Admin & Server Manual

Start here

About this manual

Everything needed to run SOiL's internal systems — the staff portal, the dashboards, the domain, email, and remote access to Sage Evolution — written so that someone new could pick it up and keep things running.

It is in two parts. Part A (Admin User) is for the person who manages the portal day to day — staff access, the dashboards, HR records. Part B (Server Administrator) is for whoever maintains the underlying infrastructure — the domain, Cloudflare, deployments, and the Sage server.

Passwords are not written into this document. Where a real secret is needed it shows 🔒 in Bitwarden — meaning the value lives in Bitwarden, SOiL's password vault (see the Credential register). Keep that rule: this page is gated, but documents get copied and shared, so secrets stay in Bitwarden.

Start here

System overview

SOiL runs four things you need to understand. They are independent — a problem in one rarely affects the others.

Start here

Quick links

Part A — Admin User Guide

The portal & login

The portal is the front door for staff. It lives at hub.soiloils.com and branded as Veld Botanicals — Elements of Wellness.

How staff log in

Each person signs in with a personal username and a shared password. The username controls their name, role label, and which dashboards they see; the password is currently the same for all staff (the general portal PIN — 🔒 in Bitwarden).

Adding, removing, or editing a portal user

Users are defined in a list near the top of the hub's code. To change them you edit the hub file and redeploy.

1. Open soiloils-hub/index.html in a text editor.
2. Find the block of lines that look like:

   { username: "natalie", password: "••••••", name: "Natalie",
     role: "Admin", access: ["people","performance","production"] },

3. Copy a line, change username, name, role, and access. To remove someone, delete their line (or put // at the start to disable it).
4. access is the list of dashboards that person can open — use any of people, performance, production.
5. Save, then redeploy the hub (see Dashboards & deploys).

Part A — Admin User Guide

The dashboards

Three dashboards hang off the portal. Each is a self-contained page; staff reach them through the tiles on the hub once logged in.

Part A — Admin User Guide

HR employee records

The People dashboard has an Employee Records tab holding each employee's statutory details:

• V number — the internal employee number (e.g. V002).
• ID number — the SA ID; the first six digits are the date of birth, which the dashboard works out and displays automatically.
• Tax number — SARS income-tax reference.
• UIF reference — the company UIF reference.

The fields are locked by default

To prevent accidental edits, these fields are read-only until an admin unlocks them. There is a separate HR admin password for this (🔒 in Bitwarden — distinct from the portal login).

1. Open the Employee Records tab.
2. Click Unlock and enter the HR admin password.
3. Fields become editable, and the Add employee button appears.
4. Make your changes — they save automatically. The lock re-engages when you reload.

Part A — Admin User Guide

Sage remote access (for staff)

Finance staff who are authorised can open the Sage Evolution desktop in a browser tab — no software to install. From the portal's Systems & Access section, click Sage Evolution — Remote Access (or go to the App Launcher at bold-frost-4f30.cloudflareaccess.com).

They will be asked to sign in twice:

1. Cloudflare gate — enter your authorised work email; a one-time PIN is emailed to you; enter it.
2. Windows login — username .\sageuser and the Sage Windows password (🔒 in Bitwarden).

Only emails on the approved list can pass the first gate. To add or remove someone, the server admin edits the policy (Part B). The full technical setup is in Part B and in the file sage-browser-rdp-setup.md.

Part B — Server Administrator Guide

Accounts & credentials

Before touching anything, know where the keys are. SOiL's systems rest on a small number of accounts:

All passwords for these live in Bitwarden, not in this file (see the Credential register). If you are taking over and do not have access to the Bitwarden vault, that is the first thing to obtain from the outgoing owner.

Part B — Server Administrator Guide

Cloudflare account

Cloudflare is the hub of everything. One free-tier account holds the domain's DNS, every dashboard (as "Pages" projects), and the Sage remote-access setup (under "Zero Trust").

Part B — Server Administrator Guide

Domain & DNS

The domain soiloils.com is registered at xneelo, but its DNS is delegated to Cloudflare. That means: domain renewal and mailboxes are managed at xneelo; everything else (which address points where) is managed in Cloudflare → DNS → Records.

