-
+
-**A sovereign, browser-native AI operating system.**
-Log in with your identity → your entire operation as apps on one desktop. No install. Any device. One login.
+# Atlas OS
-[](https://command.atlascorporation.nl/os/)
-[](#-the-app-catalog)
-[](./docs/security.md)
-[](https://auth.atlascorporation.nl)
-[](./LICENSE)
+[](https://command.atlascorporation.nl/os/)
+[](./SERVICES.md)
+[](./SERVICES.md)
+[](./ARCHITECTURE.md)
+[](./docs/ai-stack.md)
+[](https://git.atlascorporation.nl/chaib/atlas-os/wiki)
+
+**Your entire business running on one hardened Linux server.**
+**One SSO identity. One browser login. One OS.**
+
+[🚀 Live Desktop](https://command.atlascorporation.nl/os/) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md) · [📖 Wiki](https://git.atlascorporation.nl/chaib/atlas-os/wiki)
---
-## What it is
+## What is Atlas OS?
-Atlas OS is what happens when one operator builds an entire private cloud and then puts **one front door** on it. Log in once with [Authentik](https://goauthentik.io) SSO and a desktop boots in your browser — your bank feed, CRM, mail, files, documents, fleet of POS terminals, automation engine and a real Linux remote desktop, all as apps on a single screen.
+Atlas OS is a self-hosted business operating system running on a single Hetzner VPS. One [Authentik](https://goauthentik.io) SSO identity unlocks **39 services** spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind [Caddy](https://caddyserver.com) with automatic HTTPS.
-Not a SaaS. Not a dashboard mockup. A **reviewed execution layer** above the tools you already run — sovereign by design, hostable in our EU cloud **or fully on-premise on your own server**, in the spirit of Citrix / ServiceNow but built for the solo founder and the small team.
+It's the operational spine of **Atlas Corporation** (Tilburg, NL) — built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.
+
+> Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data.
-
- Every department, one screen — apps on a sovereign desktop.
+
+
+
+The Atlas OS desktop — categorized launcher, live cockpit panels, drag-and-drop windows. Served at command.atlascorporation.nl/os/ behind SSO.
+
----
-
-## ✦ The experience
-
-| | |
-|---|---|
-| | |
-| **One partner for every system** — ERP, POS, webshop, hardware, AI as one seamless whole. | **The Atlas platform** — surfaces → workspace → data sources, one reviewed control layer. |
+**What runs on it:**
+- 🏢 Odoo 19 ERP/CRM — full business operations
+- 💶 Firefly III + Enable Banking — bank sync and financial intelligence
+- 📧 Stalwart — self-hosted mail (all domains)
+- 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
+- 🎓 Atlas Academy — courses + lead capture wired to Odoo CRM
+- 🕌 Islamic layer — Adhan at salah times, Quran at logon, family-safe DNS
+- 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
+- 🔒 Authentik — SSO that gates every single service
+- ...and more
---
-## 🗺️ Architecture
+## 🖥️ The Desktop
-One box. One identity. Everything behind it.
+Open `https://command.atlascorporation.nl/os/` on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, a taskbar, and cockpit panels that auto-refresh.
+
+**Remote Linux desktop** (tailnet-only):
+```
+http://atlas-01.tailab40ed.ts.net:8497
+```
+A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device.
+
+---
+
+## 🏗️ Architecture
+
+
+
+
+
+
+
+One box. Caddy is the **sole** public entry point. Every public service passes through Authentik `forward_auth` before it's reached. Root-level access (SSH, the Webtop desktop) is Tailscale-only and never exposed to the public internet.
