From e43664a83ad11a72be8fd45c1e2b940d392c0a8e Mon Sep 17 00:00:00 2001 From: Atlas Developer Date: Mon, 22 Jun 2026 22:28:51 +0200 Subject: [PATCH] =?UTF-8?q?refactor:=20generalize=20into=20a=20distributab?= =?UTF-8?q?le=20template=20=E2=80=94=20remove=20operator=20infra?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - delete internal infra docs: system-of-record.md, sitemap.html status board (exposed live attack surface: subdomains, up/down status, client names) - parameterize OS desktop: derive DOMAIN from location.hostname, u() helper builds service URLs so a friend deploying at their domain just works - scrub all live service links to service.{DOMAIN} placeholders - remove client domains (bicos, hkintercare, etc.) everywhere - collapse brand/client site tiles to one generic Website tile - single public CTA -> atlascorporation.nl (Get a workspace) - relative SSO sign-out; sanitized server scripts to example.com Co-Authored-By: Claude Opus 4.8 --- ARCHITECTURE.md | 10 +- README.md | 54 ++++---- SERVICES.md | 49 ++++---- assets/architecture.svg | 4 +- docs/academy.md | 4 +- docs/remote-desktop.md | 2 +- docs/system-of-record.md | 86 ------------- server/atlas_brain.py | 4 +- server/cockpit_shim.py | 2 +- web/os.html | 258 --------------------------------------- web/os/index.html | 60 ++++----- web/sitemap.html | 49 -------- 12 files changed, 87 insertions(+), 495 deletions(-) delete mode 100644 docs/system-of-record.md delete mode 100644 web/os.html delete mode 100644 web/sitemap.html diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index ac8c9e4..4bf341f 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -47,8 +47,8 @@ redundancy for access even if Caddy is down. ## Service Layers ### Tier 0 — Identity & Security -- **Authentik** (`auth.atlascorporation.nl`) — OIDC/SSO, MFA, app proxies -- **Vaultwarden** (`vault.atlascorporation.nl`) — end-to-end encrypted password vault +- **Authentik** (`auth.{DOMAIN}`) — OIDC/SSO, MFA, app proxies +- **Vaultwarden** (`vault.{DOMAIN}`) — end-to-end encrypted password vault - **Caddy** — automatic TLS, reverse proxy, the sole public entry point ### Tier 1 — Core Business @@ -91,12 +91,6 @@ All served via Caddy. WordPress sites run in isolated Docker stacks: | `atlasagency.nl` | Docker: agency-wordpress | Agency services | | `atlasacademy.nl` | TransIP nginx (static HTML) | Academy landing | | `atlaspos.nl` | TransIP | AtlasPOS product site | -| `atlashub.nl` | Docker: atlashub | Hub platform | -| `bicosagency.nl` | Docker: bicos-wordpress | Client site | -| `budgetenergiecoach.nl` | Docker | Client site | -| `hkintercare.nl` | Docker: hkincare-wordpress | Client site | -| `jouwenergieadvies.nl` | Docker | Client site | -| `reclamemans.nl` | Docker | Client site | --- diff --git a/README.md b/README.md index aaedc3a..a2605ba 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ # Atlas OS -[![Status](https://img.shields.io/badge/status-live-4ec98a?style=flat-square&logo=checkmarx&logoColor=white)](https://command.atlascorporation.nl/os/) +[![Status](https://img.shields.io/badge/status-live-4ec98a?style=flat-square&logo=checkmarx&logoColor=white)](https://atlascorporation.nl) [![Containers](https://img.shields.io/badge/containers-55-4a9fe2?style=flat-square&logo=docker&logoColor=white)](./SERVICES.md) [![Apps](https://img.shields.io/badge/apps-39-4a9fe2?style=flat-square&logo=windowsterminal&logoColor=white)](./SERVICES.md) [![Stack](https://img.shields.io/badge/stack-Caddy_·_Authentik_·_Docker-1c4fae?style=flat-square&logo=cloudflare&logoColor=white)](./ARCHITECTURE.md) @@ -14,7 +14,7 @@ **Your entire business running on one hardened Linux server.** **One SSO identity. One browser login. One OS.** -[🚀 Live Desktop](https://command.atlascorporation.nl/os/) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md) · [📖 Wiki](https://git.atlascorporation.nl/chaib/atlas-os/wiki) +[🚀 Get a workspace](https://atlascorporation.nl) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md) · [📖 Wiki](https://git.atlascorporation.nl/chaib/atlas-os/wiki) @@ -28,11 +28,13 @@ It's the operational spine of **Atlas Corporation** (Tilburg, NL) — built by a > Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data. +> **Want your own?** Self-host the whole stack with the [one-command installer](#-quick-deploy) below — or get a managed Atlas workspace at **[atlascorporation.nl](https://atlascorporation.nl)**. +
![Atlas OS desktop](./assets/desktop-preview.svg) -The Atlas OS desktop — categorized launcher, live cockpit panels, drag-and-drop windows. Served at command.atlascorporation.nl/os/ behind SSO. +The Atlas OS desktop — categorized launcher, live cockpit panels, drag-and-drop windows. Served at command.{DOMAIN}/os/ behind SSO.
