Atlas OS

Your entire business running on one hardened Linux server. One SSO identity. One browser login. One OS.

📐 Architecture · 📦 Services · 🛠 Deploy · 🤖 AI Stack

---

🚀 Live deployment showcase. This documents a real running installation. All YOUR_DOMAIN references map to the actual domain. To clone and adapt:

git clone <this-repo-url>
cd atlas-os
grep -rl 'YOUR_DOMAIN' . | xargs sed -i 's/YOUR_DOMAIN/yourdomain.com/g'
sudo ./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com

Full guide → deploy/README.md

---

What is Atlas OS?

Atlas OS is a self-hosted business operating system running on a single Linux server. One Authentik SSO identity unlocks 39 services spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind Caddy with automatic HTTPS.

Built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.

Think of it as a Citrix-style desktop — but it is your own server, your own identity, your own data.

_{The Atlas OS desktop — categorized launcher, live cockpit panels. Served at command.YOUR_DOMAIN/os/ behind SSO.}

---

🖥️ The Desktop

Open https://command.YOUR_DOMAIN/os/ on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, and cockpit panels that auto-refresh.

Remote Linux desktop (tailnet-only, Webtop):

A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is inside the desktop. Requires Tailscale to be active on your device.

---

🏗️ Architecture

One box. Caddy is the sole public entry point. Every public service passes through Authentik forward_auth before it is reached. Root-level access (SSH, the remote desktop) is Tailscale-only and never exposed to the public internet.

Interactive Mermaid diagram

graph LR
    subgraph Internet
        U([User Browser])
        iOS([iOS / Mobile])
    end
    subgraph server["Your Server"]
        direction TB
        C[Caddy TLS]
        A[Authentik SSO]
        C -->|forward_auth| A
        A -->|verified| OS[Atlas OS Desktop]
        A -->|verified| OD[Odoo ERP]
        A -->|verified| NC[Nextcloud]
        A -->|verified| AI[AI Gateway]
        A -->|verified| FG[Forgejo Git]
        A -->|verified| MC[MeshCentral]
        subgraph AIStack["AI Stack"]
            AI --> OL[Ollama Local]
            AI --> GR[Groq / Cerebras]
            AI --> CL[Claude API]
            AB[Atlas Brain] -->|15min| AI
        end
        subgraph MeshNet["Mesh"]
            NATS[NATS Event Bus] --> TS[Tailscale Devices]
        end
    end
    U -->|HTTPS| C
    iOS -->|Tailscale| TS

Full detail in ARCHITECTURE.md.

---

📦 Service Catalog

🎯 Cockpit (live data panels)

App	Description
Today	AI daily brief + accountability level
Money	Bank transactions via Enable Banking PSD2
Inbox	Email + WhatsApp drafts, flagged items
Pipeline	Odoo CRM leads and deal status
Fleet	POS terminals, health, last-seen (MeshCentral)
Control	AI kill-switch, autonomy level, daily spend cap

🛡️ Identity

App	URL
Authentik — SSO, OIDC, MFA	auth.YOUR_DOMAIN
Vaultwarden — self-hosted Bitwarden	vault.YOUR_DOMAIN

🤖 AI

App	URL
Atlas Chat (Open-WebUI)	chat.YOUR_DOMAIN
AI Gateway (LiteLLM proxy)	llm.YOUR_DOMAIN
Mindmap	mindmap.YOUR_DOMAIN
Leeragent	leeragent.YOUR_DOMAIN

See the full AI routing stack (local → free cloud → paid) in docs/ai-stack.md.

💼 Work

App	URL
Odoo 19 ERP/CRM	odoo.YOUR_DOMAIN
Firefly III (bookkeeping)	cfo.YOUR_DOMAIN
Enable Banking (PSD2 feed)	fidi.YOUR_DOMAIN
Paperless-ngx (documents)	paperless.YOUR_DOMAIN
OnlyOffice	office.YOUR_DOMAIN
Nextcloud Calendar	cloud.YOUR_DOMAIN

📁 Files & Comms

App	URL
Nextcloud	cloud.YOUR_DOMAIN
Stalwart Mail (SMTP/IMAP/JMAP)	stalwart.YOUR_DOMAIN
Message relay	relay.YOUR_DOMAIN

⚙️ Ops

App	URL
Forgejo (self-hosted git)	git.YOUR_DOMAIN
n8n (automation)	n8n.YOUR_DOMAIN
Uptime Kuma	uptime.YOUR_DOMAIN
MeshCentral (fleet)	mesh.YOUR_DOMAIN
Command dashboard	command.YOUR_DOMAIN
Remote Desktop (Webtop)	tailnet-only

🎓 Academy

An education arm running on the same box — courses, coaching, ESF/BiSL/startup/AI curriculum. Lead capture posts straight into Odoo CRM. See docs/academy.md.

