This is the company handbook. Everything on it is markdown in the profuse/infra repository, reviewed as a merge request and published here on every change to main — so reading it needs nothing but your identity.

The pages a colleague reads to join, understand and leave the company are also in Romanian, at handbook.guestget.com/ro. English is the original: a Romanian page records the version of the English page it was translated from, and the site refuses to build when the two drift apart.

Start here#

You have one identity, at https://id.profuse.ro: your username, your password, your passkey (Touch ID, Windows Hello, or a security key). Everything below uses it. Nobody will ever send you a password for any of these systems, and none of them accepts one you did not set yourself.

Day one, in order#

Set your password. Open the link you were sent — it works once. Twelve characters or more, and not one that has leaked anywhere; the page checks. You are logged in.
Register your passkey, at https://id.profuse.ro/if/user/ → Settings → MFA devices. From now on it is your second factor everywhere. Register a second one the same day — another device, or a security key you keep somewhere safe. With one passkey and a lost phone you are locked out and somebody has to reset you by hand.
Install Cloudflare WARP (macOS: the App Store or cloudflare.com/warp; Windows and phones the same). Team name profuse, then log in with the identity above. WARP is the network to everything internal — leave it on while you work.
Open https://profuse.cloudflareaccess.com. That page lists everything you can reach. It is the answer to "do I have access to X": if it is not there, your roles do not include it, and nothing is waiting for your request.

This page, and the rest of the handbook, is at https://handbook.guestget.com — bookmark it. It is written and reviewed in the profuse/infra repository and published on every change, so what you are reading is what was last agreed; if a role you hold gives you an account there, the page is also a merge request away from being corrected.

This page, the role catalogue and the offboarding page are also in Romanian, at https://handbook.guestget.com/ro — the link is in the margin of every page. English is the original: each Romanian page records the version of the English page it was translated from, and the site refuses to build when the two drift apart, so the two cannot say different things for long. The quarterly access review is in English only, and says so where the Romanian version would be.

Your mailbox is created the first time you open webmail, and if your roles include GitLab, that account exists within five minutes of them being set. If something in the list below says you do not have access on your very first morning, wait five minutes and try once more before asking.

What you reach, and how#

what	address	with
This handbook: how the company works	https://handbook.guestget.com	your identity. Everyone in the directory can read it, from any device.
Mail and calendar	https://webmail.profuse.ro	the SSO button. Your mailbox is created the first time you open it.
Mail in a client (Mac Mail, phone)	IMAP `mail.profuse.ro:993`, SMTP `mail.profuse.ro:587`	an app password you generate in webmail → Mailbox → App passwords. Never your identity password.
Code, merge requests, pipelines	https://git.profuse.ro	"Sign in with Cloudflare" → your identity. Only the roles that build the product have an account here; if you do not, you are not missing anything you need.
Errors and traces	https://sentry.profuse.ro	the same
The GuestGet app, on staging	https://staging-app.guestget.com	the same
The back-office (organizations, subscriptions, support, invoices)	https://staging-admin.guestget.com	"Sign in with GuestGet ID". What you can do inside comes from your roles; there is no separate password.
Monitoring, Traefik, mail administration, the directory itself	https://zabbix.profuse.ro and the rest	the same, with WARP on: these check that your device is managed (firewall on, disk encrypted)
The server	`ssh <username>@sv1` through WARP	nothing to install or copy; a certificate is issued for each session
The databases	see below	your username and your identity password

Three levels, on purpose: the team's own apps need your identity and passkey, from any device; the operations panels also need a managed device with WARP on; the server and the databases also need the private network. What the launcher shows you is what your roles allow.

Mail that is not only yours#

Some addresses belong to a role rather than a person: support@, billing@, sales@, partners@, hello@, press@, jobs@, hr@, legal@, security@. If your role receives one, it simply arrives in your inbox — there is no second account and no shared password. Reply from your own address unless your team has agreed otherwise. When you change roles, the mail follows.

Databases#

Reachable only through WARP, and only for the roles that need them:

database	host (through WARP)	port	database name	who, and how
staging	`10.200.0.3`	`5432`	`guestget_staging`	infra and tech-leads read/write · developers and qa read-only
production	`10.200.0.2`	`5432`	`guestget`	infra read/write · tech-leads read-only

Username: your username. Password: your identity password. The database asks the directory each time; nothing about you is stored in it.
TLS: required. Set the client to verify-full with the server's certificate as the CA, so you know you are talking to our server and not to something in between. The two certificates are in this repository, hosts/sv1/postgres/staging.crt and hosts/sv1/postgres/prod.crt (public material, valid to 2036). Save them under ~/.postgresql/.
Your role appears within five minutes of your account being given it. If the database says the role does not exist, wait, then ask whoever set up your account.

Navicat, TablePlus and the like: host, port, database and username as above, your identity password, then the SSL tab — "Use SSL", authentication "CA" with the certificate file, mode verify-full. psql:

psql "host=10.200.0.3 port=5432 dbname=guestget_staging user=<username> sslmode=verify-full sslrootcert=staging.crt"

Forgetting, changing, leaving#

Forgot your password: ask anyone in the people or infra role. They open your account at https://id.profuse.ro/if/admin and generate a recovery link, which is useless to anyone but you and expires. Nobody can read your password, and nobody will invent one for you.
New laptop or phone: log in on it and WARP will ask for a passkey. Register the new device's passkey while you still have the old one — see day one, step 2.
New role, or a role removed: whoever manages people changes it in the directory. Access to panels changes at your next login, the database and GitLab within five minutes, mail within fifteen. Nothing for you to do.
When you leave, your account is switched off in one place and everything above closes at once (offboarding.md). Your mailbox is kept for the retention period, then archived; your merge requests and issues keep your name on them.
Working with us without joining (a contractor): you get a time-limited login to staging with a code sent to your e-mail, approved each time by the person you work with, and no identity here. Ask them to add your address to cloudflare/accounts/profuse/contractors.auto.tfvars.