POS
            : WMS
            : Clinic
            : HRIS
            : Unified Control Plane
            : Unified License Service

Overview​

Target Architecture

Design Principles​

Portal Services​

Phase 1 - SaaS Foundation

Objectives​

Architecture​

Licensing in Phase 1​

Runtime Access Flow​

Tenant Registry Structure​

Phase 2 - Automated Provisioning

Objectives​

Architecture​

Provisioning Flow​

Licensing in Phase 2​

Phase 3 - Infrastructure as Code (IaC)

Objectives​

Architecture​

Recommended Deployment Model

Current Stage​

Future Containerized Deployment​

SaaS Evolution Roadmap

Overview

Design Principles

Portal Services

Objectives

Architecture

Licensing in Phase 1

Runtime Access Flow

Tenant Registry Structure

Objectives

Architecture

Provisioning Flow

Licensing in Phase 2

Objectives

Architecture

Current Stage

Future Containerized Deployment