chaib/atlas-os
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
atlas-os/README.md
Atlas Developer 8c1efe6e30 feat: Atlas OS v2.0 — space-grade animated README, full productified repo 
- assets/header.svg: animated SVG header (twinkling stars, orbiting service dots,
  Atlas A logo with glow, float/pulse animations, corner accents)
- README.md: animated banner, full 39-app service catalog, Mermaid architecture,
  AI stack table, tech stack, quick-deploy, repo structure, security model
- ARCHITECTURE.md: one-box philosophy, 5-tier service layers, data flow diagram,
  Caddy SSO pattern, AI mesh topology, Docker Compose topology
- SERVICES.md: all 55 containers + 20 systemd services documented
- CHANGELOG.md: full build history from v0.5 to v2.0
- assets/logo.svg: Atlas A logo with gradient
- deploy/install.sh: one-command installer (Docker + Caddy + Tailscale + stacks)
- deploy/compose/atlas-core.yml: Authentik + Nextcloud + Stalwart + Forgejo + Vaultwarden
- deploy/caddy/Caddyfile.template: Authentik SSO pattern, sanitized
- deploy/README.md: full deployment guide
- server/: sanitized atlas_brain.py, cockpit_shim.py, intelligence.py, meridian.py,
  atlas_router_api.py, cli-atlas.py (all secrets stripped, env var patterns)
- server/systemd/: 6 atlas-* service unit files
- server/README.md: deployment and configuration guide

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-22 21:33:18 +02:00

335 lines
16 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<div align="center">
![Atlas OS](./assets/header.svg)
# Atlas OS
[![Status](https://img.shields.io/badge/status-live-4ec98a?style=flat-square&logo=checkmarx&logoColor=white)](https://command.atlascorporation.nl/os/)
[![Containers](https://img.shields.io/badge/containers-55-9b8cf0?style=flat-square&logo=docker&logoColor=white)](./SERVICES.md)
[![Apps](https://img.shields.io/badge/apps-39-e0a234?style=flat-square&logo=grid&logoColor=white)](./SERVICES.md)
[![Stack](https://img.shields.io/badge/stack-Caddy_·_Authentik_·_Docker-4a9fe2?style=flat-square&logo=cloudflare&logoColor=white)](./ARCHITECTURE.md)
[![AI](https://img.shields.io/badge/AI-LiteLLM_·_Ollama_·_Claude-e2655f?style=flat-square&logo=openai&logoColor=white)](./docs/ai-stack.md)
**Your entire business running on one hardened Linux server.**
**One SSO identity. One browser login. One OS.**
[🚀 Live Desktop](https://command.atlascorporation.nl/os/) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md)
</div>
---
## What is Atlas OS?
Atlas OS is a self-hosted business operating system running on a single Hetzner VPS. One [Authentik](https://goauthentik.io) SSO identity unlocks **39 services** spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind [Caddy](https://caddyserver.com) with automatic HTTPS.
It's the operational spine of **Atlas Corporation** (Tilburg, NL) — built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.
> Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data.
**What runs on it:**
- 🏢 Odoo 19 ERP/CRM — full business operations
- 💶 Firefly III + Enable Banking — bank sync and financial intelligence
- 📧 Stalwart — self-hosted mail (all domains)
- 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
- 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
- 🔒 Authentik — SSO that gates every single service
- ...and 33 more
---
## 🖥️ The Desktop
Open `https://command.atlascorporation.nl/os/` on any device. You get:
```
┌─────────────────────────────────────────────────────┐
│ ⌂ Atlas OS 🛡 ✓ 21:47 Chaib ∨ │
├──────────────────────────────────────────────────────│
│ Cockpit │ Identity │ AI │ Work │
│ ───────── │ ──────── │ ────── │ ──── │
│ 📊 Today │ 🛡 Auth │ 💬 Chat │ 🏪 Odoo │
│ 💰 Money │ 🔒 Vault │ 🧠 AI GW │ 💼 CFO │
│ 📬 Inbox │ │ 🗺 Mind │ 🏦 Bank │
│ 📈 Pipeline│ │ 🎓 Leer │ 📄 Paperless │
│ 🚀 Fleet │ │ │ 📝 Office │
│ ⚙ Control │ │ │ 📅 Calendar │
│─────────────────────────────────────────────────────│
│ Files & Comms │ Ops │ Sites │
│ ───────────── │ ───────────── │ ───── │
│ ☁ Nextcloud │ 🔀 Git (Forgejo) │ 11 websites │
│ 📮 Mail Admin │ ⚡ n8n │ │
│ 📡 Relay │ 📈 Uptime │ │
│ │ 🌐 MeshCentral │ │
│ │ 🖥 Desktop │ │
└─────────────────────────────────────────────────────┘
```
**Boot sequence:** space-themed boot screen → Authentik SSO login → live desktop with your real data.
**Remote Linux desktop** (tailnet-only):
```
http://atlas-01.tailab40ed.ts.net:8497
```
A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device.
