a90a428189
- Full service map (18 public services documented) - Mermaid architecture diagram: Internet → Caddy → Authentik → Apps → AI - AI stack diagram: local router tiers + cloud fallback chain - Deployment guide: VPS spec, Caddy SSO pattern, env layout - Security model: perimeter, auth gates, AI kill-switch, secrets policy - Repo structure tree - Atlas branding header + shields.io badges
225 lines
6.9 KiB
Markdown
225 lines
6.9 KiB
Markdown
<div align="center">
|
|
|
|
```
|
|
█████╗ ████████╗██╗ █████╗ ███████╗
|
|
██╔══██╗╚══██╔══╝██║ ██╔══██╗██╔════╝
|
|
███████║ ██║ ██║ ███████║███████╗
|
|
██╔══██║ ██║ ██║ ██╔══██║╚════██║
|
|
██║ ██║ ██║ ███████╗██║ ██║███████║
|
|
╚═╝ ╚═╝ ╚═╝ ╚══════╝╚═╝ ╚═╝╚══════╝
|
|
O S · A I C o m m a n d C e n t e r
|
|
```
|
|
|
|
**A browser-native AI desktop — log in with your identity, get your data, run your tools.**
|
|
No install. Any device. One URL.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
---
|
|
|
|
## What it is
|
|
|
|
Atlas OS is a Citrix-style browser desktop for solo founders and small teams.
|
|
Log in once with Authentik SSO → a desktop boots with live data from your actual systems:
|
|
bank transactions, CRM leads, email drafts, fleet status, and a kill-switch for your AI agents.
|
|
|
|
**Live:** `https://command.atlascorporation.nl/os/` *(SSO required)*
|
|
|
|
---
|
|
|
|
## Screens
|
|
|
|
| # | Screen | Live data |
|
|
|---|--------|-----------|
|
|
| 1 | **Today** | AI daily brief, accountability level |
|
|
| 2 | **Money** | Bank transactions (Enable Banking) |
|
|
| 3 | **Inbox** | Email + WhatsApp drafts, flagged items |
|
|
| 4 | **Pipeline** | CRM leads and deal status (Odoo) |
|
|
| 5 | **Fleet** | POS terminals, health, last-seen |
|
|
| 6 | **Control** | AI kill-switch, daily spend cap |
|
|
|
|
---
|
|
|
|
## Architecture
|
|
|
|
```mermaid
|
|
graph TB
|
|
subgraph Internet["Internet"]
|
|
User([User / Device])
|
|
end
|
|
|
|
subgraph Edge["Edge — Caddy reverse proxy"]
|
|
Caddy[Caddy TLS + rate limit]
|
|
end
|
|
|
|
subgraph Identity["Identity — Authentik"]
|
|
Auth[Authentik SSO forward_auth]
|
|
end
|
|
|
|
subgraph OS["Atlas OS"]
|
|
Desktop[Atlas OS PWA]
|
|
Cockpit[The Mind cockpit]
|
|
end
|
|
|
|
subgraph Comms["Communications"]
|
|
Evolution[Evolution API WhatsApp]
|
|
Stalwart[Stalwart Mail SMTP/IMAP]
|
|
end
|
|
|
|
subgraph Apps["Apps"]
|
|
Odoo[Odoo 19 CE CRM+ERP]
|
|
Nextcloud[Nextcloud 31 files+cal]
|
|
Firefly[Firefly III finance]
|
|
Paperless[Paperless-ngx docs]
|
|
N8N[n8n automation]
|
|
Forgejo[Forgejo git]
|
|
Vault[Vaultwarden passwords]
|
|
MeshCentral[MeshCentral remote]
|
|
end
|
|
|
|
subgraph AI["AI Layer"]
|
|
Router[Atlas LLM Router local+cloud]
|
|
Brain[Atlas Brain autonomous agent]
|
|
end
|
|
|
|
User --> Caddy
|
|
Caddy --> Auth
|
|
Auth --> Desktop
|
|
Auth --> Apps
|
|
Desktop --> Cockpit
|
|
Cockpit --> Odoo
|
|
Brain --> Router
|
|
Evolution --> Brain
|
|
```
|
|
|
|
---
|
|
|
|
## Service map
|
|
|
|
| Category | Service | URL |
|
|
|----------|---------|-----|
|
|
| Identity | Authentik SSO | auth.atlascorporation.nl |
|
|
| Identity | Vaultwarden | vault.atlascorporation.nl |
|
|
| OS | Atlas OS PWA | command.atlascorporation.nl/os/ |
|
|
| OS | Command dashboard | command.atlascorporation.nl |
|
|
| AI | Open WebUI / chat | chat.atlascorporation.nl |
|
|
| AI | Atlas Brain | internal |
|
|
| Mail | Stalwart | mail.atlascorporation.nl |
|
|
| CRM / ERP | Odoo 19 CE | odoo.atlascorporation.nl |
