# Atlas OS
[](https://command.atlascorporation.nl/os/)
[](./SERVICES.md)
[](./SERVICES.md)
[](./ARCHITECTURE.md)
[](./docs/ai-stack.md)
**Your entire business running on one hardened Linux server.**
**One SSO identity. One browser login. One OS.**
[🚀 Live Desktop](https://command.atlascorporation.nl/os/) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md)
---
## What is Atlas OS?
Atlas OS is a self-hosted business operating system running on a single Hetzner VPS. One [Authentik](https://goauthentik.io) SSO identity unlocks **39 services** spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind [Caddy](https://caddyserver.com) with automatic HTTPS.
It's the operational spine of **Atlas Corporation** (Tilburg, NL) — built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.
> Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data.
**What runs on it:**
- 🏢 Odoo 19 ERP/CRM — full business operations
- 💶 Firefly III + Enable Banking — bank sync and financial intelligence
- 📧 Stalwart — self-hosted mail (all domains)
- 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
- 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
- 🔒 Authentik — SSO that gates every single service
- ...and 33 more
---
## 🖥️ The Desktop
Open `https://command.atlascorporation.nl/os/` on any device. You get:
```
┌─────────────────────────────────────────────────────┐
│ ⌂ Atlas OS 🛡 ✓ 21:47 Chaib ∨ │
├──────────────────────────────────────────────────────│
│ Cockpit │ Identity │ AI │ Work │
│ ───────── │ ──────── │ ────── │ ──── │
│ 📊 Today │ 🛡 Auth │ 💬 Chat │ 🏪 Odoo │
│ 💰 Money │ 🔒 Vault │ 🧠 AI GW │ 💼 CFO │
│ 📬 Inbox │ │ 🗺 Mind │ 🏦 Bank │
│ 📈 Pipeline│ │ 🎓 Leer │ 📄 Paperless │
│ 🚀 Fleet │ │ │ 📝 Office │
│ ⚙ Control │ │ │ 📅 Calendar │
│─────────────────────────────────────────────────────│
│ Files & Comms │ Ops │ Sites │
│ ───────────── │ ───────────── │ ───── │
│ ☁ Nextcloud │ 🔀 Git (Forgejo) │ 11 websites │
│ 📮 Mail Admin │ ⚡ n8n │ │
│ 📡 Relay │ 📈 Uptime │ │
│ │ 🌐 MeshCentral │ │
│ │ 🖥 Desktop │ │
└─────────────────────────────────────────────────────┘
```
**Boot sequence:** space-themed boot screen → Authentik SSO login → live desktop with your real data.
**Remote Linux desktop** (tailnet-only):
```
http://atlas-01.tailab40ed.ts.net:8497
```
A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device.
---
## 📦 Service Catalog
### 🎯 Cockpit (live data panels)
| App | Description | URL |
|-----|-------------|-----|
| Today | AI daily brief + accountability level | `command.atlascorporation.nl/os/` |
| Money | Bank transactions via Enable Banking PSD2 | `command.atlascorporation.nl/os/` |
| Inbox | Email + WhatsApp drafts, flagged items | `command.atlascorporation.nl/os/` |
| Pipeline | Odoo CRM leads and deal status | `command.atlascorporation.nl/os/` |
| Fleet | POS terminals, health, last-seen (MeshCentral) | `command.atlascorporation.nl/os/` |
| Control | AI kill-switch, autonomy level, daily spend cap | `command.atlascorporation.nl/os/` |
### 🛡️ Identity
| App | Description | URL |
|-----|-------------|-----|
| Authentik | SSO, OIDC, MFA — gates all services | [auth.atlascorporation.nl](https://auth.atlascorporation.nl) |
| Vaultwarden | Self-hosted Bitwarden (iOS Bitwarden app works) | [vault.atlascorporation.nl](https://vault.atlascorporation.nl) |
### 🤖 AI
| App | Description | URL |
|-----|-------------|-----|
| Atlas Chat | Open-WebUI — ChatGPT-style on local + cloud models | [chat.atlascorporation.nl](https://chat.atlascorporation.nl) |
| AI Gateway | LiteLLM proxy — unified OpenAI-compat API | [llm.atlascorporation.nl](https://llm.atlascorporation.nl) |
| Mindmap | AI-powered visual thinking | [mindmap.atlascorporation.nl](https://mindmap.atlascorporation.nl) |
| Leeragent | Learning & knowledge agent | [leeragent.atlascorporation.nl](https://leeragent.atlascorporation.nl) |
### 💼 Work
| App | Description | URL |
|-----|-------------|-----|
| Odoo | ERP + CRM (leads, invoices, customers) | [odoo.atlascorporation.nl](https://odoo.atlascorporation.nl) |
| CFO / Firefly III | Double-entry bookkeeping + budget intelligence | [cfo.atlascorporation.nl](https://cfo.atlascorporation.nl) |
| Bank / Enable Banking | PSD2 bank sync (ING, Knab, etc.) | [fidi.atlascorporation.nl](https://fidi.atlascorporation.nl) |
