atlas-os/README.md

Atlas OS

Your entire business running on one hardened Linux server.
One SSO identity. One browser login. One OS.

🚀 Live Desktop · 📐 Architecture · 📦 Services · 🛠 Deploy · 🤖 AI Stack

---

What is Atlas OS?

Atlas OS is a self-hosted business operating system running on a single Hetzner VPS. One Authentik SSO identity unlocks 39 services spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind Caddy with automatic HTTPS.

It's the operational spine of Atlas Corporation (Tilburg, NL) — built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.

Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data.

What runs on it:

• 🏢 Odoo 19 ERP/CRM — full business operations
• 💶 Firefly III + Enable Banking — bank sync and financial intelligence
• 📧 Stalwart — self-hosted mail (all domains)
• 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
• 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
• 🔒 Authentik — SSO that gates every single service
• ...and 33 more

---

🖥️ The Desktop

Open https://command.atlascorporation.nl/os/ on any device. You get:

┌─────────────────────────────────────────────────────┐
│  ⌂ Atlas OS          🛡 ✓    21:47    Chaib  ∨      │
├──────────────────────────────────────────────────────│
│  Cockpit    │  Identity  │  AI       │  Work         │
│  ─────────  │  ────────  │  ──────   │  ────         │
│  📊 Today   │  🛡 Auth   │  💬 Chat  │  🏪 Odoo      │
│  💰 Money   │  🔒 Vault  │  🧠 AI GW │  💼 CFO       │
│  📬 Inbox   │            │  🗺 Mind  │  🏦 Bank      │
│  📈 Pipeline│            │  🎓 Leer  │  📄 Paperless │
│  🚀 Fleet   │            │           │  📝 Office    │
│  ⚙ Control  │            │           │  📅 Calendar  │
│─────────────────────────────────────────────────────│
│  Files & Comms  │  Ops              │  Sites         │
│  ─────────────  │  ─────────────    │  ─────         │
│  ☁ Nextcloud   │  🔀 Git (Forgejo) │  11 websites   │
│  📮 Mail Admin  │  ⚡ n8n           │                │
│  📡 Relay       │  📈 Uptime        │                │
│                 │  🌐 MeshCentral   │                │
│                 │  🖥 Desktop       │                │
└─────────────────────────────────────────────────────┘

Boot sequence: space-themed boot screen → Authentik SSO login → live desktop with your real data.

Remote Linux desktop (tailnet-only):

http://atlas-01.tailab40ed.ts.net:8497

A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is inside the desktop. Requires Tailscale to be active on your device.

---

📦 Service Catalog

🎯 Cockpit (live data panels)

App	Description	URL
Today	AI daily brief + accountability level	command.atlascorporation.nl/os/
Money	Bank transactions via Enable Banking PSD2	command.atlascorporation.nl/os/
Inbox	Email + WhatsApp drafts, flagged items	command.atlascorporation.nl/os/
Pipeline	Odoo CRM leads and deal status	command.atlascorporation.nl/os/
Fleet	POS terminals, health, last-seen (MeshCentral)	command.atlascorporation.nl/os/
Control	AI kill-switch, autonomy level, daily spend cap	command.atlascorporation.nl/os/

🛡️ Identity

App	Description	URL
Authentik	SSO, OIDC, MFA — gates all services	auth.atlascorporation.nl
Vaultwarden	Self-hosted Bitwarden (iOS Bitwarden app works)	vault.atlascorporation.nl

🤖 AI

App	Description	URL
Atlas Chat	Open-WebUI — ChatGPT-style on local + cloud models	chat.atlascorporation.nl
AI Gateway	LiteLLM proxy — unified OpenAI-compat API	llm.atlascorporation.nl
Mindmap	AI-powered visual thinking	mindmap.atlascorporation.nl
Leeragent	Learning & knowledge agent	leeragent.atlascorporation.nl

💼 Work

App	Description	URL
Odoo	ERP + CRM (leads, invoices, customers)	odoo.atlascorporation.nl
CFO / Firefly III	Double-entry bookkeeping + budget intelligence	cfo.atlascorporation.nl
Bank / Enable Banking	PSD2 bank sync (ING, Knab, etc.)	fidi.atlascorporation.nl
Paperless-ngx	Document management + OCR	paperless.atlascorporation.nl
OnlyOffice	Full office suite (Writer, Sheets, Slides)	office.atlascorporation.nl
Calendar	Nextcloud Calendar (DAV sync to iOS)	cloud.atlascorporation.nl/apps/calendar

