Building Managed Odoo Infrastructure in Kenya: What We Shipped This Week (August 5, 2026) 🛠️🇰🇪

Building managed multi-tenant infrastructure for Odoo in Kenya comes with a unique set of engineering challenges. Beyond handling high uptime and container orchestration, local SaaS platforms must integrate reliably with regulatory APIs like the Kenya Revenue Authority (KRA) eTIMS and local payment gateways like M-Pesa.

Here is an engineering deep-dive into what we updated, refactored, and fixed under the hood across JengaStack this week.

1. Resolving Odoo ORM Tax Group Errors in POS & Zero-Downtime Migration

The Issue

During Point of Sale (POS) checkouts, an edge-case bug occurred around account.tax.group mapping for KRA eTIMS tax rates. In Odoo's financial engine, improper tax group assignments can prevent invoice payload generation or result in XML schema validation failures when submitting invoices to KRA's API.

The Fix

1. ORM-Level Patching: Corrected the tax group associations within custom eTIMS modules so that POS checkout flows dynamically map tax groups without dropping validation fields.
2. Automated Tenant Patching Script (fix_tenant_taxes.py): Rather than requiring manual database migrations or taking down tenant instances, we deployed an automated Python migration script:
   • Connects via Odoo's internal environment context (odoo.api.Environment).
   • Iterates across isolated tenant schema/databases.
   • Updates account.tax references transactionally and commits without requiring instance restarts.

2. CI/CD Hardening & Vulnerability Patching with uv

Security hygiene in a multi-tenant cloud environment requires proactive dependency management.

• Core Package Upgrades: Upgraded key backend libraries—including cryptography, WeasyPrint (used for PDF report generation), and Pygments—to address recently published CVEs.
• Pipeline Audits with uv: Integrated uv into our GitHub Actions / CI pipeline for ultra-fast dependency resolution and automated auditing (uv pip audit). Any pipeline with vulnerable transitive dependencies is flagged before reaching staging or production.

3. Modernizing Internal Tooling: Portainer → Dockhand + Authentik SSO

As infrastructure scales, managing endpoints via raw IPs creates friction and expands the attack surface.

• Domain Migration: Fully transitioned all management subdomains (app.jengastack.app and auth.jengastack.app) to HTTPS behind reverse proxy routing with automatic Let's Encrypt renewal.
• Replacing Portainer with Dockhand + Authentik:
  • Retired legacy Portainer instances in favor of Dockhand paired with Authentik SSO.
  • Enforced centralized identity management (OIDC), multi-factor authentication (MFA), and role-based access control (RBAC) across all container nodes.
• Observability & Analytics Routing: Resolved SSL routing bottlenecks on telemetry endpoints and refined health probe thresholds to eliminate false-positive restart triggers during peak database IOPS.

4. Resilience Patterns for Third-Party APIs & RPC Bug Fixes

Network volatility between cloud servers and external government endpoints is an inevitable reality.

Circuit Breakers for eTIMS API Drops

When KRA eTIMS endpoints experience latency or intermittent drops, unhandled timeouts can cascade and block checkout threads in Odoo.

• Extended our custom eTIMS integration with an explicit Circuit Breaker pattern.
• Intercepts connection drop exceptions, fails gracefully without crashing POS threads, and queues fiscal requests in a background worker queue for retry upon service recovery.

Odoo RPC & Asset Pipeline Fixes

• OdooRPCError: cannot marshal None: Fixed a serialization error where XML-RPC / JSON-RPC responses returned None types on null-returning controller methods.
• Staticfiles Manifest Handling: Handled missing file manifest exceptions gracefully during asset compilation, preventing broken UI assets during rolling backend deployments.

Key Takeaways

1. Automate schema and data updates: If you run multi-tenant software, build CLI/Python script runners that can patch live tenant databases transactionally.
2. Build for network resilience: When relying on external regulatory or payment APIs, always wrap HTTP calls in circuit breakers and resilient background queues.
3. Streamline internal IAM early: Moving management tools behind centralized SSO (Authentik) with strict HTTPS subdomains drastically reduces ops overhead and improves platform posture.

---

Are you building cloud platforms or running Odoo in production? Let me know in the comments how you handle zero-downtime tenant updates and third-party API resilience!