# Atlas OS
[](#-quick-deploy)
[](./SERVICES.md)
[](./SERVICES.md)
[](./ARCHITECTURE.md)
[](./docs/ai-stack.md)
**Your entire business running on one hardened Linux server.**
**One SSO identity. One browser login. One OS.**
[๐ Architecture](./ARCHITECTURE.md) ยท [๐ฆ Services](./SERVICES.md) ยท [๐ Deploy](./deploy/) ยท [๐ค AI Stack](./docs/ai-stack.md)
---
> **๐ Live deployment showcase.** This documents a real running installation.
> All `YOUR_DOMAIN` references map to the actual domain. To clone and adapt:
> ```bash
> git clone
> cd atlas-os
> grep -rl 'YOUR_DOMAIN' . | xargs sed -i 's/YOUR_DOMAIN/yourdomain.com/g'
> sudo ./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com
> ```
> Full guide โ [deploy/README.md](./deploy/README.md)
---
## What is Atlas OS?
Atlas OS is a self-hosted business operating system running on a single Linux server. One [Authentik](https://goauthentik.io) SSO identity unlocks **39 services** spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop โ all served behind [Caddy](https://caddyserver.com) with automatic HTTPS.
Built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.
> Think of it as a Citrix-style desktop โ but it is your own server, your own identity, your own data.
The Atlas OS desktop โ categorized launcher, live cockpit panels. Served at command.YOUR_DOMAIN/os/ behind SSO.
---
## ๐ฅ๏ธ The Desktop
Open `https://command.YOUR_DOMAIN/os/` on any device. You get a space-themed boot screen โ Authentik SSO login โ a live desktop with your real data: a categorized launcher (Cockpit ยท Identity ยท AI ยท Work ยท Files ยท Ops ยท Sites), drag-and-drop windows, and cockpit panels that auto-refresh.
**Remote Linux desktop** (tailnet-only, Webtop):
A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed โ OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device.
---
## ๐๏ธ Architecture
One box. Caddy is the **sole** public entry point. Every public service passes through Authentik `forward_auth` before it is reached. Root-level access (SSH, the remote desktop) is Tailscale-only and never exposed to the public internet.
Interactive Mermaid diagram
```mermaid
graph LR
subgraph Internet
U([User Browser])
iOS([iOS / Mobile])
end
subgraph server["Your Server"]
direction TB
C[Caddy TLS]
A[Authentik SSO]
C -->|forward_auth| A
A -->|verified| OS[Atlas OS Desktop]
A -->|verified| OD[Odoo ERP]
A -->|verified| NC[Nextcloud]
A -->|verified| AI[AI Gateway]
A -->|verified| FG[Forgejo Git]
A -->|verified| MC[MeshCentral]
subgraph AIStack["AI Stack"]
AI --> OL[Ollama Local]
AI --> GR[Groq / Cerebras]
AI --> CL[Claude API]
AB[Atlas Brain] -->|15min| AI
end
subgraph MeshNet["Mesh"]
NATS[NATS Event Bus] --> TS[Tailscale Devices]
end
end
U -->|HTTPS| C
iOS -->|Tailscale| TS
```
Full detail in [ARCHITECTURE.md](./ARCHITECTURE.md).
---
## ๐ฆ Service Catalog
### ๐ฏ Cockpit (live data panels)
| App | Description |
|-----|-------------|
| Today | AI daily brief + accountability level |
| Money | Bank transactions via Enable Banking PSD2 |
| Inbox | Email + WhatsApp drafts, flagged items |
| Pipeline | Odoo CRM leads and deal status |
| Fleet | POS terminals, health, last-seen (MeshCentral) |
| Control | AI kill-switch, autonomy level, daily spend cap |
### ๐ก๏ธ Identity
| App | URL |
|-----|-----|
| Authentik โ SSO, OIDC, MFA | `auth.YOUR_DOMAIN` |
| Vaultwarden โ self-hosted Bitwarden | `vault.YOUR_DOMAIN` |
### ๐ค AI
| App | URL |
|-----|-----|
| Atlas Chat (Open-WebUI) | `chat.YOUR_DOMAIN` |
| AI Gateway (LiteLLM proxy) | `llm.YOUR_DOMAIN` |
| Mindmap | `mindmap.YOUR_DOMAIN` |
| Leeragent | `leeragent.YOUR_DOMAIN` |
See the full AI routing stack (local โ free cloud โ paid) in [docs/ai-stack.md](./docs/ai-stack.md).
### ๐ผ Work
| App | URL |
|-----|-----|
| Odoo 19 ERP/CRM | `odoo.YOUR_DOMAIN` |
| Firefly III (bookkeeping) | `cfo.YOUR_DOMAIN` |
| Enable Banking (PSD2 feed) | `fidi.YOUR_DOMAIN` |
| Paperless-ngx (documents) | `paperless.YOUR_DOMAIN` |
| OnlyOffice | `office.YOUR_DOMAIN` |
| Nextcloud Calendar | `cloud.YOUR_DOMAIN` |
### ๐ Files & Comms
| App | URL |
|-----|-----|
| Nextcloud | `cloud.YOUR_DOMAIN` |
| Stalwart Mail (SMTP/IMAP/JMAP) | `stalwart.YOUR_DOMAIN` |
| Message relay | `relay.YOUR_DOMAIN` |
### โ๏ธ Ops
| App | URL |
|-----|-----|
| Forgejo (self-hosted git) | `git.YOUR_DOMAIN` |
| n8n (automation) | `n8n.YOUR_DOMAIN` |
| Uptime Kuma | `uptime.YOUR_DOMAIN` |
| MeshCentral (fleet) | `mesh.YOUR_DOMAIN` |
| Command dashboard | `command.YOUR_DOMAIN` |
| Remote Desktop (Webtop) | tailnet-only |
### ๐ Academy
An education arm running on the same box โ courses, coaching, ESF/BiSL/startup/AI curriculum. Lead capture posts straight into Odoo CRM. See [docs/academy.md](./docs/academy.md).