| Paperless-ngx | Document management + OCR | [paperless.atlascorporation.nl](https://paperless.atlascorporation.nl) |
| OnlyOffice | Full office suite (Writer, Sheets, Slides) | [office.atlascorporation.nl](https://office.atlascorporation.nl) |
| Calendar | Nextcloud Calendar (DAV sync to iOS) | [cloud.atlascorporation.nl/apps/calendar](https://cloud.atlascorporation.nl/apps/calendar) |
### 📁 Files & Comms
| App | Description | URL |
|-----|-------------|-----|
| Nextcloud | File storage, DAV, photos | [cloud.atlascorporation.nl](https://cloud.atlascorporation.nl) |
| Stalwart Mail | Self-hosted email (SMTP/IMAP/JMAP) | [stalwart.atlascorporation.nl](https://stalwart.atlascorporation.nl) |
| Relay | Internal message relay service | [relay.atlascorporation.nl](https://relay.atlascorporation.nl) |
### ⚙️ Ops
| App | Description | URL |
|-----|-------------|-----|
| Forgejo | Self-hosted Git — this very repo | [git.atlascorporation.nl](https://git.atlascorporation.nl) |
| n8n | Workflow automation | [n8n.atlascorporation.nl](https://n8n.atlascorporation.nl) |
| Uptime Kuma | Service health monitoring | [uptime.atlascorporation.nl](https://uptime.atlascorporation.nl) |
| MeshCentral | Fleet management + remote access | [mesh.atlascorporation.nl](https://mesh.atlascorporation.nl) |
| Command | Atlas command dashboard | [command.atlascorporation.nl](https://command.atlascorporation.nl) |
| Remote Desktop | Webtop full Linux desktop (tailnet-only) | `atlas-01.tailab40ed.ts.net:8497` |
| Architecture | Live system map | `/os/sitemap.html` |
### 🌐 Managed Sites
`atlasworks.nl` · `atlascorporation.nl` · `atlasagency.nl` · `atlasacademy.nl` · `atlaspos.nl` · `atlashub.nl` · `bicosagency.nl` · `budgetenergiecoach.nl` · `hkintercare.nl` · `jouwenergieadvies.nl` · `reclamemans.nl`
---
## 🏗️ Architecture
```mermaid
graph LR
subgraph Internet
U([User Browser])
iOS([iOS / Mobile])
end
subgraph atlas-01["atlas-01 · Hetzner CPX32"]
direction TB
C[Caddy TLS]
A[Authentik SSO]
C -->|forward_auth| A
A -->|verified| OS[Atlas OS Desktop]
A -->|verified| OD[Odoo ERP]
A -->|verified| NC[Nextcloud]
A -->|verified| AI[AI Gateway LiteLLM]
A -->|verified| FG[Forgejo Git]
A -->|verified| N8[n8n]
A -->|verified| MC[MeshCentral]
A -->|verified| UP[Uptime Kuma]
subgraph AI Stack
AI --> OL[Ollama Local Models]
AI --> GR[Groq Cloud]
AI --> CL[Claude API]
AB[Atlas Brain] -->|15min cycle| AI
AB --> ST[atlas-state.json]
ST --> OS
end
subgraph Mesh
NATS[NATS Event Bus]
NATS --> TS[Tailscale Devices]
end
end
U -->|HTTPS| C
iOS -->|Tailscale| TS
```
---
## 🤖 AI Stack
Atlas OS has a 4-tier AI routing stack — zero-cost local first, paid cloud only when needed:
| Tier | Model / Alias | Backing | Use |
|------|--------------|---------|-----|
| 0 — Local | `atlas-fast` | LLaMA 1B (RTX A2000) | Classification, routing, labels |
| 0 — Local | `atlas-free` | Hermes3 7B | Dutch copy, FAQ, product descriptions |
| 0 — Local | `atlas-code` | Qwen Coder | Code completion, simple fixes |
| 0 — Local | `atlas-auto` | Smart router | Picks best free local model |
| 1 — Free Cloud | `groq/llama-3.3-70b` | Groq | Fast 70B reasoning, bulk tasks |
| 1 — Free Cloud | `cerebras/llama-3.1-70b` | Cerebras | Fastest inference, free tier |
| 1 — Free Cloud | `gemini-2.5-pro` | OpenRouter | 1M context, vision, PDF |
| 2 — Paid | `claude-haiku-4-5` | Anthropic | Short copy, classification |
| 2 — Paid | `claude-sonnet-4-6` | Anthropic | Code, multi-step reasoning |
| 2 — Paid | `claude-opus-4-8` | Anthropic | Deep research, architecture |
**Key AI services running 24/7:**
| Service | What it does |
|---------|-------------|
| `atlas-brain` | Collects mail + CRM + bank every 15 min → synthesizes daily brief |
| `atlas-loop` | Background signal loop — publishes nudges to NATS |
| `atlas-meridian` | Autonomous decision engine / battle responder |
| `atlas-litellm` | Unified LLM proxy (OpenAI-compat API for all above models) |
| NATS mesh | Real-time event bus across all devices on the tailnet |
| Langfuse | Full LLM observability — every call traced |
---
## 🚀 Quick Deploy
> **Requirements:** Debian 12 or Ubuntu 24.04, a domain with DNS pointed at the server, a Tailscale account.