+
+
+Interactive Mermaid diagram
```mermaid
-%%{init: {'theme':'base','themeVariables':{'primaryColor':'#0c1428','primaryTextColor':'#cfe2ff','primaryBorderColor':'#1F6FE0','lineColor':'#4EA0FF','fontFamily':'monospace'}}}%%
-graph TB
- User([Any device]):::u --> Caddy[Caddy · TLS + edge]:::edge
- Caddy --> Auth{{Authentik SSO}}:::id
- Auth --> OS[Atlas OS desktop]:::os
- Auth --> Apps[39 apps]:::os
- OS --> Mind[The Mind · cockpit + spine]:::ai
- Mind --> Brain[Atlas Brain · reviewed execution]:::ai
- Brain --> Router[LLM router · local → Groq → Claude]:::ai
- Apps --> Stack[Odoo · Nextcloud · Firefly · Paperless · n8n · Forgejo · Vault · Stalwart]:::svc
- Caddy --> Fleet[Fleet · MeshCentral + Tailscale + NATS mesh]:::fleet
- Caddy --> Sites[Client sites · WordPress · POS · Academy]:::site
-
- classDef u fill:#050810,stroke:#4EA0FF,color:#8EC2FF
- classDef edge fill:#0c1428,stroke:#1F6FE0,color:#cfe2ff
- classDef id fill:#145ED2,stroke:#4EA0FF,color:#fff
- classDef os fill:#0c1428,stroke:#4EA0FF,color:#cfe2ff
- classDef ai fill:#0c1428,stroke:#8EC2FF,color:#cfe2ff
- classDef svc fill:#080c18,stroke:#1F6FE0,color:#9fb8e0
- classDef fleet fill:#080c18,stroke:#1F6FE0,color:#9fb8e0
- classDef site fill:#080c18,stroke:#145ED2,color:#9fb8e0
+graph LR
+ subgraph Internet
+ U([User Browser])
+ iOS([iOS / Mobile])
+ end
+ subgraph atlas-01["atlas-01 · Hetzner CPX32"]
+ direction TB
+ C[Caddy TLS]
+ A[Authentik SSO]
+ C -->|forward_auth| A
+ A -->|verified| OS[Atlas OS Desktop]
+ A -->|verified| OD[Odoo ERP]
+ A -->|verified| NC[Nextcloud]
+ A -->|verified| AI[AI Gateway LiteLLM]
+ A -->|verified| FG[Forgejo Git]
+ A -->|verified| MC[MeshCentral]
+ subgraph AIStack["AI Stack"]
+ AI --> OL[Ollama Local]
+ AI --> GR[Groq / Cerebras]
+ AI --> CL[Claude API]
+ AB[Atlas Brain] -->|15min| AI
+ AB --> ST[atlas-state.json]
+ ST --> OS
+ end
+ subgraph MeshNet["Mesh"]
+ NATS[NATS Event Bus] --> TS[Tailscale Devices]
+ end
+ end
+ U -->|HTTPS| C
+ iOS -->|Tailscale| TS
```
+
-Full write-up → **[ARCHITECTURE.md](./ARCHITECTURE.md)** · every container & service → **[SERVICES.md](./SERVICES.md)** · the AI layer → **[docs/ai-stack.md](./docs/ai-stack.md)**
+Full detail in [ARCHITECTURE.md](./ARCHITECTURE.md).