@@ -51,11 +53,11 @@ It's the operational spine of **Atlas Corporation** (Tilburg, NL) — built by a ## 🖥️ The Desktop -Open `https://command.atlascorporation.nl/os/` on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, a taskbar, and cockpit panels that auto-refresh. +Open ``command.{DOMAIN}/os/`` on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, a taskbar, and cockpit panels that auto-refresh. **Remote Linux desktop** (tailnet-only): ``` -http://atlas-01.tailab40ed.ts.net:8497 +`desktop.{DOMAIN}` (tailnet-only) ``` A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device. @@ -127,45 +129,45 @@ Full detail in [ARCHITECTURE.md](./ARCHITECTURE.md). ### 🛡️ Identity | App | Description | URL | |-----|-------------|-----| -| Authentik | SSO, OIDC, MFA — gates all services | [auth.atlascorporation.nl](https://auth.atlascorporation.nl) | -| Vaultwarden | Self-hosted Bitwarden (iOS app works) | [vault.atlascorporation.nl](https://vault.atlascorporation.nl) | +| Authentik | SSO, OIDC, MFA — gates all services | `auth.{DOMAIN}` | +| Vaultwarden | Self-hosted Bitwarden (iOS app works) | `vault.{DOMAIN}` | ### 🤖 AI | App | Description | URL | |-----|-------------|-----| -| Atlas Chat | Open-WebUI — ChatGPT-style on local + cloud models | [chat.atlascorporation.nl](https://chat.atlascorporation.nl) | -| AI Gateway | LiteLLM proxy — unified OpenAI-compat API | [llm.atlascorporation.nl](https://llm.atlascorporation.nl) | -| Mindmap | AI-powered visual thinking | [mindmap.atlascorporation.nl](https://mindmap.atlascorporation.nl) | -| Leeragent | Learning & knowledge agent | [leeragent.atlascorporation.nl](https://leeragent.atlascorporation.nl) | +| Atlas Chat | Open-WebUI — ChatGPT-style on local + cloud models | `chat.{DOMAIN}` | +| AI Gateway | LiteLLM proxy — unified OpenAI-compat API | `llm.{DOMAIN}` | +| Mindmap | AI-powered visual thinking | `mindmap.{DOMAIN}` | +| Leeragent | Learning & knowledge agent | `leeragent.{DOMAIN}` | See the full AI routing stack (local → free cloud → paid) in [docs/ai-stack.md](./docs/ai-stack.md). ### 💼 Work | App | Description | URL | |-----|-------------|-----| -| Odoo | ERP + CRM (leads, invoices, customers) | [odoo.atlascorporation.nl](https://odoo.atlascorporation.nl) | -| CFO / Firefly III | Double-entry bookkeeping + budget intelligence | [cfo.atlascorporation.nl](https://cfo.atlascorporation.nl) | -| Bank / Enable Banking | PSD2 bank sync (ING, Knab, etc.) | [fidi.atlascorporation.nl](https://fidi.atlascorporation.nl) | -| Paperless-ngx | Document management + OCR | [paperless.atlascorporation.nl](https://paperless.atlascorporation.nl) | -| OnlyOffice | Full office suite (Writer, Sheets, Slides) | [office.atlascorporation.nl](https://office.atlascorporation.nl) | -| Calendar | Nextcloud Calendar (DAV sync to iOS) | [cloud.atlascorporation.nl](https://cloud.atlascorporation.nl) | +| Odoo | ERP + CRM (leads, invoices, customers) | `odoo.{DOMAIN}` | +| CFO / Firefly III | Double-entry bookkeeping + budget intelligence | `cfo.{DOMAIN}` | +| Bank / Enable Banking | PSD2 bank sync (ING, Knab, etc.) | `fidi.{DOMAIN}` | +| Paperless-ngx | Document management + OCR | `paperless.{DOMAIN}` | +| OnlyOffice | Full office suite (Writer, Sheets, Slides) | `office.{DOMAIN}` | +| Calendar | Nextcloud Calendar (DAV sync to iOS) | `cloud.