Atlas OS

Your entire business running on one hardened Linux server.
One SSO identity. One browser login. One OS.

🚀 Get a workspace · 📐 Architecture · 📦 Services · 🛠 Deploy · 🤖 AI Stack · 📖 Wiki

---

What is Atlas OS?

Atlas OS is a self-hosted business operating system running on a single Hetzner VPS. One Authentik SSO identity unlocks 39 services spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind Caddy with automatic HTTPS.

It's the operational spine of Atlas Corporation (Tilburg, NL) — built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.

Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data.

Want your own? Self-host the whole stack with the one-command installer below — or get a managed Atlas workspace at atlascorporation.nl.

_{The Atlas OS desktop — categorized launcher, live cockpit panels, drag-and-drop windows. Served at command.{DOMAIN}/os/ behind SSO.}

What runs on it:

• 🏢 Odoo 19 ERP/CRM — full business operations
• 💶 Firefly III + Enable Banking — bank sync and financial intelligence
• 📧 Stalwart — self-hosted mail (all domains)
• 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
• 🎓 Atlas Academy — courses + lead capture wired to Odoo CRM
• 🕌 Islamic layer — Adhan at salah times, Quran at logon, family-safe DNS
• 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
• 🔒 Authentik — SSO that gates every single service
• ...and more

---

🖥️ The Desktop

Open command.{DOMAIN}/os/ on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, a taskbar, and cockpit panels that auto-refresh.

Remote Linux desktop (tailnet-only):

`desktop.{DOMAIN}` (tailnet-only)

A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is inside the desktop. Requires Tailscale to be active on your device.

---

🏗️ Architecture

One box. Caddy is the sole public entry point. Every public service passes through Authentik forward_auth before it's reached. Root-level access (SSH, the Webtop desktop) is Tailscale-only and never exposed to the public internet.

Interactive Mermaid diagram

graph LR
    subgraph Internet
        U([User Browser])
        iOS([iOS / Mobile])
    end
    subgraph atlas-01["atlas-01 · Hetzner CPX32"]
        direction TB
        C[Caddy TLS]
        A[Authentik SSO]
        C -->|forward_auth| A
        A -->|verified| OS[Atlas OS Desktop]
        A -->|verified| OD[Odoo ERP]
        A -->|verified| NC[Nextcloud]
        A -->|verified| AI[AI Gateway LiteLLM]
        A -->|verified| FG[Forgejo Git]
        A -->|verified| MC[MeshCentral]
        subgraph AIStack["AI Stack"]
            AI --> OL[Ollama Local]
            AI --> GR[Groq / Cerebras]
            AI --> CL[Claude API]
            AB[Atlas Brain] -->|15min| AI
            AB --> ST[atlas-state.json]
            ST --> OS
        end
        subgraph MeshNet["Mesh"]
            NATS[NATS Event Bus] --> TS[Tailscale Devices]
        end
    end
    U -->|HTTPS| C
    iOS -->|Tailscale| TS

Full detail in ARCHITECTURE.md.

---

📦 Service Catalog

🎯 Cockpit (live data panels)

App	Description
Today	AI daily brief + accountability level
Money	Bank transactions via Enable Banking PSD2
Inbox	Email + WhatsApp drafts, flagged items
Pipeline	Odoo CRM leads and deal status
Fleet	POS terminals, health, last-seen (MeshCentral)
Control	AI kill-switch, autonomy level, daily spend cap

🛡️ Identity

App	Description	URL
Authentik	SSO, OIDC, MFA — gates all services	auth.{DOMAIN}
Vaultwarden	Self-hosted Bitwarden (iOS app works)	vault.{DOMAIN}

🤖 AI

App	Description	URL
Atlas Chat	Open-WebUI — ChatGPT-style on local + cloud models	chat.{DOMAIN}
AI Gateway	LiteLLM proxy — unified OpenAI-compat API	llm.{DOMAIN}
Mindmap	AI-powered visual thinking	mindmap.{DOMAIN}
Leeragent	Learning & knowledge agent	leeragent.{DOMAIN}

See the full AI routing stack (local → free cloud → paid) in docs/ai-stack.md.