📖 Course: Digitale Soevereiniteit voor Ondernemers — 8 lessons: why sovereign cloud → your first server → Docker + Caddy → Authentik SSO → files/mail/calendar → free local AI → the Atlas OS dashboard → security & backups. Built in Odoo eLearning, linked to Odoo CRM for lead capture.

🕌 Islamic Layer

A first-class part of the OS: family-safe DNS (AdGuard Family), Quran at logon, Adhan + screen lock at configured mosque salah times, sunnah reminders across the device fleet. See docs/islamic-layer.md.

🌐 Managed Sites

Atlas OS manages multiple sites (own brands + client sites) on the same box. Each is an isolated Docker stack or static HTML, registered in Caddy with its own Authentik proxy provider if needed.

---

🤖 AI Stack

Four-tier routing — zero-cost local first, paid cloud only when needed. Full table in docs/ai-stack.md.

Tier	Example	Use
0 — Local	Ollama on local GPU	Classification, copy, code, summaries
1 — Free Cloud	Groq / Cerebras 70B · Gemini (1M ctx)	Fast reasoning, bulk tasks, vision
2 — Paid	Claude Haiku / Sonnet / Opus	Code, multi-step reasoning, architecture

Always-on AI services: atlas-brain (15-min signal cycle), atlas-loop (NATS nudges), atlas-meridian (autonomous decisions), atlas-litellm (unified proxy), Langfuse (full LLM tracing).

---

🚀 Quick Deploy

Requirements: Debian 12 or Ubuntu 24.04 · a domain with DNS → server · Tailscale account (free tier)

git clone <this-repo-url>
cd atlas-os
chmod +x deploy/install.sh
sudo ./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com

1. Open https://auth.yourdomain.com → complete Authentik setup
2. Log in to https://command.yourdomain.com/os/ — desktop boots
3. Add the AI stack: docker compose -f deploy/compose/atlas-ai.yml up -d
4. Configure server/atlas_brain.py with your mail accounts

Full guide: deploy/README.md

---

📁 Repository Structure

atlas-os/
├── assets/                 # Animated header, desktop preview, architecture SVGs
├── web/os/index.html       # The browser OS desktop (production copy)
├── server/                 # Python services (atlas_brain, meridian, ...)
│   └── systemd/            # Service unit files
├── scripts/                # Export + automation scripts
├── deploy/
│   ├── install.sh          # One-command installer
│   ├── compose/            # atlas-core.yml, atlas-ai.yml
│   └── caddy/              # Caddyfile.template (Authentik SSO pattern)
├── docs/                   # ai-stack · academy · islamic-layer · security · deployment
├── ARCHITECTURE.md         # One-box philosophy, topology, data flows
├── SERVICES.md             # All containers + systemd services
└── CHANGELOG.md

---

🔒 Security Model

Layer	Implementation
Identity	Authentik SSO — single source of truth for all services
TLS	Caddy automatic HTTPS on every public endpoint
Network	Public services behind SSO · internal services on Tailscale only
Secrets	Vaultwarden (E2E) · age-encrypted vault for sync · chmod 600 on disk
Remote desktop	Webtop is tailnet-only — never exposed to the public internet
Backups	Automated backup services for Forgejo, Nextcloud, Authentik

Rule: anything root-level stays tailnet-only. Public services must pass Authentik forward_auth. No bare basic-auth on the public internet. Full model in docs/security.md.

---

🛠️ Tech Stack

Caddy · Authentik · Docker Compose · Tailscale · NATS · Odoo 19 · Nextcloud · Firefly III · Paperless-ngx · Stalwart · Forgejo · n8n · Vaultwarden · LiteLLM · Open-WebUI · Langfuse · Webtop · MeshCentral · Uptime Kuma · Ollama

---

Built with obsession by Chaib Aarab · Atlas Corporation · Tilburg, NL

"Your business on one box — space grade."