---
-## 🧩 The app catalog
+## 📦 Service Catalog
-39 apps, live-verified (no dead tiles), grouped into a categorized launcher:
+### 🎯 Cockpit (live data panels)
+| App | Description |
+|-----|-------------|
+| Today | AI daily brief + accountability level |
+| Money | Bank transactions via Enable Banking PSD2 |
+| Inbox | Email + WhatsApp drafts, flagged items |
+| Pipeline | Odoo CRM leads and deal status |
+| Fleet | POS terminals, health, last-seen (MeshCentral) |
+| Control | AI kill-switch, autonomy level, daily spend cap |
-| Group | Apps |
-|---|---|
-| **Cockpit** | Today · Money · Inbox · Pipeline · Fleet · Control |
-| **Identity** | Authentik SSO · Vaultwarden |
-| **AI** | Atlas Chat (Open WebUI) · AI Gateway · Mindmap · Leeragent |
-| **Work** | Odoo 19 · CFO · Bank (Firefly) · Paperless · Office · Calendar |
-| **Files & Comms** | Nextcloud · Mail Admin (Stalwart) · Relay |
-| **Ops** | Git (Forgejo) · n8n · Uptime Kuma · MeshCentral · Command · **Remote Desktop** · Architecture |
-| **Sites** | AtlasWorks · Atlas Corp · Agency · **Academy** · AtlasPOS · Hub + client sites |
+### 🛡️ Identity
+| App | Description | URL |
+|-----|-------------|-----|
+| Authentik | SSO, OIDC, MFA — gates all services | [auth.atlascorporation.nl](https://auth.atlascorporation.nl) |
+| Vaultwarden | Self-hosted Bitwarden (iOS app works) | [vault.atlascorporation.nl](https://vault.atlascorporation.nl) |
-> **Remote Desktop** is a genuine Ubuntu XFCE desktop in the browser (Webtop) with Claude Code + Chromium pre-installed — boot Claude or any app, on a sovereign desktop. → [docs/remote-desktop.md](./docs/remote-desktop.md)
+### 🤖 AI
+| App | Description | URL |
+|-----|-------------|-----|
+| Atlas Chat | Open-WebUI — ChatGPT-style on local + cloud models | [chat.atlascorporation.nl](https://chat.atlascorporation.nl) |
+| AI Gateway | LiteLLM proxy — unified OpenAI-compat API | [llm.atlascorporation.nl](https://llm.atlascorporation.nl) |
+| Mindmap | AI-powered visual thinking | [mindmap.atlascorporation.nl](https://mindmap.atlascorporation.nl) |
+| Leeragent | Learning & knowledge agent | [leeragent.atlascorporation.nl](https://leeragent.atlascorporation.nl) |
+
+See the full AI routing stack (local → free cloud → paid) in [docs/ai-stack.md](./docs/ai-stack.md).
+
+### 💼 Work
+| App | Description | URL |
+|-----|-------------|-----|
+| Odoo | ERP + CRM (leads, invoices, customers) | [odoo.atlascorporation.nl](https://odoo.atlascorporation.nl) |
+| CFO / Firefly III | Double-entry bookkeeping + budget intelligence | [cfo.atlascorporation.nl](https://cfo.atlascorporation.nl) |
+| Bank / Enable Banking | PSD2 bank sync (ING, Knab, etc.) | [fidi.atlascorporation.nl](https://fidi.atlascorporation.nl) |
+| Paperless-ngx | Document management + OCR | [paperless.atlascorporation.nl](https://paperless.atlascorporation.nl) |
+| OnlyOffice | Full office suite (Writer, Sheets, Slides) | [office.atlascorporation.nl](https://office.atlascorporation.nl) |
+| Calendar | Nextcloud Calendar (DAV sync to iOS) | [cloud.atlascorporation.nl](https://cloud.atlascorporation.nl) |
+
+### 📁 Files & Comms
+| App | Description | URL |
+|-----|-------------|-----|
+| Nextcloud | File storage, DAV, photos | [cloud.atlascorporation.nl](https://cloud.atlascorporation.nl) |
+| Stalwart Mail | Self-hosted email (SMTP/IMAP/JMAP) | [stalwart.atlascorporation.nl](https://stalwart.atlascorporation.nl) |
+| Relay | Internal message relay service | [relay.atlascorporation.nl](https://relay.atlascorporation.nl) |
+
+### ⚙️ Ops
+| App | Description | URL |
+|-----|-------------|-----|
+| Forgejo | Self-hosted Git — this very repo | [git.atlascorporation.nl](https://git.atlascorporation.nl) |
+| n8n | Workflow automation | [n8n.atlascorporation.nl](https://n8n.atlascorporation.nl) |
+| Uptime Kuma | Service health monitoring | [uptime.atlascorporation.nl](https://uptime.atlascorporation.nl) |
+| MeshCentral | Fleet management + remote access | [mesh.atlascorporation.nl](https://mesh.atlascorporation.nl) |
+| Command | Atlas command dashboard | [command.atlascorporation.nl](https://command.atlascorporation.nl) |
+| Remote Desktop | Webtop full Linux desktop (tailnet-only) | `atlas-01.tailab40ed.ts.net:8497` |
+
+### 🎓 Atlas Academy
+A full education arm running on the same box — courses, coaching, and an ESF/BiSL/AI curriculum at [atlasacademy.nl](https://atlasacademy.nl). Lead capture posts straight into Odoo CRM via the `atlas-academy-relay` service (creates `crm.lead` records), with an email fallback. Product feed is wired to WooCommerce. See [docs/academy.md](./docs/academy.md).