💼 Work

App	Description	URL
Odoo	ERP + CRM (leads, invoices, customers)	odoo.{DOMAIN}
CFO / Firefly III	Double-entry bookkeeping + budget intelligence	cfo.{DOMAIN}
Bank / Enable Banking	PSD2 bank sync (ING, Knab, etc.)	fidi.{DOMAIN}
Paperless-ngx	Document management + OCR	paperless.{DOMAIN}
OnlyOffice	Full office suite (Writer, Sheets, Slides)	office.{DOMAIN}
Calendar	Nextcloud Calendar (DAV sync to iOS)	cloud.{DOMAIN}

📁 Files & Comms

App	Description	URL
Nextcloud	File storage, DAV, photos	cloud.{DOMAIN}
Stalwart Mail	Self-hosted email (SMTP/IMAP/JMAP)	stalwart.{DOMAIN}
Relay	Internal message relay service	relay.{DOMAIN}

⚙️ Ops

App	Description	URL
Forgejo	Self-hosted Git — this very repo	git.atlascorporation.nl
n8n	Workflow automation	n8n.{DOMAIN}
Uptime Kuma	Service health monitoring	uptime.{DOMAIN}
MeshCentral	Fleet management + remote access	mesh.{DOMAIN}
Command	Atlas command dashboard	command.{DOMAIN}
Remote Desktop	Webtop full Linux desktop (tailnet-only)	desktop.{DOMAIN} (tailnet-only)

🎓 Atlas Academy

A full education arm running on the same box — courses, coaching, and an ESF/BiSL/AI curriculum at atlasacademy.nl. Lead capture posts straight into Odoo CRM via the atlas-academy-relay service (creates crm.lead records), with an email fallback. Product feed is wired to WooCommerce. See docs/academy.md.

🕌 Islamic Layer

A first-class part of the OS, not an add-on: family-safe DNS (AdGuard Family), Quran at logon, Adhan playback + screen lock at El Feth Tilburg salah times, and recurring sunnah reminders across the device fleet. See docs/islamic-layer.md.

🌐 Managed Sites

Your own brand sites and any client WordPress sites — each in an isolated Docker stack behind Caddy.

---

🤖 AI Stack

Atlas OS has a 4-tier AI routing stack — zero-cost local first, paid cloud only when needed. Full table and routing decision tree in docs/ai-stack.md.

Tier	Example	Use
0 — Local	atlas-auto (Ollama on RTX A2000)	Classification, Dutch copy, code, summaries
1 — Free Cloud	Groq / Cerebras 70B · Gemini (1M ctx)	Fast reasoning, bulk tasks, vision
2 — Paid	Claude Haiku / Sonnet / Opus	Code, multi-step reasoning, architecture

Always-on AI services: atlas-brain (15-min signal cycle), atlas-loop (NATS nudges), atlas-meridian (autonomous decisions), atlas-litellm (unified proxy), Langfuse (full LLM tracing).

---

🚀 Quick Deploy

Requirements: Debian 12 or Ubuntu 24.04, a domain with DNS pointed at the server, a Tailscale account.

git clone https://git.atlascorporation.nl/chaib/atlas-os
cd atlas-os
chmod +x deploy/install.sh
./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com

The installer sets up Docker, Caddy, Tailscale, and the core compose stacks. After install, configure Authentik at https://auth.yourdomain.com, then log in to https://command.yourdomain.com/os/. Full guide: deploy/README.md.

---

📁 Repository Structure

atlas-os/
├── assets/                 # Animated header, desktop preview, architecture SVGs
├── web/os/index.html       # The browser OS desktop (production copy)
├── server/                 # Sanitized production Python (atlas_brain, meridian, ...)
│   └── systemd/            # Service unit files
├── scripts/                # Export + automation scripts
├── deploy/
│   ├── install.sh          # One-command installer
│   ├── compose/            # atlas-core.yml (+ ai stack)
│   └── caddy/              # Caddyfile.template (Authentik SSO pattern)
├── docs/                   # ai-stack · academy · islamic-layer · security · deployment
├── ARCHITECTURE.md · SERVICES.md · CHANGELOG.md · README.md

---

🔒 Security Model

Layer	Implementation
Identity	Authentik SSO — single source of truth for all services
TLS	Caddy automatic HTTPS on every public endpoint
Network	Public services behind SSO · internal services on Tailscale only
Secrets	Vaultwarden (E2E) · age-encrypted vault for sync · chmod 600 on disk
Remote desktop	Webtop is tailnet-only — never exposed to the public internet
Backups	atlas-backup-* services for Forgejo, Nextcloud, Authentik

Rule: anything root-level stays tailnet-only. Public services must pass Authentik forward_auth. No bare basic-auth on the public internet. Full model in docs/security.md.

---

🛠️ Tech Stack

Caddy · Authentik · Docker Compose · Tailscale · NATS · Odoo 19 · Nextcloud · Firefly III · Paperless-ngx · Stalwart · Forgejo · n8n · Vaultwarden · LiteLLM · Open-WebUI · Langfuse · Webtop · MeshCentral · Uptime Kuma · Ollama

---

Built with obsession by Chaib Aarab · Atlas Corporation · Tilburg, NL

⟡ atlascorporation.nl · atlasworks.nl · atlasacademy.nl · atlaspos.nl ⟡

"Your business on one box — space grade."