---
## 📦 Service Catalog
### 🎯 Cockpit (live data panels)
| App | Description | URL |
|-----|-------------|-----|
| Today | AI daily brief + accountability level | `command.atlascorporation.nl/os/` |
| Money | Bank transactions via Enable Banking PSD2 | `command.atlascorporation.nl/os/` |
| Inbox | Email + WhatsApp drafts, flagged items | `command.atlascorporation.nl/os/` |
| Pipeline | Odoo CRM leads and deal status | `command.atlascorporation.nl/os/` |
| Fleet | POS terminals, health, last-seen (MeshCentral) | `command.atlascorporation.nl/os/` |
| Control | AI kill-switch, autonomy level, daily spend cap | `command.atlascorporation.nl/os/` |
### 🛡️ Identity
| App | Description | URL |
|-----|-------------|-----|
| Authentik | SSO, OIDC, MFA — gates all services | [auth.atlascorporation.nl](https://auth.atlascorporation.nl) |
| Vaultwarden | Self-hosted Bitwarden (iOS Bitwarden app works) | [vault.atlascorporation.nl](https://vault.atlascorporation.nl) |
### 🤖 AI
| App | Description | URL |
|-----|-------------|-----|
| Atlas Chat | Open-WebUI — ChatGPT-style on local + cloud models | [chat.atlascorporation.nl](https://chat.atlascorporation.nl) |
| AI Gateway | LiteLLM proxy — unified OpenAI-compat API | [llm.atlascorporation.nl](https://llm.atlascorporation.nl) |
| Mindmap | AI-powered visual thinking | [mindmap.atlascorporation.nl](https://mindmap.atlascorporation.nl) |
| Leeragent | Learning & knowledge agent | [leeragent.atlascorporation.nl](https://leeragent.atlascorporation.nl) |
### 💼 Work
| App | Description | URL |
|-----|-------------|-----|
| Odoo | ERP + CRM (leads, invoices, customers) | [odoo.atlascorporation.nl](https://odoo.atlascorporation.nl) |
| CFO / Firefly III | Double-entry bookkeeping + budget intelligence | [cfo.atlascorporation.nl](https://cfo.atlascorporation.nl) |
| Bank / Enable Banking | PSD2 bank sync (ING, Knab, etc.) | [fidi.atlascorporation.nl](https://fidi.atlascorporation.nl) |
| Paperless-ngx | Document management + OCR | [paperless.atlascorporation.nl](https://paperless.atlascorporation.nl) |
| OnlyOffice | Full office suite (Writer, Sheets, Slides) | [office.atlascorporation.nl](https://office.atlascorporation.nl) |
| Calendar | Nextcloud Calendar (DAV sync to iOS) | [cloud.atlascorporation.nl/apps/calendar](https://cloud.atlascorporation.nl/apps/calendar) |
### 📁 Files & Comms
| App | Description | URL |
|-----|-------------|-----|
| Nextcloud | File storage, DAV, photos | [cloud.atlascorporation.nl](https://cloud.atlascorporation.nl) |
| Stalwart Mail | Self-hosted email (SMTP/IMAP/JMAP) | [stalwart.atlascorporation.nl](https://stalwart.atlascorporation.nl) |
| Relay | Internal message relay service | [relay.atlascorporation.nl](https://relay.atlascorporation.nl) |
### ⚙️ Ops
| App | Description | URL |
|-----|-------------|-----|
| Forgejo | Self-hosted Git — this very repo | [git.atlascorporation.nl](https://git.atlascorporation.nl) |
| n8n | Workflow automation | [n8n.atlascorporation.nl](https://n8n.atlascorporation.nl) |
| Uptime Kuma | Service health monitoring | [uptime.atlascorporation.nl](https://uptime.atlascorporation.nl) |
| MeshCentral | Fleet management + remote access | [mesh.atlascorporation.nl](https://mesh.atlascorporation.nl) |