What points where

Part B — Server Administrator Guide

Email — the thing you must not break

Company email is hosted at xneelo; Cloudflare only carries the DNS records that route mail. If those records are wrong, email stops. Treat them as sacred.

Part B — Server Administrator Guide

Dashboards & how to deploy them

Each website is a Cloudflare Pages project. The source is a folder of files on the work computer; "deploying" means uploading that folder so the live site updates.

Deploy by drag-and-drop (the reliable method, ~30 seconds)

1. Go to dash.cloudflare.com → Workers & Pages → open the project (e.g. soiloils-hub).
2. Click Create new deployment.
3. Drag the whole project folder onto the upload area and confirm.
4. Wait for "Success". The live site updates within a minute.

Part B — Server Administrator Guide

Sage remote access — how it works

Goal: let authorised staff use the Sage Evolution desktop from any browser, securely, with no software install. The pieces:

• The server — a PC on-site called soil-server running Sage Evolution and Windows Remote Desktop.
• Cloudflare Tunnel — a small program (cloudflared) on that PC that makes a secure outbound connection to Cloudflare. No router ports are opened. Tunnel name sage-evolution-pc.
• Browser-based RDP — Cloudflare's Access-for-Infrastructure feature renders the Windows desktop in the browser. Free under 50 users.
• The gate — a Cloudflare Access policy that emails a one-time PIN, restricted to an approved email list.

To authorise a new person for Sage

1. Cloudflare → Zero Trust → Access → Applications → open the Sage app → its policy Sage Authorized Staff.
2. Add their work email to the Include → Emails list. Save.
3. Give them the Windows login (.\sageuser + password) separately and securely.

Part B — Server Administrator Guide

The Sage server (soil-server)

The Sage remote login account

Staff log into the Sage desktop with a dedicated account, sageuser, created so the main admin account stays separate. If you ever need to recreate it, open PowerShell as Administrator on the server and run:

net user sageuser <STRONG_PASSWORD> /add
net localgroup "Remote Desktop Users" sageuser /add
wmic useraccount where "name='sageuser'" set PasswordExpires=false

Then record the password in the vault. The Sage tile login is .\sageuser + that password.

If Sage remote access stops working

Almost always the server, not Cloudflare. The most common cause is the PC being off, asleep, or the Remote Desktop listener not running after an update. Check, on the server:

Test-NetConnection 192.168.2.100 -Port 3389

If TcpTestSucceeded is False, Remote Desktop is not listening — reboot the server (after hours; it is the live Sage box). After reboot the same command should return True, and the Sage tile will work again. Keep the PC set to never sleep.

Part B — Server Administrator Guide

Routine maintenance

Reference

Credential register

Passwords are deliberately not printed here. This table lists every credential, who/what it is for, and where the actual value is kept. All real values live in Bitwarden, SOiL's password vault (free, set up as described below).

Setting up the vault (Bitwarden)

SOiL uses Bitwarden — a free, open-source password manager — as the single home for every secret in this manual.

1. Create the account. Sign up at bitwarden.com with a strong master password that is not reused anywhere else. This master password is the one thing never written down digitally — memorise it.
2. Turn on two-factor authentication (Settings → Security → Two-step login).
3. Add every credential from the register above as a Bitwarden item: Cloudflare login + recovery codes, the Cloudflare API token, xneelo/konsoleH, .\sageuser, the server admin accounts, the portal PIN, the HR unlock, and this manual's password.
4. Share with one trusted colleague. Bitwarden's free plan includes a 2-person Organisation — create one, put the SOiL credentials in a shared collection, and invite a second trusted person (e.g. a manager). This ensures the company is never locked out if one person is unavailable.
5. Make a break-glass backup. Print the credential list once, seal it in an envelope, and store it in a locked drawer or safe at the office — for the rare case nobody can reach Bitwarden itself.

Changing this manual's password

Open soiloils-hub/admin-manual.html, find the line near the bottom that reads const ADMIN_PW = "…";, change the value, save, and redeploy the hub. Record the new value in the vault.

Reference

Troubleshooting

Reference

Glossary