```bash
git clone https://git.atlascorporation.nl/chaib/atlas-os
cd atlas-os
chmod +x deploy/install.sh
./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com
```
The installer sets up Docker, Caddy, Tailscale, and the core compose stacks. After install, configure Authentik at `https://auth.yourdomain.com` to create your admin user, then log in to `https://command.yourdomain.com/os/`.
See [deploy/README.md](./deploy/README.md) for full instructions.
---
## 📁 Repository Structure
```
atlas-os/
├── assets/
│ ├── header.svg # Animated space header (used in README)
│ └── logo.svg # Atlas A logo
├── web/
│ ├── os/
│ │ └── index.html # The browser OS desktop (production copy)
│ ├── sitemap.html # Live architecture map
│ ├── atlas-chat.html # Atlas Chat UI
│ ├── atlas-command.html # Command dashboard
│ └── atlas-hud.html # HUD overlay
├── server/
│ ├── atlas_brain.py # Signal collector + AI brief synthesizer
│ ├── cockpit_shim.py # Feed API adapter
│ ├── intelligence.py # Intelligence layer
│ ├── meridian.py # Autonomous decision engine
│ ├── atlas_router_api.py # Local model router (port 8888)
│ ├── cli-atlas.py # Atlas CLI
│ └── systemd/ # Service unit files
├── scripts/
│ ├── atlas_brain.py # Brain export scripts
│ ├── atlas_self_prompting_loop.py
│ ├── enis_monitor.py # WhatsApp auto-reply monitor
│ └── ...
├── deploy/
│ ├── install.sh # One-command installer
│ ├── compose/
│ │ ├── atlas-core.yml # Core services (Authentik, Nextcloud, Mail, Git, Vault)
│ │ └── atlas-ai.yml # AI stack (LiteLLM, Open-WebUI, Langfuse)
│ ├── caddy/
│ │ └── Caddyfile.template
│ └── README.md
├── docs/
│ ├── getting-started.md
│ ├── ai-stack.md
│ ├── security.md
│ ├── services.md
│ └── system-of-record.md
├── patterns/
│ ├── ANTI_IMPULSE_RULES.md
│ └── CLUSTER_THEN_POLISH.md
├── ARCHITECTURE.md
├── SERVICES.md
├── CHANGELOG.md
└── README.md # This file
```
---
## 🔒 Security Model
| Layer | Implementation |
|-------|---------------|
| Identity | Authentik SSO — single source of truth for all services |
| TLS | Caddy automatic HTTPS on every public endpoint |
| Network | Public services behind SSO · internal services on Tailscale only |
| Secrets | Vaultwarden (end-to-end encrypted) · age-encrypted vault for sync |
| File permissions | 600 on all secret files on atlas-01 |
| Remote desktop | Webtop is tailnet-only — never exposed to public internet |
| Backups | `atlas-backup-*` systemd services for Forgejo, Nextcloud, Authentik |
**Rule:** anything root-level (remote desktop, server SSH) stays tailnet-only. Public services must pass through Authentik `forward_auth`. No bare basic-auth on the public internet.
---
## 🛠️ Tech Stack
| Component | Technology |
|-----------|------------|
| Reverse proxy + TLS | [Caddy](https://caddyserver.com) |
| Identity & SSO | [Authentik](https://goauthentik.io) |
| Containers | Docker + Docker Compose |
| Private mesh | [Tailscale](https://tailscale.com) |
| Event bus | [NATS](https://nats.io) |
| CRM / ERP | [Odoo 19](https://odoo.com) |
| File storage | [Nextcloud 31](https://nextcloud.com) |
| Finance | [Firefly III](https://firefly-iii.org) |
| Documents | [Paperless-ngx](https://docs.paperless-ngx.com) |
| Mail server | [Stalwart](https://stalw.art) |
| Git hosting | [Forgejo](https://forgejo.org) |
| Automation | [n8n](https://n8n.io) |
| Password manager | [Vaultwarden](https://github.com/dani-garcia/vaultwarden) |
| AI proxy | [LiteLLM](https://litellm.ai) |
| AI chat UI | [Open-WebUI](https://openwebui.com) |
| LLM observability | [Langfuse](https://langfuse.com) |
| Remote desktop | [Webtop](https://docs.linuxserver.io/images/docker-webtop/) (KasmVNC + XFCE) |
| Fleet management | [MeshCentral](https://meshcentral.com) |
| Monitoring | [Uptime Kuma](https://uptime.kuma.pet) |
| AI models (local) | [Ollama](https://ollama.com) on RTX A2000 |
| Brain / orchestrator | Python 3.12 + httpx + NATS.py |
| OS desktop | Vanilla JS (single HTML file, zero build step) |
---
---
Built with obsession by **Chaib Aarab** · Atlas Corporation · Tilburg, NL
⟡ [atlascorporation.nl](https://atlascorporation.nl) · [atlasworks.nl](https://atlasworks.nl) · [atlaspos.nl](https://atlaspos.nl) ⟡
*"Your business on one box — space grade."*