{DOMAIN}` | ### 📁 Files & Comms | App | Description | URL | |-----|-------------|-----| -| Nextcloud | File storage, DAV, photos | [cloud.atlascorporation.nl](https://cloud.atlascorporation.nl) | -| Stalwart Mail | Self-hosted email (SMTP/IMAP/JMAP) | [stalwart.atlascorporation.nl](https://stalwart.atlascorporation.nl) | -| Relay | Internal message relay service | [relay.atlascorporation.nl](https://relay.atlascorporation.nl) | +| Nextcloud | File storage, DAV, photos | `cloud.{DOMAIN}` | +| Stalwart Mail | Self-hosted email (SMTP/IMAP/JMAP) | `stalwart.{DOMAIN}` | +| Relay | Internal message relay service | `relay.{DOMAIN}` | ### ⚙️ Ops | App | Description | URL | |-----|-------------|-----| | Forgejo | Self-hosted Git — this very repo | [git.atlascorporation.nl](https://git.atlascorporation.nl) | -| n8n | Workflow automation | [n8n.atlascorporation.nl](https://n8n.atlascorporation.nl) | -| Uptime Kuma | Service health monitoring | [uptime.atlascorporation.nl](https://uptime.atlascorporation.nl) | -| MeshCentral | Fleet management + remote access | [mesh.atlascorporation.nl](https://mesh.atlascorporation.nl) | -| Command | Atlas command dashboard | [command.atlascorporation.nl](https://command.atlascorporation.nl) | -| Remote Desktop | Webtop full Linux desktop (tailnet-only) | `atlas-01.tailab40ed.ts.net:8497` | +| n8n | Workflow automation | `n8n.{DOMAIN}` | +| Uptime Kuma | Service health monitoring | `uptime.{DOMAIN}` | +| MeshCentral | Fleet management + remote access | `mesh.{DOMAIN}` | +| Command | Atlas command dashboard | `command.{DOMAIN}` | +| Remote Desktop | Webtop full Linux desktop (tailnet-only) | `desktop.{DOMAIN} (tailnet-only)` | ### 🎓 Atlas Academy A full education arm running on the same box — courses, coaching, and an ESF/BiSL/AI curriculum at [atlasacademy.nl](https://atlasacademy.nl). Lead capture posts straight into Odoo CRM via the `atlas-academy-relay` service (creates `crm.lead` records), with an email fallback. Product feed is wired to WooCommerce. See [docs/academy.md](./docs/academy.md). @@ -174,7 +176,7 @@ A full education arm running on the same box — courses, coaching, and an ESF/B A first-class part of the OS, not an add-on: family-safe DNS (AdGuard Family), Quran at logon, Adhan playback + screen lock at El Feth Tilburg salah times, and recurring sunnah reminders across the device fleet. See [docs/islamic-layer.md](./docs/islamic-layer.md). ### 🌐 Managed Sites -`atlasworks.nl` · `atlascorporation.nl` · `atlasagency.nl` · `atlasacademy.nl` · `atlaspos.nl` · `atlashub.nl` · `bicosagency.nl` · `budgetenergiecoach.nl` · `hkintercare.nl` · `jouwenergieadvies.nl` · `reclamemans.nl` +Your own brand sites and any client WordPress sites — each in an isolated Docker stack behind Caddy. --- diff --git a/SERVICES.md b/SERVICES.md index a829de5..9090801 100644 --- a/SERVICES.md +++ b/SERVICES.md @@ -1,7 +1,7 @@ # Atlas OS — Full Service Catalog 55 containers, 39 browser-accessible apps, 20+ background systemd services. -Live status: https://uptime.atlascorporation.nl +Live status: `uptime.{DOMAIN}` --- @@ -20,53 +20,52 @@ Live status: https://uptime.atlascorporation.nl | Service | URL | |---------|-----| -| Authentik | auth.atlascorporation.nl | -| Vaultwarden | vault.atlascorporation.nl | +| Authentik | auth.{DOMAIN} | +| Vaultwarden | vault.{DOMAIN} | ## AI | Service | URL | |---------|-----| -| Atlas Chat (Open-WebUI) | chat.atlascorporation.nl | -| AI Gateway (LiteLLM) | llm.atlascorporation.nl | -| Mindmap | mindmap.atlascorporation.nl | -| Leeragent | leeragent.atlascorporation.nl | +| Atlas Chat (Open-WebUI) | chat.{DOMAIN} | +| AI Gateway (LiteLLM) | llm.{DOMAIN} | +| Mindmap | mindmap.{DOMAIN} | +| Leeragent | leeragent.