█████╗ ████████╗██╗      █████╗ ███████╗
██╔══██╗╚══██╔══╝██║     ██╔══██╗██╔════╝
███████║   ██║   ██║     ███████║███████╗
██╔══██║   ██║   ██║     ██╔══██║╚════██║
██║  ██║   ██║   ███████╗██║  ██║███████║
╚═╝  ╚═╝   ╚═╝   ╚══════╝╚═╝  ╚═╝╚══════╝
    O S  ·  A I  C o m m a n d  C e n t e r

A browser-native AI desktop — log in with your identity, get your data, run your tools. No install. Any device. One URL.

---

What it is

Atlas OS is a Citrix-style browser desktop for solo founders and small teams. Log in once with Authentik SSO → a desktop boots with live data from your actual systems: bank transactions, CRM leads, email drafts, fleet status, and a kill-switch for your AI agents.

Live: https://command.atlascorporation.nl/os/ (SSO required)

---

Screens

#	Screen	Live data
1	Today	AI daily brief, accountability level
2	Money	Bank transactions (Enable Banking)
3	Inbox	Email + WhatsApp drafts, flagged items
4	Pipeline	CRM leads and deal status (Odoo)
5	Fleet	POS terminals, health, last-seen
6	Control	AI kill-switch, daily spend cap

---

Architecture

graph TB
    subgraph Internet["Internet"]
        User([User / Device])
    end

    subgraph Edge["Edge — Caddy reverse proxy"]
        Caddy[Caddy TLS + rate limit]
    end

    subgraph Identity["Identity — Authentik"]
        Auth[Authentik SSO forward_auth]
    end

    subgraph OS["Atlas OS"]
        Desktop[Atlas OS PWA]
        Cockpit[The Mind cockpit]
    end

    subgraph Comms["Communications"]
        Evolution[Evolution API WhatsApp]
        Stalwart[Stalwart Mail SMTP/IMAP]
    end

    subgraph Apps["Apps"]
        Odoo[Odoo 19 CE CRM+ERP]
        Nextcloud[Nextcloud 31 files+cal]
        Firefly[Firefly III finance]
        Paperless[Paperless-ngx docs]
        N8N[n8n automation]
        Forgejo[Forgejo git]
        Vault[Vaultwarden passwords]
        MeshCentral[MeshCentral remote]
    end

    subgraph AI["AI Layer"]
        Router[Atlas LLM Router local+cloud]
        Brain[Atlas Brain autonomous agent]
    end

    User --> Caddy
    Caddy --> Auth
    Auth --> Desktop
    Auth --> Apps
    Desktop --> Cockpit
    Cockpit --> Odoo
    Brain --> Router
    Evolution --> Brain

---

Service map

Category	Service	URL
Identity	Authentik SSO	auth.atlascorporation.nl
Identity	Vaultwarden	vault.atlascorporation.nl
OS	Atlas OS PWA	command.atlascorporation.nl/os/
OS	Command dashboard	command.atlascorporation.nl
AI	Open WebUI / chat	chat.atlascorporation.nl
AI	Atlas Brain	internal
Mail	Stalwart	mail.atlascorporation.nl
CRM / ERP	Odoo 19 CE	odoo.atlascorporation.nl
Files	Nextcloud 31	cloud.atlascorporation.nl
Finance	Firefly III	money.atlascorporation.nl
Documents	Paperless-ngx	docs.atlascorporation.nl
Automation	n8n	n8n.atlascorporation.nl
Git	Forgejo	git.atlascorporation.nl
Remote access	MeshCentral	mesh.atlascorporation.nl
Monitoring	Uptime Kuma	uptime.atlascorporation.nl
WhatsApp	Evolution API	internal
Academy	Atlas Academy	atlasacademy.nl
POS	AtlasPOS	atlaspos.nl

---

Repo structure

atlas-os/
├── web/
│   ├── os.html          # Atlas OS desktop PWA (6 screens, 28KB)
│   └── sitemap.html     # Live service map (all 24+ services)
├── scripts/
│   ├── enis_monitor.py        # WhatsApp monitor + LLM auto-reply
│   ├── enis_monitor.service   # systemd unit template
│   └── *.py                   # Automation: finance, leads, reminders
├── patterns/
│   ├── ANTI_IMPULSE_RULES.md  # Build discipline
│   └── CLUSTER_THEN_POLISH.md # UX pattern
├── docs/
│   ├── deployment.md    # Full stack deployment guide
│   └── security.md      # Security model
└── .gitignore           # Blocks secrets, env files, credentials

---

Deployment

Prerequisites

• VPS (4 vCPU / 8 GB RAM minimum — Hetzner CPX32 recommended)
• Docker + Docker Compose
• Caddy (TLS + reverse proxy)
• Domain you control

Atlas OS (Caddyfile snippet)

command.yourdomain.com {
    forward_auth authentik-server:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers X-Authentik-Username X-Authentik-Name X-Authentik-Email
    }
    handle_path /os/* {
        root * /opt/atlas/atlas-desktop
        file_server
    }
}

WhatsApp monitor

cp scripts/enis_monitor.py /opt/atlas/brain/
cp scripts/enis_monitor.service /etc/systemd/system/atlas-enis-monitor.service
systemctl enable --now atlas-enis-monitor

The monitor only replies when the contact starts a message with /atlas — silent otherwise.

---

AI stack

User message
    │
    ▼
Atlas Brain (Python autonomous agent)
    │
    ├── Local router (localhost:8888)
    │     ├── atlas-fast   LLaMA 1B    labels, routing
    │     ├── atlas-free   hermes3     Dutch copy, summaries
    │     ├── atlas-code   Qwen Coder  code completion
    │     └── atlas-phi3   Qwen 7B     reasoning
    │
    └── Cloud fallback (free tier first)
          ├── Groq       llama-3.3-70b-versatile
          ├── Cerebras   llama-3.1-70b
          └── Claude     sonnet-4-6  (paid, last resort)

---

Security model

• All public services behind Authentik — unauthenticated = 302 to SSO login.
• Sensitive APIs on Tailscale only — cockpit, Odoo internal APIs never public.
• No secrets in git — .gitignore blocks *.env, *.key, *.sqlite, secrets/, .auth.
• LLM guardrails — WhatsApp brain hard-blocks passwords, personal finance, client data.
• Human gate for critical actions — money movement, external comms, self-modification all require approval via the Control screen.

---

Built by

Chaib Aarab — Atlas Corporation, Tilburg NL

Solo founder building AI-native business tooling for SMEs. Everything here was built incrementally while running actual client projects.

---

MIT License — see LICENSE