+
+### 🕌 Islamic Layer
+A first-class part of the OS, not an add-on: family-safe DNS (AdGuard Family), Quran at logon, Adhan playback + screen lock at El Feth Tilburg salah times, and recurring sunnah reminders across the device fleet. See [docs/islamic-layer.md](./docs/islamic-layer.md).
+
+### 🌐 Managed Sites
+`atlasworks.nl` · `atlascorporation.nl` · `atlasagency.nl` · `atlasacademy.nl` · `atlaspos.nl` · `atlashub.nl` · `bicosagency.nl` · `budgetenergiecoach.nl` · `hkintercare.nl` · `jouwenergieadvies.nl` · `reclamemans.nl`
---
-## 🛰️ Fleet, mesh & sovereignty
+## 🤖 AI Stack
-- **MeshCentral** — remote management of every client POS terminal and device.
-- **Tailscale** — the private spine; internal services (`tailscale serve`) never touch the public internet.
-- **NATS mesh** — node-to-node messaging across the Atlas estate (round-trip proven).
-- **EU-sovereign** — Hetzner (NL/DE), no US Cloud Act exposure, MFA, nightly backups. → [docs/security.md](./docs/security.md)
+Atlas OS has a 4-tier AI routing stack — zero-cost local first, paid cloud only when needed. Full table and routing decision tree in **[docs/ai-stack.md](./docs/ai-stack.md)**.
+
+| Tier | Example | Use |
+|------|---------|-----|
+| 0 — Local | `atlas-auto` (Ollama on RTX A2000) | Classification, Dutch copy, code, summaries |
+| 1 — Free Cloud | Groq / Cerebras 70B · Gemini (1M ctx) | Fast reasoning, bulk tasks, vision |
+| 2 — Paid | Claude Haiku / Sonnet / Opus | Code, multi-step reasoning, architecture |
+
+**Always-on AI services:** `atlas-brain` (15-min signal cycle), `atlas-loop` (NATS nudges), `atlas-meridian` (autonomous decisions), `atlas-litellm` (unified proxy), Langfuse (full LLM tracing).
---
-## 🎓 Atlas Academy
+## 🚀 Quick Deploy
-[atlasacademy.nl](https://atlasacademy.nl) — the training arm. BiSL, startup, AI and ESF-funded tracks, coaching and a course catalog, with leads relayed straight into Odoo CRM. Part of the same one-identity estate; surfaced as a desktop app.
-
-## 🕌 Atlas Islamic layer
-
-A personal-sovereignty layer for the operator: Adhan at El Feth (Tilburg) salah times, Qur'an at logon, AdGuard Family DNS + content filtering, and sunnah reminders — proof that "sovereign" includes values, not just data residency.
-
----
-
-## 🚀 Deploy your own
+> **Requirements:** Debian 12 or Ubuntu 24.04, a domain with DNS pointed at the server, a Tailscale account.
```bash
-git clone https://git.atlascorporation.nl/chaib/atlas-os.git
+git clone https://git.atlascorporation.nl/chaib/atlas-os
cd atlas-os
-sudo bash deploy/install.sh # Debian/Ubuntu, Docker + Caddy
+chmod +x deploy/install.sh
+./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com
```
-Bring your own domain; point it at the box; Caddy issues certs and Authentik gates everything. Core stack compose lives in [`deploy/compose/atlas-core.yml`](./deploy/compose/atlas-core.yml). Full guide → **[docs/deployment.md](./docs/deployment.md)**.