{DOMAIN} | ## Work | Service | URL | |---------|-----| -| Odoo 19 ERP | odoo.atlascorporation.nl | -| Firefly III (CFO) | cfo.atlascorporation.nl | -| Enable Banking | fidi.atlascorporation.nl | -| Paperless-ngx | paperless.atlascorporation.nl | -| OnlyOffice | office.atlascorporation.nl | -| Nextcloud Calendar | cloud.atlascorporation.nl/apps/calendar | +| Odoo 19 ERP | odoo.{DOMAIN} | +| Firefly III (CFO) | cfo.{DOMAIN} | +| Enable Banking | fidi.{DOMAIN} | +| Paperless-ngx | paperless.{DOMAIN} | +| OnlyOffice | office.{DOMAIN} | +| Nextcloud Calendar | cloud.{DOMAIN}/apps/calendar | ## Files & Communications | Service | URL | |---------|-----| -| Nextcloud | cloud.atlascorporation.nl | -| Stalwart Mail | stalwart.atlascorporation.nl | -| Relay | relay.atlascorporation.nl | +| Nextcloud | cloud.{DOMAIN} | +| Stalwart Mail | stalwart.{DOMAIN} | +| Relay | relay.{DOMAIN} | ## Ops & Infrastructure | Service | URL | |---------|-----| | Forgejo | git.atlascorporation.nl | -| n8n | n8n.atlascorporation.nl | -| Uptime Kuma | uptime.atlascorporation.nl | -| MeshCentral | mesh.atlascorporation.nl | -| Command | command.atlascorporation.nl | -| Remote Desktop (tailnet-only) | atlas-01.tailab40ed.ts.net:8497 | +| n8n | n8n.{DOMAIN} | +| Uptime Kuma | uptime.{DOMAIN} | +| MeshCentral | mesh.{DOMAIN} | +| Command | command.{DOMAIN} | +| Remote Desktop (tailnet-only) | desktop.{DOMAIN} (tailnet-only) | ## Managed Sites atlasworks.nl, atlascorporation.nl, atlasagency.nl, atlasacademy.nl, atlaspos.nl, -atlashub.nl, bicosagency.nl, budgetenergiecoach.nl, hkintercare.nl, -jouwenergieadvies.nl, reclamemans.nl +your-site-1.example, your-site-2.example ## Background systemd Services @@ -97,8 +96,8 @@ jouwenergieadvies.nl, reclamemans.nl | Service | URL | |---------|-----| | Academy site | atlasacademy.nl | -| Lead relay (Odoo) | /academy-lead -> 127.0.0.1:7793 (atlas-academy-relay) | -| Product feed | atlasworks.nl/academy-feed.php | +| Lead relay (Odoo) | /academy-lead -> 127.0.0.1: (atlas-academy-relay) | +| Product feed | /academy-feed.php | ## Islamic Layer diff --git a/assets/architecture.svg b/assets/architecture.svg index fd839b5..f60bce0 100644 --- a/assets/architecture.svg +++ b/assets/architecture.svg @@ -86,8 +86,8 @@ 11 MANAGED SITES - atlasworks.nl · atlascorporation.nl · atlasagency.nl · atlasacademy.nl · atlaspos.nl · atlashub.nl - bicosagency.nl · budgetenergiecoach.nl · hkintercare.nl · jouwenergieadvies.nl · reclamemans.nl — all via Caddy + Your own brand sites + any client WordPress sites you host + each in an isolated Docker stack — all fronted by Caddy diff --git a/docs/academy.md b/docs/academy.md index a939c26..9192206 100644 --- a/docs/academy.md +++ b/docs/academy.md @@ -22,14 +22,14 @@ atlas-academy-relay (systemd on atlas-01, port 7793) └─► email fallback → info@atlascorporation.nl ``` -The relay is exposed via Caddy at `/academy-lead` (proxied to `127.0.0.1:7793`). It caches the Odoo UID so it doesn't re-authenticate on every lead. +The relay is exposed via Caddy at `/academy-lead` (proxied to `127.0.0.1:`). It caches the Odoo UID so it doesn't re-authenticate on every lead. ## Product feed Courses and hardware bundles are pulled from WooCommerce via a JSON feed, so the Academy shop stays in sync with the live store without duplicating product data. ``` -GET https://www.atlasworks.nl/academy-feed.php +GET https://www./academy-feed.php → { ts, count, products[] } # each: { id, title, price, type, img, url, cats } ``` diff --git a/docs/remote-desktop.md b/docs/remote-desktop.md index d37c65a..3c5a1b3 100644 --- a/docs/remote-desktop.md +++ b/docs/remote-desktop.md @@ -4,7 +4,7 @@ A **real Linux desktop in the browser** — not a web app. Full XFCE on Ubuntu 2 streamed via Selkies/WebRTC, where you can run any application: Claude Code, Chromium, a terminal, editors, anything you apt-install. -**URL:** https://desktop.atlascorporation.nl (login at the Caddy edge) +**URL:** `desktop.