| Command | Atlas command dashboard | [command.atlascorporation.nl](https://command.atlascorporation.nl) |
| Remote Desktop | Webtop full Linux desktop (tailnet-only) | `atlas-01.tailab40ed.ts.net:8497` |
| Architecture | Live system map | `/os/sitemap.html` |
### 🌐 Managed Sites
`atlasworks.nl` · `atlascorporation.nl` · `atlasagency.nl` · `atlasacademy.nl` · `atlaspos.nl` · `atlashub.nl` · `bicosagency.nl` · `budgetenergiecoach.nl` · `hkintercare.nl` · `jouwenergieadvies.nl` · `reclamemans.nl`
---
## 🏗️ Architecture
```mermaid
graph LR
subgraph Internet
U([User Browser])
iOS([iOS / Mobile])
end
subgraph atlas-01["atlas-01 · Hetzner CPX32"]
direction TB
C[Caddy TLS]
A[Authentik SSO]
C -->|forward_auth| A
A -->|verified| OS[Atlas OS Desktop]
A -->|verified| OD[Odoo ERP]
A -->|verified| NC[Nextcloud]
A -->|verified| AI[AI Gateway LiteLLM]
A -->|verified| FG[Forgejo Git]
A -->|verified| N8[n8n]
A -->|verified| MC[MeshCentral]
A -->|verified| UP[Uptime Kuma]
subgraph AI Stack
AI --> OL[Ollama Local Models]
AI --> GR[Groq Cloud]
AI --> CL[Claude API]
AB[Atlas Brain] -->|15min cycle| AI
AB --> ST[atlas-state.json]
ST --> OS
end
subgraph Mesh
NATS[NATS Event Bus]
NATS --> TS[Tailscale Devices]
end
end
U -->|HTTPS| C
iOS -->|Tailscale| TS
```
---
## 🤖 AI Stack
Atlas OS has a 4-tier AI routing stack — zero-cost local first, paid cloud only when needed:
| Tier | Model / Alias | Backing | Use |
|------|--------------|---------|-----|
| 0 — Local | `atlas-fast` | LLaMA 1B (RTX A2000) | Classification, routing, labels |
| 0 — Local | `atlas-free` | Hermes3 7B | Dutch copy, FAQ, product descriptions |
| 0 — Local | `atlas-code` | Qwen Coder | Code completion, simple fixes |
| 0 — Local | `atlas-auto` | Smart router | Picks best free local model |
| 1 — Free Cloud | `groq/llama-3.3-70b` | Groq | Fast 70B reasoning, bulk tasks |
| 1 — Free Cloud | `cerebras/llama-3.1-70b` | Cerebras | Fastest inference, free tier |
| 1 — Free Cloud | `gemini-2.5-pro` | OpenRouter | 1M context, vision, PDF |
| 2 — Paid | `claude-haiku-4-5` | Anthropic | Short copy, classification |
| 2 — Paid | `claude-sonnet-4-6` | Anthropic | Code, multi-step reasoning |
| 2 — Paid | `claude-opus-4-8` | Anthropic | Deep research, architecture |
**Key AI services running 24/7:**
| Service | What it does |
|---------|-------------|
| `atlas-brain` | Collects mail + CRM + bank every 15 min → synthesizes daily brief |
| `atlas-loop` | Background signal loop — publishes nudges to NATS |
| `atlas-meridian` | Autonomous decision engine / battle responder |
| `atlas-litellm` | Unified LLM proxy (OpenAI-compat API for all above models) |
| NATS mesh | Real-time event bus across all devices on the tailnet |
| Langfuse | Full LLM observability — every call traced |
---
## 🚀 Quick Deploy
> **Requirements:** Debian 12 or Ubuntu 24.04, a domain with DNS pointed at the server, a Tailscale account.
```bash
git clone https://git.atlascorporation.nl/chaib/atlas-os
cd atlas-os
chmod +x deploy/install.sh
./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com
```
The installer sets up Docker, Caddy, Tailscale, and the core compose stacks. After install, configure Authentik at `https://auth.yourdomain.com` to create your admin user, then log in to `https://command.yourdomain.com/os/`.
See [deploy/README.md](./deploy/README.md) for full instructions.
