<div align="center">

```
 █████╗ ████████╗██╗      █████╗ ███████╗
██╔══██╗╚══██╔══╝██║     ██╔══██╗██╔════╝
███████║   ██║   ██║     ███████║███████╗
██╔══██║   ██║   ██║     ██╔══██║╚════██║
██║  ██║   ██║   ███████╗██║  ██║███████║
╚═╝  ╚═╝   ╚═╝   ╚══════╝╚═╝  ╚═╝╚══════╝
    O S  ·  A I  C o m m a n d  C e n t e r
```

**A browser-native AI desktop — log in with your identity, get your data, run your tools.**
No install. Any device. One URL.

![Status](https://img.shields.io/badge/status-live-brightgreen?style=flat-square)
![Stack](https://img.shields.io/badge/stack-Vanilla_JS_·_Authentik_·_Docker_·_Caddy-blue?style=flat-square)
![License](https://img.shields.io/badge/license-MIT-yellow?style=flat-square)
![Built by](https://img.shields.io/badge/built_by-Atlas_Corporation-orange?style=flat-square)

</div>

---

## What it is

Atlas OS is a Citrix-style browser desktop for solo founders and small teams.
Log in once with Authentik SSO → a desktop boots with live data from your actual systems:
bank transactions, CRM leads, email drafts, fleet status, and a kill-switch for your AI agents.

**Live:** `https://command.atlascorporation.nl/os/` *(SSO required)*

---

## Screens

| # | Screen | Live data |
|---|--------|-----------|
| 1 | **Today** | AI daily brief, accountability level |
| 2 | **Money** | Bank transactions (Enable Banking) |
| 3 | **Inbox** | Email + WhatsApp drafts, flagged items |
| 4 | **Pipeline** | CRM leads and deal status (Odoo) |
| 5 | **Fleet** | POS terminals, health, last-seen |
| 6 | **Control** | AI kill-switch, daily spend cap |

---

## Architecture

```mermaid
graph TB
    subgraph Internet["Internet"]
        User([User / Device])
    end

    subgraph Edge["Edge — Caddy reverse proxy"]
        Caddy[Caddy TLS + rate limit]
    end

    subgraph Identity["Identity — Authentik"]
        Auth[Authentik SSO forward_auth]
    end

    subgraph OS["Atlas OS"]
        Desktop[Atlas OS PWA]
        Cockpit[The Mind cockpit]
    end

    subgraph Comms["Communications"]
        Evolution[Evolution API WhatsApp]
        Stalwart[Stalwart Mail SMTP/IMAP]
    end

    subgraph Apps["Apps"]
        Odoo[Odoo 19 CE CRM+ERP]
        Nextcloud[Nextcloud 31 files+cal]
        Firefly[Firefly III finance]
        Paperless[Paperless-ngx docs]
        N8N[n8n automation]
        Forgejo[Forgejo git]
        Vault[Vaultwarden passwords]
        MeshCentral[MeshCentral remote]
    end

    subgraph AI["AI Layer"]
        Router[Atlas LLM Router local+cloud]
        Brain[Atlas Brain autonomous agent]
    end

    User --> Caddy
    Caddy --> Auth
    Auth --> Desktop
    Auth --> Apps
    Desktop --> Cockpit
    Cockpit --> Odoo
    Brain --> Router
    Evolution --> Brain
```

---

## Service map

| Category | Service | URL |
|----------|---------|-----|
| Identity | Authentik SSO | auth.atlascorporation.nl |
| Identity | Vaultwarden | vault.atlascorporation.nl |
| OS | Atlas OS PWA | command.atlascorporation.nl/os/ |
| OS | Command dashboard | command.atlascorporation.nl |
| AI | Open WebUI / chat | chat.atlascorporation.nl |
| AI | Atlas Brain | internal |
| Mail | Stalwart | mail.atlascorporation.nl |
| CRM / ERP | Odoo 19 CE | odoo.atlascorporation.nl |
| Files | Nextcloud 31 | cloud.atlascorporation.nl |
| Finance | Firefly III | money.atlascorporation.nl |
| Documents | Paperless-ngx | docs.atlascorporation.nl |
| Automation | n8n | n8n.atlascorporation.nl |
| Git | Forgejo | git.atlascorporation.nl |
| Remote access | MeshCentral | mesh.atlascorporation.nl |
| Monitoring | Uptime Kuma | uptime.atlascorporation.nl |
| WhatsApp | Evolution API | internal |
| Academy | Atlas Academy | atlasacademy.nl |
| POS | AtlasPOS | atlaspos.nl |

---

## Repo structure

```
atlas-os/
├── web/
│   ├── os.html          # Atlas OS desktop PWA (6 screens, 28KB)
│   └── sitemap.html     # Live service map (all 24+ services)
├── scripts/
│   ├── enis_monitor.py        # WhatsApp monitor + LLM auto-reply
│   ├── enis_monitor.service   # systemd unit template
│   └── *.py                   # Automation: finance, leads, reminders
├── patterns/
│   ├── ANTI_IMPULSE_RULES.md  # Build discipline
│   └── CLUSTER_THEN_POLISH.md # UX pattern
├── docs/
│   ├── deployment.md    # Full stack deployment guide
│   └── security.md      # Security model
└── .gitignore           # Blocks secrets, env files, credentials
```

---

## Deployment

### Prerequisites
- VPS (4 vCPU / 8 GB RAM minimum — Hetzner CPX32 recommended)
- Docker + Docker Compose
- Caddy (TLS + reverse proxy)
- Domain you control

### Atlas OS (Caddyfile snippet)

```caddy
command.yourdomain.com {
    forward_auth authentik-server:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers X-Authentik-Username X-Authentik-Name X-Authentik-Email
    }
    handle_path /os/* {
        root * /opt/atlas/atlas-desktop
        file_server
    }
}
```

### WhatsApp monitor

```bash
cp scripts/enis_monitor.py /opt/atlas/brain/
cp scripts/enis_monitor.service /etc/systemd/system/atlas-enis-monitor.service
systemctl enable --now atlas-enis-monitor
```

The monitor only replies when the contact starts a message with `/atlas` — silent otherwise.

---

## AI stack

```
User message
    │
    ▼
Atlas Brain (Python autonomous agent)
    │
    ├── Local router (localhost:8888)
    │     ├── atlas-fast   LLaMA 1B    labels, routing
    │     ├── atlas-free   hermes3     Dutch copy, summaries
    │     ├── atlas-code   Qwen Coder  code completion
    │     └── atlas-phi3   Qwen 7B     reasoning
    │
    └── Cloud fallback (free tier first)
          ├── Groq       llama-3.3-70b-versatile
          ├── Cerebras   llama-3.1-70b
          └── Claude     sonnet-4-6  (paid, last resort)
```

---

## Security model

- **All public services behind Authentik** — unauthenticated = 302 to SSO login.
- **Sensitive APIs on Tailscale only** — cockpit, Odoo internal APIs never public.
- **No secrets in git** — `.gitignore` blocks `*.env`, `*.key`, `*.sqlite`, `secrets/`, `.auth`.
- **LLM guardrails** — WhatsApp brain hard-blocks passwords, personal finance, client data.
- **Human gate for critical actions** — money movement, external comms, self-modification all require approval via the Control screen.

---

## Built by

**Chaib Aarab** — [Atlas Corporation](https://atlascorporation.nl), Tilburg NL

Solo founder building AI-native business tooling for SMEs.
Everything here was built incrementally while running actual client projects.

---

*MIT License — see LICENSE*