📁 Files & Comms

App	Description	URL
Nextcloud	File storage, DAV, photos	cloud.atlascorporation.nl
Stalwart Mail	Self-hosted email (SMTP/IMAP/JMAP)	stalwart.atlascorporation.nl
Relay	Internal message relay service	relay.atlascorporation.nl

⚙️ Ops

App	Description	URL
Forgejo	Self-hosted Git — this very repo	git.atlascorporation.nl
n8n	Workflow automation	n8n.atlascorporation.nl
Uptime Kuma	Service health monitoring	uptime.atlascorporation.nl
MeshCentral	Fleet management + remote access	mesh.atlascorporation.nl
Command	Atlas command dashboard	command.atlascorporation.nl
Remote Desktop	Webtop full Linux desktop (tailnet-only)	atlas-01.tailab40ed.ts.net:8497
Architecture	Live system map	/os/sitemap.html

🌐 Managed Sites

atlasworks.nl · atlascorporation.nl · atlasagency.nl · atlasacademy.nl · atlaspos.nl · atlashub.nl · bicosagency.nl · budgetenergiecoach.nl · hkintercare.nl · jouwenergieadvies.nl · reclamemans.nl

---

🏗️ Architecture

graph LR
    subgraph Internet
        U([User Browser])
        iOS([iOS / Mobile])
    end

    subgraph atlas-01["atlas-01 · Hetzner CPX32"]
        direction TB
        C[Caddy TLS]
        A[Authentik SSO]
        C -->|forward_auth| A
        A -->|verified| OS[Atlas OS Desktop]
        A -->|verified| OD[Odoo ERP]
        A -->|verified| NC[Nextcloud]
        A -->|verified| AI[AI Gateway LiteLLM]
        A -->|verified| FG[Forgejo Git]
        A -->|verified| N8[n8n]
        A -->|verified| MC[MeshCentral]
        A -->|verified| UP[Uptime Kuma]

        subgraph AI Stack
            AI --> OL[Ollama Local Models]
            AI --> GR[Groq Cloud]
            AI --> CL[Claude API]
            AB[Atlas Brain] -->|15min cycle| AI
            AB --> ST[atlas-state.json]
            ST --> OS
        end

        subgraph Mesh
            NATS[NATS Event Bus]
            NATS --> TS[Tailscale Devices]
        end
    end

    U -->|HTTPS| C
    iOS -->|Tailscale| TS

---

🤖 AI Stack

Atlas OS has a 4-tier AI routing stack — zero-cost local first, paid cloud only when needed:

Tier	Model / Alias	Backing	Use
0 — Local	atlas-fast	LLaMA 1B (RTX A2000)	Classification, routing, labels
0 — Local	atlas-free	Hermes3 7B	Dutch copy, FAQ, product descriptions
0 — Local	atlas-code	Qwen Coder	Code completion, simple fixes
0 — Local	atlas-auto	Smart router	Picks best free local model
1 — Free Cloud	groq/llama-3.3-70b	Groq	Fast 70B reasoning, bulk tasks
1 — Free Cloud	cerebras/llama-3.1-70b	Cerebras	Fastest inference, free tier
1 — Free Cloud	gemini-2.5-pro	OpenRouter	1M context, vision, PDF
2 — Paid	claude-haiku-4-5	Anthropic	Short copy, classification
2 — Paid	claude-sonnet-4-6	Anthropic	Code, multi-step reasoning
2 — Paid	claude-opus-4-8	Anthropic	Deep research, architecture

Key AI services running 24/7:

Service	What it does
atlas-brain	Collects mail + CRM + bank every 15 min → synthesizes daily brief
atlas-loop	Background signal loop — publishes nudges to NATS
atlas-meridian	Autonomous decision engine / battle responder
atlas-litellm	Unified LLM proxy (OpenAI-compat API for all above models)
NATS mesh	Real-time event bus across all devices on the tailnet
Langfuse	Full LLM observability — every call traced

---

🚀 Quick Deploy

Requirements: Debian 12 or Ubuntu 24.04, a domain with DNS pointed at the server, a Tailscale account.

git clone https://git.atlascorporation.nl/chaib/atlas-os
cd atlas-os
chmod +x deploy/install.sh
./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com

The installer sets up Docker, Caddy, Tailscale, and the core compose stacks. After install, configure Authentik at https://auth.yourdomain.com to create your admin user, then log in to https://command.yourdomain.com/os/.