---
## 📁 Repository Structure
```
atlas-os/
├── assets/
│ ├── header.svg # Animated space header (used in README)
│ └── logo.svg # Atlas A logo
├── web/
│ ├── os/
│ │ └── index.html # The browser OS desktop (production copy)
│ ├── sitemap.html # Live architecture map
│ ├── atlas-chat.html # Atlas Chat UI
│ ├── atlas-command.html # Command dashboard
│ └── atlas-hud.html # HUD overlay
├── server/
│ ├── atlas_brain.py # Signal collector + AI brief synthesizer
│ ├── cockpit_shim.py # Feed API adapter
│ ├── intelligence.py # Intelligence layer
│ ├── meridian.py # Autonomous decision engine
│ ├── atlas_router_api.py # Local model router (port 8888)
│ ├── cli-atlas.py # Atlas CLI
│ └── systemd/ # Service unit files
├── scripts/
│ ├── atlas_brain.py # Brain export scripts
│ ├── atlas_self_prompting_loop.py
│ ├── enis_monitor.py # WhatsApp auto-reply monitor
│ └── ...
├── deploy/
│ ├── install.sh # One-command installer
│ ├── compose/
│ │ ├── atlas-core.yml # Core services (Authentik, Nextcloud, Mail, Git, Vault)
│ │ └── atlas-ai.yml # AI stack (LiteLLM, Open-WebUI, Langfuse)
│ ├── caddy/
│ │ └── Caddyfile.template
│ └── README.md
├── docs/
│ ├── getting-started.md
│ ├── ai-stack.md
│ ├── security.md
│ ├── services.md
│ └── system-of-record.md
├── patterns/
│ ├── ANTI_IMPULSE_RULES.md
│ └── CLUSTER_THEN_POLISH.md
├── ARCHITECTURE.md
├── SERVICES.md
├── CHANGELOG.md
└── README.md # This file
```
---
## 🔒 Security Model
| Layer | Implementation |
|-------|---------------|
| Identity | Authentik SSO — single source of truth for all services |
| TLS | Caddy automatic HTTPS on every public endpoint |
| Network | Public services behind SSO · internal services on Tailscale only |
| Secrets | Vaultwarden (end-to-end encrypted) · age-encrypted vault for sync |
| File permissions | 600 on all secret files on atlas-01 |
| Remote desktop | Webtop is tailnet-only — never exposed to public internet |
| Backups | `atlas-backup-*` systemd services for Forgejo, Nextcloud, Authentik |
**Rule:** anything root-level (remote desktop, server SSH) stays tailnet-only. Public services must pass through Authentik `forward_auth`. No bare basic-auth on the public internet.
---
## 🛠️ Tech Stack
| Component | Technology |
|-----------|------------|
| Reverse proxy + TLS | [Caddy](https://caddyserver.com) |
| Identity & SSO | [Authentik](https://goauthentik.io) |
| Containers | Docker + Docker Compose |
| Private mesh | [Tailscale](https://tailscale.com) |
| Event bus | [NATS](https://nats.io) |
| CRM / ERP | [Odoo 19](https://odoo.com) |
| File storage | [Nextcloud 31](https://nextcloud.com) |
| Finance | [Firefly III](https://firefly-iii.org) |
| Documents | [Paperless-ngx](https://docs.paperless-ngx.com) |
| Mail server | [Stalwart](https://stalw.art) |
| Git hosting | [Forgejo](https://forgejo.org) |
| Automation | [n8n](https://n8n.io) |
| Password manager | [Vaultwarden](https://github.com/dani-garcia/vaultwarden) |
| AI proxy | [LiteLLM](https://litellm.ai) |
| AI chat UI | [Open-WebUI](https://openwebui.com) |
| LLM observability | [Langfuse](https://langfuse.com) |
| Remote desktop | [Webtop](https://docs.linuxserver.io/images/docker-webtop/) (KasmVNC + XFCE) |
| Fleet management | [MeshCentral](https://meshcentral.com) |
| Monitoring | [Uptime Kuma](https://uptime.kuma.pet) |
| AI models (local) | [Ollama](https://ollama.com) on RTX A2000 |
| Brain / orchestrator | Python 3.12 + httpx + NATS.py |
| OS desktop | Vanilla JS (single HTML file, zero build step) |
---
<div align="center">
---
Built with obsession by **Chaib Aarab** · Atlas Corporation · Tilburg, NL
⟡ [atlascorporation.nl](https://atlascorporation.nl) · [atlasworks.nl](https://atlasworks.nl) · [atlaspos.nl](https://atlaspos.nl) ⟡
*"Your business on one box — space grade."*
</div>
Reference in a new issue View git blame Copy permalink