+The installer sets up Docker, Caddy, Tailscale, and the core compose stacks. After install, configure Authentik at `https://auth.yourdomain.com`, then log in to `https://command.yourdomain.com/os/`. Full guide: [deploy/README.md](./deploy/README.md).
---
-## 📚 Docs & wiki
+## 📁 Repository Structure
-| | |
-|---|---|
-| [ARCHITECTURE.md](./ARCHITECTURE.md) | One-box philosophy, topology, data flows |
-| [SERVICES.md](./SERVICES.md) | All 55 containers + systemd services |
-| [docs/ai-stack.md](./docs/ai-stack.md) | The Mind, the Brain, the LLM router |
-| [docs/remote-desktop.md](./docs/remote-desktop.md) | Webtop desktop + Claude inside |
-| [docs/security.md](./docs/security.md) | SSO gate, sovereignty, secrets model |
-| [docs/deployment.md](./docs/deployment.md) | Stand up the whole stack |
-| **[Wiki ↗](https://git.atlascorporation.nl/chaib/atlas-os/wiki)** | Browsable, page-per-topic |
+```
+atlas-os/
+├── assets/ # Animated header, desktop preview, architecture SVGs
+├── web/os/index.html # The browser OS desktop (production copy)
+├── server/ # Sanitized production Python (atlas_brain, meridian, ...)
+│ └── systemd/ # Service unit files
+├── scripts/ # Export + automation scripts
+├── deploy/
+│ ├── install.sh # One-command installer
+│ ├── compose/ # atlas-core.yml (+ ai stack)
+│ └── caddy/ # Caddyfile.template (Authentik SSO pattern)
+├── docs/ # ai-stack · academy · islamic-layer · security · deployment
+├── ARCHITECTURE.md · SERVICES.md · CHANGELOG.md · README.md
+```
+
+---
+
+## 🔒 Security Model
+
+| Layer | Implementation |
+|-------|---------------|
+| Identity | Authentik SSO — single source of truth for all services |
+| TLS | Caddy automatic HTTPS on every public endpoint |
+| Network | Public services behind SSO · internal services on Tailscale only |
+| Secrets | Vaultwarden (E2E) · age-encrypted vault for sync · chmod 600 on disk |
+| Remote desktop | Webtop is tailnet-only — never exposed to the public internet |
+| Backups | `atlas-backup-*` services for Forgejo, Nextcloud, Authentik |
+
+**Rule:** anything root-level stays tailnet-only. Public services must pass Authentik `forward_auth`. No bare basic-auth on the public internet. Full model in [docs/security.md](./docs/security.md).
+
+---
+
+## 🛠️ Tech Stack
+
+[Caddy](https://caddyserver.com) · [Authentik](https://goauthentik.io) · Docker Compose · [Tailscale](https://tailscale.com) · [NATS](https://nats.io) · [Odoo 19](https://odoo.com) · [Nextcloud](https://nextcloud.com) · [Firefly III](https://firefly-iii.org) · [Paperless-ngx](https://docs.paperless-ngx.com) · [Stalwart](https://stalw.art) · [Forgejo](https://forgejo.org) · [n8n](https://n8n.io) · [Vaultwarden](https://github.com/dani-garcia/vaultwarden) · [LiteLLM](https://litellm.ai) · [Open-WebUI](https://openwebui.com) · [Langfuse](https://langfuse.com) · [Webtop](https://docs.linuxserver.io/images/docker-webtop/) · [MeshCentral](https://meshcentral.com) · [Uptime Kuma](https://uptime.kuma.pet) · [Ollama](https://ollama.com)
---
-**Built by [Chaib Aarab](https://atlascorporation.nl) — Atlas Corporation, Tilburg NL**
-Built incrementally, on the go, while running real client projects. The architecture emerged from constraints, not slides.