**๐ Course: [Digitale Soevereiniteit voor Ondernemers](https://atlasacademy.nl/slides/digitale-soevereiniteit-voor-ondernemers-10)** โ 8 lessons: why sovereign cloud โ your first server โ Docker + Caddy โ Authentik SSO โ files/mail/calendar โ free local AI โ the Atlas OS dashboard โ security & backups. Built in Odoo eLearning, linked to Odoo CRM for lead capture.
### ๐ Islamic Layer
A first-class part of the OS: family-safe DNS (AdGuard Family), Quran at logon, Adhan + screen lock at configured mosque salah times, sunnah reminders across the device fleet. See [docs/islamic-layer.md](./docs/islamic-layer.md).
### ๐ Managed Sites
Atlas OS manages multiple sites (own brands + client sites) on the same box. Each is an isolated Docker stack or static HTML, registered in Caddy with its own Authentik proxy provider if needed.
---
## ๐ค AI Stack
Four-tier routing โ zero-cost local first, paid cloud only when needed. Full table in **[docs/ai-stack.md](./docs/ai-stack.md)**.
| Tier | Example | Use |
|------|---------|-----|
| 0 โ Local | Ollama on local GPU | Classification, copy, code, summaries |
| 1 โ Free Cloud | Groq / Cerebras 70B ยท Gemini (1M ctx) | Fast reasoning, bulk tasks, vision |
| 2 โ Paid | Claude Haiku / Sonnet / Opus | Code, multi-step reasoning, architecture |
**Always-on AI services:** `atlas-brain` (15-min signal cycle), `atlas-loop` (NATS nudges), `atlas-meridian` (autonomous decisions), `atlas-litellm` (unified proxy), Langfuse (full LLM tracing).
---
## ๐ Quick Deploy
> **Requirements:** Debian 12 or Ubuntu 24.04 ยท a domain with DNS โ server ยท Tailscale account (free tier)
```bash
git clone
cd atlas-os
chmod +x deploy/install.sh
sudo ./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com
```
1. Open `https://auth.yourdomain.com` โ complete Authentik setup
2. Log in to `https://command.yourdomain.com/os/` โ desktop boots
3. Add the AI stack: `docker compose -f deploy/compose/atlas-ai.yml up -d`
4. Configure `server/atlas_brain.py` with your mail accounts
Full guide: [deploy/README.md](./deploy/README.md)
---
## ๐ Repository Structure
```
atlas-os/
โโโ assets/ # Animated header, desktop preview, architecture SVGs
โโโ web/os/index.html # The browser OS desktop (production copy)
โโโ server/ # Python services (atlas_brain, meridian, ...)
โ โโโ systemd/ # Service unit files
โโโ scripts/ # Export + automation scripts
โโโ deploy/
โ โโโ install.sh # One-command installer
โ โโโ compose/ # atlas-core.yml, atlas-ai.yml
โ โโโ caddy/ # Caddyfile.template (Authentik SSO pattern)
โโโ docs/ # ai-stack ยท academy ยท islamic-layer ยท security ยท deployment
โโโ ARCHITECTURE.md # One-box philosophy, topology, data flows
โโโ SERVICES.md # All containers + systemd services
โโโ CHANGELOG.md
```
---
## ๐ Security Model
| Layer | Implementation |
|-------|---------------|
| Identity | Authentik SSO โ single source of truth for all services |
| TLS | Caddy automatic HTTPS on every public endpoint |
| Network | Public services behind SSO ยท internal services on Tailscale only |
| Secrets | Vaultwarden (E2E) ยท age-encrypted vault for sync ยท chmod 600 on disk |
| Remote desktop | Webtop is tailnet-only โ never exposed to the public internet |
| Backups | Automated backup services for Forgejo, Nextcloud, Authentik |
**Rule:** anything root-level stays tailnet-only. Public services must pass Authentik `forward_auth`. No bare basic-auth on the public internet. Full model in [docs/security.md](./docs/security.md).
---
## ๐ ๏ธ Tech Stack
[Caddy](https://caddyserver.com) ยท [Authentik](https://goauthentik.io) ยท Docker Compose ยท [Tailscale](https://tailscale.com) ยท [NATS](https://nats.io) ยท [Odoo 19](https://odoo.com) ยท [Nextcloud](https://nextcloud.com) ยท [Firefly III](https://firefly-iii.org) ยท [Paperless-ngx](https://docs.paperless-ngx.com) ยท [Stalwart](https://stalw.art) ยท [Forgejo](https://forgejo.org) ยท [n8n](https://n8n.io) ยท [Vaultwarden](https://github.com/dani-garcia/vaultwarden) ยท [LiteLLM](https://litellm.ai) ยท [Open-WebUI](https://openwebui.com) ยท [Langfuse](https://langfuse.com) ยท [Webtop](https://docs.linuxserver.io/images/docker-webtop/) ยท [MeshCentral](https://meshcentral.com) ยท [Uptime Kuma](https://uptime.kuma.pet) ยท [Ollama](https://ollama.com)
---
Built with obsession by **Chaib Aarab** ยท Atlas Corporation ยท Tilburg, NL
*"Your business on one box โ space grade."*