Chapter 35 / 40
The launchpad
The launchpad is the one page a Sodimo employee bookmarks. Everything internal — the CRM, the AI chat, the mail archive, the admin console, this manual — is reachable from one grid of tiles on one URL. Open the tile, the service loads. No VPN client to install, no password to remember beyond the Google Workspace account.
Status: Planned — the launchpad page itself is a small static site that activates once the Framework Desktop is racked and the first on-prem services go live. The URL is reserved (dash.sodimo.eu); the tiles light up as each backing service comes online.
How to reach it
The launchpad lives at dash.sodimo.eu. Open it in any browser, on any device, anywhere — office laptop, home laptop, phone on 4G.
The first time you visit in a new browser, Cloudflare Access intercepts the request and asks you to log in with your @sodimo.eu Google Workspace account. Pick the account, approve the prompt, and the launchpad loads. The session lasts a working day; after that, the next visit sends you through Google again.
That is the entire login flow. There is no separate dashboard password. There is no second-factor prompt beyond whatever Google Workspace already enforces for your account. The Google login is the credential for every internal tool on the launchpad — once you are through the gate, the tiles work.
What is on the launchpad
The tiles are grouped into two sections: Work tools (the ones every employee uses every day) and Admin tools (the ones Rani, Paul, or Thomas touch occasionally). The ordering matches what people reach for most often.
Work tools
| Tool | URL | What it does | Who uses it |
|---|---|---|---|
| Twenty CRM | crm.sodimo.eu | Contacts, pipeline, deals, activity timeline. The single place for customer-facing state. | Rani (primary), sales team |
| OpenWebUI | chat.sodimo.eu | Team chat with the local AI models. Ad-hoc questions, summaries, drafts — nothing leaves the building. | Everyone |
| Piler | mail.sodimo.eu | Searchable archive of every email Sodimo has sent or received. Retention is indefinite. | Rani, Paul, anyone doing a lookup |
| Paperclip | agents.sodimo.eu | Dashboard for scheduled agents — morning briefs, nightly drafts, overnight collections. Shows last-run status and upcoming runs. | Paul, Rani (consumer of output); Thomas (author) |
Admin tools
| Tool | URL | What it does | Who uses it |
|---|---|---|---|
| Cockpit | admin.sodimo.eu | The Framework Desktop admin console. Services, logs, disk, network — the view of the box itself. | Thomas; Rani for basic checks |
| Manual & changelog | changelog.sodimo.eu | This site. The living manual plus the append-only release feed. | Everyone, for reference |
| Grafana (if applicable) | metrics.sodimo.eu | Runtime metrics for the harness and the agent runs, when monitoring is wired. | Thomas; Paul via the savings-study dashboard |
Every URL above goes through the same Cloudflare Access gate. If you can log in to one, you can log in to all of them.
The access model, in one paragraph
Cloudflare sits in front of every on-prem URL. A request to crm.sodimo.eu reaches Cloudflare first; Cloudflare Access checks your Google Workspace session and either waves you through or sends you to log in. If approved, Cloudflare opens a pre-established tunnel from the Framework Desktop out to Cloudflare’s edge (the box never opens an inbound port — it dials out and stays connected) and the request flows through that tunnel. The service itself believes it is talking to a local visitor.
One login, one gate, every tool — for the whole team.
Who this does not apply to. Thomas reaches the box a second way, directly over Tailscale, for SSH and deeper configuration work. That path is not on the launchpad because it is not for employees — it is the maintenance door, not the front door. Sodimo staff do not need Tailscale installed on their laptops to do their jobs.
If a tool is not loading
The whole launchpad is down. First check whether sodimo.eu itself loads — if the public site is down, the problem is at Cloudflare or the domain, and every Sodimo service is affected. If the public site works but the launchpad does not, the Cloudflare tunnel from the Framework Desktop is probably unhealthy. Message Thomas; in the meantime, email still works (Gmail / the mail stack are on a different path).
One tile loads, another does not. Cloudflare Access is up (you got through the login), so the outer gate is fine. The specific service is the problem — usually a container that needs a restart. Message Thomas with the name of the tile. If it is Rani or Paul asking during working hours, Cockpit (admin.sodimo.eu) is where a service restart happens, and the service logs explain what broke.
The Google login loops forever. Your Google Workspace session is probably expired or the wrong account is selected. Open an incognito window, pick the @sodimo.eu account explicitly, and try again. If the incognito window works, clear Cloudflare Access cookies in your normal browser (Settings → Privacy → Clear browsing data → Cookies for cloudflareaccess.com) and log in fresh.
A specific service says “Access denied” after login. Your Google account is not on the allowlist for that tool. Ask Thomas (during the engagement) or whoever owns Cloudflare Access after handoff. The fix is a one-line edit to the Access policy.
Why the launchpad exists
Every tool on the list has its own URL, its own interface, and its own chapter elsewhere in this manual. The launchpad exists so the employee does not have to remember any of that. One bookmark. One login. Everything one click away.
It also sets the convention for the handoff. A future Sodimo engineer who adds a new internal tool adds a new tile to the launchpad and a new chapter to this manual — and the team learns the tool without a meeting.