See deploy/README.md for full instructions.

---

📁 Repository Structure

atlas-os/
├── assets/
│   ├── header.svg          # Animated space header (used in README)
│   └── logo.svg            # Atlas A logo
├── web/
│   ├── os/
│   │   └── index.html      # The browser OS desktop (production copy)
│   ├── sitemap.html        # Live architecture map
│   ├── atlas-chat.html     # Atlas Chat UI
│   ├── atlas-command.html  # Command dashboard
│   └── atlas-hud.html      # HUD overlay
├── server/
│   ├── atlas_brain.py      # Signal collector + AI brief synthesizer
│   ├── cockpit_shim.py     # Feed API adapter
│   ├── intelligence.py     # Intelligence layer
│   ├── meridian.py         # Autonomous decision engine
│   ├── atlas_router_api.py # Local model router (port 8888)
│   ├── cli-atlas.py        # Atlas CLI
│   └── systemd/            # Service unit files
├── scripts/
│   ├── atlas_brain.py      # Brain export scripts
│   ├── atlas_self_prompting_loop.py
│   ├── enis_monitor.py     # WhatsApp auto-reply monitor
│   └── ...
├── deploy/
│   ├── install.sh          # One-command installer
│   ├── compose/
│   │   ├── atlas-core.yml  # Core services (Authentik, Nextcloud, Mail, Git, Vault)
│   │   └── atlas-ai.yml    # AI stack (LiteLLM, Open-WebUI, Langfuse)
│   ├── caddy/
│   │   └── Caddyfile.template
│   └── README.md
├── docs/
│   ├── getting-started.md
│   ├── ai-stack.md
│   ├── security.md
│   ├── services.md
│   └── system-of-record.md
├── patterns/
│   ├── ANTI_IMPULSE_RULES.md
│   └── CLUSTER_THEN_POLISH.md
├── ARCHITECTURE.md
├── SERVICES.md
├── CHANGELOG.md
└── README.md               # This file

---

🔒 Security Model

Layer	Implementation
Identity	Authentik SSO — single source of truth for all services
TLS	Caddy automatic HTTPS on every public endpoint
Network	Public services behind SSO · internal services on Tailscale only
Secrets	Vaultwarden (end-to-end encrypted) · age-encrypted vault for sync
File permissions	600 on all secret files on atlas-01
Remote desktop	Webtop is tailnet-only — never exposed to public internet
Backups	atlas-backup-* systemd services for Forgejo, Nextcloud, Authentik

Rule: anything root-level (remote desktop, server SSH) stays tailnet-only. Public services must pass through Authentik forward_auth. No bare basic-auth on the public internet.

---

🛠️ Tech Stack

Component	Technology
Reverse proxy + TLS	Caddy
Identity & SSO	Authentik
Containers	Docker + Docker Compose
Private mesh	Tailscale
Event bus	NATS
CRM / ERP	Odoo 19
File storage	Nextcloud 31
Finance	Firefly III
Documents	Paperless-ngx
Mail server	Stalwart
Git hosting	Forgejo
Automation	n8n
Password manager	Vaultwarden
AI proxy	LiteLLM
AI chat UI	Open-WebUI
LLM observability	Langfuse
Remote desktop	Webtop (KasmVNC + XFCE)
Fleet management	MeshCentral
Monitoring	Uptime Kuma
AI models (local)	Ollama on RTX A2000
Brain / orchestrator	Python 3.12 + httpx + NATS.py
OS desktop	Vanilla JS (single HTML file, zero build step)

---

---

Built with obsession by Chaib Aarab · Atlas Corporation · Tilburg, NL

⟡ atlascorporation.nl · atlasworks.nl · atlaspos.nl ⟡

"Your business on one box — space grade."