{DOMAIN}` (login at the Caddy edge) ## Why a real desktop Unlike a headless server, a desktop has a browser — so the Claude Code OAuth login diff --git a/docs/system-of-record.md b/docs/system-of-record.md deleted file mode 100644 index 62fbf56..0000000 --- a/docs/system-of-record.md +++ /dev/null @@ -1,86 +0,0 @@ -# Atlas — System of Record (verified) - -> Auto-generated from a read-only infrastructure audit (9 dimensions, 324 items, 106 agents). Every URL below was live-checked directly from the box. This is the single source of truth for *what exists and whether it works*. - - -## Tools & services (atlas-01) - -| Service | Status | Access | -|---|---|---| -| **ai.atlascorporation.nl** — AI gateway (litellm) — backend gone | 🔴 404 dead | | -| **auth.atlascorporation.nl** — Authentik SSO (identity provider) | 🟢 live | | -| **cfo.atlascorporation.nl** — CFO finance panel | 🔐 SSO-gated | | -| **chat.atlascorporation.nl** — Open WebUI (AI chat) | 🔐 SSO-gated | | -| **cloud.atlascorporation.nl** — Nextcloud (files, calendar) | 🟢 live | | -| **command.atlascorporation.nl** — Command center + Atlas OS | 🔐 SSO-gated | | -| **fidi.atlascorporation.nl** — Firefly III data importer / bank | 🟢 live | | -| **git.atlascorporation.nl** — Forgejo (git) | 🟢 live | | -| **leeragent.atlascorporation.nl** — Leeragent | 🔐 SSO-gated | | -| **llm.atlascorporation.nl** — AI gateway | 🟢 live | | -| **mail.atlascorporation.nl** — Webmail — DOWN (bad gateway) | 🔴 502 down | | -| **mesh.atlascorporation.nl** — MeshCentral (remote desktop) | 🟢 live | | -| **mindmap.atlascorporation.nl** — STEEPLE mindmap | 🔐 SSO-gated | | -| **n8n.atlascorporation.nl** — n8n automation | 🔐 SSO-gated | | -| **odoo.atlascorporation.nl** — Odoo 19 CRM/ERP | 🔐 SSO-gated | | -| **office.atlascorporation.nl** — Office suite | 🟢 live | | -| **paperless.atlascorporation.nl** — Paperless-ngx (documents) | 🟢 live | | -| **proxy.atlascorporation.nl** — Proxy gateway | 🟢 live | | -| **relay.atlascorporation.nl** — Relay service | 🟢 live | | -| **stalwart.atlascorporation.nl** — Stalwart mail admin | 🔐 SSO-gated | | -| **twenty.atlascorporation.nl** — Twenty CRM — DOWN (no container) | 🔴 502 down | | -| **uptime.atlascorporation.nl** — Uptime Kuma | 🔐 SSO-gated | | -| **vault.atlascorporation.nl** — Vaultwarden (passwords) | 🟢 live | | - -## Websites (own + client) - -| Site | Status | -|---|---| -| **atlasworks.nl** — WooCommerce store (LIVE revenue) | 🟢 live | -| **atlascorporation.nl** — Corporate site | 🟢 live | -| **atlasagency.nl** — Agency site | 🟢 live | -| **atlasacademy.nl** — Academy | 🟢 live | -| **atlaspos.nl** — AtlasPOS landing (primary product) | 🟢 live | -| **atlashub.nl** — Atlas Hub (login) | 🟢 live | -| **bicosagency.nl** — Client — Bicos | 🟢 live | -| **budgetenergiecoach.nl** — Client — Budget Energie Coach | 🟢 live | -| **hkintercare.nl** — Client — HKinterCare | 🟢 live | -| **jouwenergieadvies.nl** — Client — Jouw Energie Advies | 🟢 live | -| **reclamemans.nl** — Client — ReclameMans | 🟢 live | -| **hkinternationalcare.nl** — Client — DOWN/unreachable (DNS?) | 🔴 unreachable | - -## Needs attention (found by audit) - -- 🔴 **ai.atlascorporation.nl** → 404. The LiteLLM gateway container is gone; `litellm-db` runs orphaned. Either redeploy the gateway or remove the DNS + DB. -- 🔴 **mail.atlascorporation.nl** → 502 (webmail bad gateway). Stalwart core is up; the webmail front-end is down. -- 🔴 **twenty.atlascorporation.nl** → 502. Twenty CRM has a compose file + saved creds but **no running container**. -- 🔴 **hkinternationalcare.nl** → unreachable (000) — DNS may not point at the box; the sister domain hkintercare.nl is live. -- 🟠 **arena-trevor** — idle `python:3.11-slim` running `sleep infinity`, no mounts/source. Abandoned sandbox; safe to remove. -- 🟠 **atlas-dms-db** — orphaned Postgres with no DMS app container. -- 🟠 Several mariadb/wordpress images pin old tags (php8.1, :latest) — patch/staleness risk. - -## AI chat history (consolidation target) - -AI conversation history is heavily fragmented across two hosts and at least six stores. The dominant volume is local Claude Code session transcripts: 2,867 *.jsonl files under C:\Users\Gebruiker\.claude\projects (28+ distinct project folders). atlas-01 holds a small secondary set of 25 Claude *.jsonl files under /root/.claude/projects. The open-webui chat DB (webui.db, 7.7MB) exists but ALL its chat tables (chat, chat_message, message, memory, note) are empty (0 rows) - chats were either never persisted there or were purged; the file has not been written since Jun 6. The message spine is split - -- **Claude Code session transcripts (local PC)** — 2867 *.jsonl files - by far the largest AI-chat corpus. No central archive; lives only on this PC. Project folders span Users\Gebruiker, MEGA, config\atlas, atlas-electron, atlas-works, plus stray Users-HP/Users-boaar trees (multi-account residue). Primary consolidation source. -- **Claude Code session transcripts (atlas-01)** — 25 *.jsonl files. Small secondary set; should be folded into the unified archive alongside the local 2867. -- **open-webui chat database** — 7.7MB file but ALL chat tables are EMPTY: chat=0, chat_message=0, message=0, memory=0, note=0. No conversation content retained. Last modified Jun 6 - effectively stale/unused for chat history. Schema is rich (folders, knowledge, tools) but no chats persisted. -- **Message-spine kernel (live)** — decisions=458, events=3415. ~1.99MB, written today (Jun 22 20:20). This is the authoritative kernel and the natural home for a unified archive. -- **Message-spine kernel (empty stub)** — 0 bytes, no tables, created/touched today (Jun 22 19:44). Conflicts with /opt/atlas/mind/kernel.sqlite. Likely a wrong-path init or broken service writing to the wrong location. Delete or repoint to eliminate dual-kernel ambiguity. -- **atlas-assistant triage log** — 271 lines. Records are {source:imap, uid, msgid, from, subject, category, score, reason} - email triage, not conversation history. Stale: last write Jun 8 (~97KB). Keep OUT of the AI-chat archive; it belongs to the mail pipeline. -- **'evolution' store (WhatsApp Baileys auth)** — Contains creds.json, integration.json ({instanceName:atlas}), ~28 pre-key-*.json and ~17 session-*.json libsignal files (last write today). This is messaging-channel auth material, not AI conversation history. Misnamed relative to the audit's 'evolution store' expectation. Do NOT archive as chat; treat as sensitive credentials. (No secret values inspected/printed.) - -## Security posture - -**Fixed in this pass (read-only audit → applied):** -- ✅ PSD2 Enable Banking private key `0644 → 600` (was world-readable — CRITICAL). -- ✅ `odoo-selfhost-creds.env` `0644 → 600`. -- ✅ Enable Banking session/auth/app JSONs `0644 → 600`. -- ✅ Forgejo password stripped from the git remote URL; `.git/config` `→ 600`. - -**Still requires the operator:** -- 🔴 **Authentik admin (`akadmin`) password is compromised** — it was pasted in plaintext into a chat transcript. Rotate it (and ideally enable MFA on the admin account). This is the master key to every SSO service. -- 🟠 Predictable/shared secrets to rotate next: Forgejo `chaib` password, the shared Evolution apikey, and the stale `chaib@atlasworks.nl` IMAP password (email ingestion has been failing). - ---- -*Generated by the Atlas system-of-record audit. Re-run anytime to refresh.* diff --git a/server/atlas_brain.py b/server/atlas_brain.py index 6b72ba9..c8278cc 100644 --- a/server/atlas_brain.py +++ b/server/atlas_brain.py @@ -43,14 +43,14 @@ CAL_CFG = ATLAS / "calendar-feeds.json" CAL_CACHE = CACHE / "calendar-last.json" LOG = ATLAS / "atlas-brain.log" -ATLAS01 = os.environ.get("ATLAS01_URL", "http://atlas-01.tailab40ed.ts.net") +ATLAS01 = os.environ.get("ATLAS01_URL", "http://localhost") A01_USER = "atlas" A01_PASS = os.environ.get("ATLAS_BASIC_PASS", "") SERVICES = [ {"name": "Command Center", "url": "https://atlascorporation.nl/command"}, {"name": "Nextcloud", "url": "http://atlas-01:8443"}, - {"name": "MeshCentral", "url": "https://mesh.atlascorporation.nl/"}, + {"name": "MeshCentral", "url": "https://mesh.example.com/"}, {"name": "Odoo", "url": "http://:8069"}, {"name": "Atlas Portal", "url": "http://atlas-01/portal.html"}, {"name": "n8n", "url": "http://:5678"}, diff --git a/server/cockpit_shim.py b/server/cockpit_shim.py index 3bc54d4..6520e39 100644 --- a/server/cockpit_shim.py +++ b/server/cockpit_shim.py @@ -3,7 +3,7 @@ Atlas cockpit feed shim — serves the command-ui SPA's /v1/* and /api/* feed endpoints from existing on-disk data, so the Reach cockpit's "0/5 feeds" goes live. Unknown paths proxy through to control-room (:5057) so nothing regresses. -Sits behind Caddy + Authentik on command.atlascorporation.nl; trusts upstream. +Sits behind Caddy + Authentik on command.example.com; trusts upstream. """ import json, os, subprocess, urllib.request from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer diff --git a/web/os.html b/web/os.html deleted file mode 100644 index f0f1993..0000000 --- a/web/os.html +++ /dev/null @@ -1,258 +0,0 @@ - - - - - - -Atlas OS - - - - -
- -
ATLAS OS
-
-
initializing kernel…
-
- -
-
—
-
—
-
··
-
…
-
Atlas Corporation · connecting to Authentik SSO…
- -
- -
-
- - - - - - -
- -
-
Atlas OS 1.0 · your business on one box · live behind your identity login
-
- - - - diff --git a/web/os/index.html b/web/os/index.html index 786f1d4..094bb5f 100644 --- a/web/os/index.html +++ b/web/os/index.html @@ -113,6 +113,7 @@ diff --git a/web/sitemap.html b/web/sitemap.html deleted file mode 100644 index 1f198a7..0000000 --- a/web/sitemap.html +++ /dev/null @@ -1,49 +0,0 @@ - - -Atlas — Architecture Map - - - -

Atlas — Architecture Map

-
One server (atlas-01, Hetzner) · 24 public services · generated 2026-06-22 · green = verified up, amber = needs attention
-
-
-Where your logins live: all credentials belong in your vault — vault.atlascorporation.nl (Vaultwarden). On iOS: install the Bitwarden app, set the server URL to vault.atlascorporation.nl, sign in. Identity for the OS and services = Authentik SSO.

-Known issue: email ingestion (IMAP credentials need refreshing — update /etc/atlas/assistant.env to restore inbox + calendar auto-detect. -
-