Internal guide · Naijm platform
Naijm is the company. Rafiq is its Agentic Assistant — a helpful AI agent in Slack — backed by a web console that manages accounts and deployments, and an internal GitLab where your code lives. This page gets you access to all three, usually in under an hour.
Naijm is the company; these are the three pieces of it you’ll actually touch day to day. Each one is simple on its own.
The company’s AI agent, waiting in your Slack DMs. Rafiq (Arabic for “companion”) builds and deploys apps, researches topics, writes documents, monitors things on a schedule, and answers questions about how the platform works.
You interact with it by mentioning it in a DM or a channel where it is invited.
A web app at console.naijm.com that manages your account, your GitLab connection, service registration, publication of deployed apps, and the agent instructions everyone shares.
Reachable only from the private tailnet — see step 1 below.
The assistant runs on Hermes Agent (by Nous Research). It acts as you — with your account, your permissions and your credentials — and nothing is shared between teammates.
Follow them in order. Steps 1–2 need a human admin; the rest you can do yourself or with the assistant's help.
Everything internal — the console, deployed apps, GitLab — lives on our private Tailscale network (the "tailnet"). Nothing is exposed to the public internet.
https://gitlab.naijm.com — if the GitLab sign-in page loads, you are on the tailnet.The console is at https://console.naijm.com. An admin creates your account and tells you your username.
Now connect Slack to the console — this is how Rafiq knows who you are:
linklink again for a fresh one.Our code lives on an internal GitLab server (https://gitlab.naijm.com). You get a personal namespace there — for example samuelcardillo or arthur-maquet. To let Rafiq push code, create repositories and deploy with your identity, connect a legacy personal access token:
/-/user_settings/personal_access_tokens), then Add new token.naijm-console), pick an expiry you are comfortable renewing, and select the legacy scopes api, read_repository and write_repository — the same set the platform itself runs on.glpat-…).Paste the token only into the console — never into Slack or chat. Rafiq never asks for tokens in a conversation.
Your Slack and console accounts are linked — Rafiq can now act for you. Give it something real:
That's it — you're onboarded. The rest of this page explains each area in more depth.
Rafiq is a teammate, not a search box. The clearer the request, the better the result.
my-team/landing on port 18100 and publish it to the tailnet."/new in the chat begins a new conversation with a clean context.link to Rafiq any time you need to (re)connect your Slack and console accounts — each URL it returns is valid for 5 minutes.The control room for accounts, connections and deployments. You'll rarely need it day-to-day — the assistant does most console actions for you — but it helps to know what lives there.
https://console.naijm.com
Your profile, username and console role. Admins manage accounts for the whole team.
Link your GitLab identity once; every assistant action afterwards runs with your access.
Registered apps, their deployment pipelines, publication routes and live status.
Owners can grant teammates permission to redeploy a specific app without owning it.
The shared "how the assistant behaves" policy, plus your personal additions.
Apps publish to the private tailnet by default; public exposure is an explicit, deliberate request.
Our internal GitLab hosts all project code. You can use it like any Git forge — and the assistant can do the tedious parts for you.
https://gitlab.naijm.com
samuelcardillo/…). Your projects are private by default..env, tokens, keys and credentials never belong in source. Every publish is secret-scanned.Deployments on Naijm follow one tracked path — you never deploy by "just pushing":
Pushing new source code never triggers a deployment by itself. Ask the assistant: "redeploy my app" — it handles the rest.
A realistic first-week task: get something you built running on the tailnet. Total effort: one Slack conversation.
Put your app in your GitLab namespace. Review what you commit: no .env files, no tokens, no database dumps. A README.md and a .gitignore are good hygiene — the secret scanner is not optional.
"Register my project firstname/dashboard as a Naijm service called dashboard on port 18100." Registration validates repo access and port conflicts — nothing is deployed yet.
"Deploy dashboard." Rafiq runs one deployment request with a stable identifier, waits for the CI pipeline, and checks its health evidence. Retries reuse the same request — never a blind second trigger.
"Publish dashboard to the tailnet." You get the managed HTTPS URL back — and Rafiq verifies the actual page renders before reporting success. Public (internet-wide) access always needs an explicit request from you.
Push source updates freely — then ask for a redeploy when you want them live. Need to stop it? "Undeploy" stops the app and removes its routes but keeps code and data. "Delete" is owner-only and always previews exactly what will be removed first.
Bookmark this section — it's the whole page in five lines.
Rafiq
start a DM, or @-mention it in an invited channel
https://console.naijm.com
accounts · GitLab connections · services · publication
https://gitlab.naijm.com
personal namespaces · private repos · CI pipelines
https://llm.naijm.com/v1
OpenAI-compatible API — request your key from an admin
send "link" to Rafiq
returns a connect URL — valid 5 minutes
Samuel Cardillo
tailnet invites · console accounts · anything access-related
Private (tailnet)
public access only via explicit request
The things people actually ask in week one.
You're almost certainly not on the tailnet (or Tailscale is signed out). Install/launch Tailscale and sign in; if you were never invited, ask Samuel. console.naijm.com, gitlab.naijm.com and llm.naijm.com look like normal names but resolve only inside the tailnet — private by design.
Nothing lost — send link to Rafiq again. Every URL Rafiq returns is valid for 5 minutes, so click it promptly.
Create a fresh legacy personal access token with the same scopes (api, read_repository, write_repository) and paste it into the GitLab token field on your console profile — same flow as onboarding. Rafiq picks up the new identity immediately.
Yes — the API base is https://llm.naijm.com/v1 (OpenAI-compatible). Ask an admin for an API key, keep it out of your repositories, and you're set.
No. It uses the credentials connected to your profile, acts within your permissions, and asks before destructive or public changes. Stop requests are honoured immediately.
Source pushes never deploy by themselves. Ask the assistant to redeploy the service; it runs one tracked pipeline and verifies the result. Avoid triggering a second deployment if the first one's outcome is unclear — retries reuse the same request.
Undeploy stops the app and removes its sharing routes, keeping all source and data. Delete removes the registration (and, if you ask for "entirely", the data directory and the GitLab repository too) — and only the app's owner can do it, even admins can't delete someone else's app.
Not verified yet. A running process with no published, verified URL is not "live". Ask the assistant to publish it and confirm the URL verification result.
Yes, but only through an explicit request — private tailnet publication is the default for everything. Say "publish publicly" and Rafiq will treat that as deliberate authorization.
For destructive actions (like deletion) the tools require a preview-then-execute sequence with a confirmation token. It's a safety rail, not bureaucracy: you see exactly what will be removed before anything happens.