|
|
| Files | Nextcloud 31 | cloud.atlascorporation.nl |
|
|
| Finance | Firefly III | money.atlascorporation.nl |
|
|
| Documents | Paperless-ngx | docs.atlascorporation.nl |
|
|
| Automation | n8n | n8n.atlascorporation.nl |
|
|
| Git | Forgejo | git.atlascorporation.nl |
|
|
| Remote access | MeshCentral | mesh.atlascorporation.nl |
|
|
| Monitoring | Uptime Kuma | uptime.atlascorporation.nl |
|
|
| WhatsApp | Evolution API | internal |
|
|
| Academy | Atlas Academy | atlasacademy.nl |
|
|
| POS | AtlasPOS | atlaspos.nl |
|
|
|
|
---
|
|
|
|
## Repo structure
|
|
|
|
```
|
|
atlas-os/
|
|
├── web/
|
|
│ ├── os.html # Atlas OS desktop PWA (6 screens, 28KB)
|
|
│ └── sitemap.html # Live service map (all 24+ services)
|
|
├── scripts/
|
|
│ ├── enis_monitor.py # WhatsApp monitor + LLM auto-reply
|
|
│ ├── enis_monitor.service # systemd unit template
|
|
│ └── *.py # Automation: finance, leads, reminders
|
|
├── patterns/
|
|
│ ├── ANTI_IMPULSE_RULES.md # Build discipline
|
|
│ └── CLUSTER_THEN_POLISH.md # UX pattern
|
|
├── docs/
|
|
│ ├── deployment.md # Full stack deployment guide
|
|
│ └── security.md # Security model
|
|
└── .gitignore # Blocks secrets, env files, credentials
|
|
```
|
|
|
|
---
|
|
|
|
## Deployment
|
|
|
|
### Prerequisites
|
|
- VPS (4 vCPU / 8 GB RAM minimum — Hetzner CPX32 recommended)
|
|
- Docker + Docker Compose
|
|
- Caddy (TLS + reverse proxy)
|
|
- Domain you control
|
|
|
|
### Atlas OS (Caddyfile snippet)
|
|
|
|
```caddy
|
|
command.yourdomain.com {
|
|
forward_auth authentik-server:9000 {
|
|
uri /outpost.goauthentik.io/auth/caddy
|
|
copy_headers X-Authentik-Username X-Authentik-Name X-Authentik-Email
|
|
}
|
|
handle_path /os/* {
|
|
root * /opt/atlas/atlas-desktop
|
|
file_server
|
|
}
|
|
}
|
|
```
|
|
|
|
### WhatsApp monitor
|
|
|
|
```bash
|
|
cp scripts/enis_monitor.py /opt/atlas/brain/
|
|
cp scripts/enis_monitor.service /etc/systemd/system/atlas-enis-monitor.service
|
|
systemctl enable --now atlas-enis-monitor
|
|
```
|
|
|
|
The monitor only replies when the contact starts a message with `/atlas` — silent otherwise.
|
|
|
|
---
|
|
|
|
## AI stack
|
|
|
|
```
|
|
User message
|
|
│
|
|
▼
|
|
Atlas Brain (Python autonomous agent)
|
|
│
|
|
├── Local router (localhost:8888)
|
|
│ ├── atlas-fast LLaMA 1B labels, routing
|
|
│ ├── atlas-free hermes3 Dutch copy, summaries
|
|
│ ├── atlas-code Qwen Coder code completion
|
|
│ └── atlas-phi3 Qwen 7B reasoning
|
|
│
|
|
└── Cloud fallback (free tier first)
|
|
├── Groq llama-3.3-70b-versatile
|
|
├── Cerebras llama-3.1-70b
|
|
└── Claude sonnet-4-6 (paid, last resort)
|
|
```
|
|
|
|
---
|
|
|
|
## Security model
|
|
|
|
- **All public services behind Authentik** — unauthenticated = 302 to SSO login.
|
|
- **Sensitive APIs on Tailscale only** — cockpit, Odoo internal APIs never public.
|
|
- **No secrets in git** — `.gitignore` blocks `*.env`, `*.key`, `*.sqlite`, `secrets/`, `.auth`.
|
|
- **LLM guardrails** — WhatsApp brain hard-blocks passwords, personal finance, client data.
|
|
- **Human gate for critical actions** — money movement, external comms, self-modification all require approval via the Control screen.
|
|
|
|
---
|
|
|
|
## Built by
|
|
|
|
**Chaib Aarab** — [Atlas Corporation](https://atlascorporation.nl), Tilburg NL
|
|
|
|
Solo founder building AI-native business tooling for SMEs.
|
|
Everything here was built incrementally while running actual client projects.
|
|
|
|
---
|
|
|
|
*MIT License — see LICENSE*
|