+Built with obsession by **Chaib Aarab** · Atlas Corporation · Tilburg, NL
-MIT licensed · EU-sovereign · one login for all of it
+⟡ [atlascorporation.nl](https://atlascorporation.nl) · [atlasworks.nl](https://atlasworks.nl) · [atlasacademy.nl](https://atlasacademy.nl) · [atlaspos.nl](https://atlaspos.nl) ⟡
+
+*"Your business on one box — space grade."*
diff --git a/SERVICES.md b/SERVICES.md
index ac91ef1..a829de5 100644
--- a/SERVICES.md
+++ b/SERVICES.md
@@ -91,3 +91,21 @@ jouwenergieadvies.nl, reclamemans.nl
| atlas-backup-ak | Authentik daily backup |
| atlas-disk-api | Disk status API |
| atlas-eb-callback | Enable Banking PSD2 callback |
+
+## Atlas Academy
+
+| Service | URL |
+|---------|-----|
+| Academy site | atlasacademy.nl |
+| Lead relay (Odoo) | /academy-lead -> 127.0.0.1:7793 (atlas-academy-relay) |
+| Product feed | atlasworks.nl/academy-feed.php |
+
+## Islamic Layer
+
+| Component | Purpose |
+|-----------|---------|
+| AdGuard Family DNS | Family-safe DNS + hosts blocklist |
+| HaramBlur | Browser content filtering |
+| Quran at logon | Recitation on workstation login |
+| Adhan + lock | Adhan + screen lock at El Feth Tilburg salah times |
+| Sunnah reminders | Recurring fleet-wide reminders |
diff --git a/assets/architecture.svg b/assets/architecture.svg
new file mode 100644
index 0000000..fd839b5
--- /dev/null
+++ b/assets/architecture.svg
@@ -0,0 +1,95 @@
+
diff --git a/assets/desktop-preview.svg b/assets/desktop-preview.svg
new file mode 100644
index 0000000..8680288
--- /dev/null
+++ b/assets/desktop-preview.svg
@@ -0,0 +1,109 @@
+
diff --git a/assets/header.svg b/assets/header.svg
index 2dd63a5..17111bd 100644
--- a/assets/header.svg
+++ b/assets/header.svg
@@ -1,71 +1,115 @@
-
+
-**A sovereign, browser-native AI operating system.**
-Log in with your identity → your entire operation as apps on one desktop. No install. Any device. One login.
+# Atlas OS
-[](https://command.atlascorporation.nl/os/)
-[](#-the-app-catalog)
-[](./docs/security.md)
-[](https://auth.atlascorporation.nl)
-[](./LICENSE)
+[](https://command.atlascorporation.nl/os/)
+[](./SERVICES.md)
+[](./SERVICES.md)
+[](./ARCHITECTURE.md)
+[](./docs/ai-stack.md)
+[](https://git.atlascorporation.nl/chaib/atlas-os/wiki)
+
+**Your entire business running on one hardened Linux server.**
+**One SSO identity. One browser login. One OS.**
+
+[🚀 Live Desktop](https://command.atlascorporation.nl/os/) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md) · [📖 Wiki](https://git.atlascorporation.nl/chaib/atlas-os/wiki)
-
| 
|
-| **One partner for every system** — ERP, POS, webshop, hardware, AI as one seamless whole. | **The Atlas platform** — surfaces → workspace → data sources, one reviewed control layer. |
+**What runs on it:**
+- 🏢 Odoo 19 ERP/CRM — full business operations
+- 💶 Firefly III + Enable Banking — bank sync and financial intelligence
+- 📧 Stalwart — self-hosted mail (all domains)
+- 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
+- 🎓 Atlas Academy — courses + lead capture wired to Odoo CRM
+- 🕌 Islamic layer — Adhan at salah times, Quran at logon, family-safe DNS
+- 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
+- 🔒 Authentik — SSO that gates every single service
+- ...and more
---
-## 🗺️ Architecture
+## 🖥️ The Desktop
-One box. One identity. Everything behind it.
+Open `https://command.atlascorporation.nl/os/` on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, a taskbar, and cockpit panels that auto-refresh.
+
+**Remote Linux desktop** (tailnet-only):
+```
+http://atlas-01.tailab40ed.ts.net:8497
+```
+A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device.
+
+---
+
+## 🏗️ Architecture
+
+