e43664a83a
- delete internal infra docs: system-of-record.md, sitemap.html status board
(exposed live attack surface: subdomains, up/down status, client names)
- parameterize OS desktop: derive DOMAIN from location.hostname, u() helper
builds service URLs so a friend deploying at their domain just works
- scrub all live service links to service.{DOMAIN} placeholders
- remove client domains (bicos, hkintercare, etc.) everywhere
- collapse brand/client site tiles to one generic Website tile
- single public CTA -> atlascorporation.nl (Get a workspace)
- relative SSO sign-out; sanitized server scripts to example.com
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
260 lines
12 KiB
Markdown
260 lines
12 KiB
Markdown
<div align="center">
|
|
|
|
|
|
|
|
# Atlas OS
|
|
|
|
[](https://atlascorporation.nl)
|
|
[](./SERVICES.md)
|
|
[](./SERVICES.md)
|
|
[](./ARCHITECTURE.md)
|
|
[](./docs/ai-stack.md)
|
|
[](https://git.atlascorporation.nl/chaib/atlas-os/wiki)
|
|
|
|
**Your entire business running on one hardened Linux server.**
|
|
**One SSO identity. One browser login. One OS.**
|
|
|
|
[🚀 Get a workspace](https://atlascorporation.nl) · [📐 Architecture](./ARCHITECTURE.md) · [📦 Services](./SERVICES.md) · [🛠 Deploy](./deploy/) · [🤖 AI Stack](./docs/ai-stack.md) · [📖 Wiki](https://git.atlascorporation.nl/chaib/atlas-os/wiki)
|
|
|
|
</div>
|
|
|
|
---
|
|
|
|
## What is Atlas OS?
|
|
|
|
Atlas OS is a self-hosted business operating system running on a single Hetzner VPS. One [Authentik](https://goauthentik.io) SSO identity unlocks **39 services** spanning CRM, finance, communications, AI, fleet management, document storage, and a full Linux remote desktop — all served behind [Caddy](https://caddyserver.com) with automatic HTTPS.
|
|
|
|
It's the operational spine of **Atlas Corporation** (Tilburg, NL) — built by and for a solo founder who needed a private cloud they actually own, styled like a space-grade command console.
|
|
|
|
> Think of it as a Citrix-style desktop, but it's your own server, your own identity, your own data.
|
|
|
|
> **Want your own?** Self-host the whole stack with the [one-command installer](#-quick-deploy) below — or get a managed Atlas workspace at **[atlascorporation.nl](https://atlascorporation.nl)**.
|
|
|
|
<div align="center">
|
|
|
|
|
|
|
|
<sub>The Atlas OS desktop — categorized launcher, live cockpit panels, drag-and-drop windows. Served at <code>command.{DOMAIN}/os/</code> behind SSO.</sub>
|
|
|
|
</div>
|
|
|
|
**What runs on it:**
|
|
- 🏢 Odoo 19 ERP/CRM — full business operations
|
|
- 💶 Firefly III + Enable Banking — bank sync and financial intelligence
|
|
- 📧 Stalwart — self-hosted mail (all domains)
|
|
- 🤖 Atlas Brain — AI that reads your mail, CRM, and bank every 15 minutes
|
|
- 🎓 Atlas Academy — courses + lead capture wired to Odoo CRM
|
|
- 🕌 Islamic layer — Adhan at salah times, Quran at logon, family-safe DNS
|
|
- 🖥️ Remote Linux desktop — Webtop (XFCE + Claude Code + Chromium inside)
|
|
- 🔒 Authentik — SSO that gates every single service
|
|
- ...and more
|
|
|
|
---
|
|
|
|
## 🖥️ The Desktop
|
|
|
|
Open ``command.{DOMAIN}/os/`` on any device. You get a space-themed boot screen → Authentik SSO login → a live desktop with your real data: a categorized launcher (Cockpit · Identity · AI · Work · Files · Ops · Sites), drag-and-drop windows, a taskbar, and cockpit panels that auto-refresh.
|
|
|
|
**Remote Linux desktop** (tailnet-only):
|
|
```
|
|
`desktop.{DOMAIN}` (tailnet-only)
|
|
```
|
|
A real XFCE desktop in the browser. Claude Code and Chromium are pre-installed — OAuth login works because the browser is *inside* the desktop. Requires Tailscale to be active on your device.
|
|
|
|
---
|
|
|
|
## 🏗️ Architecture
|
|
|
|
<div align="center">
|
|
|
|
|
|
|
|
</div>
|
|
|
|
One box. Caddy is the **sole** public entry point. Every public service passes through Authentik `forward_auth` before it's reached. Root-level access (SSH, the Webtop desktop) is Tailscale-only and never exposed to the public internet.
|
|
|
|
<details>
|
|
<summary>Interactive Mermaid diagram</summary>
|
|
|
|
```mermaid
|
|
graph LR
|
|
subgraph Internet
|
|
U([User Browser])
|
|
iOS([iOS / Mobile])
|
|
end
|
|
subgraph atlas-01["atlas-01 · Hetzner CPX32"]
|
|
direction TB
|
|
C[Caddy TLS]
|
|
A[Authentik SSO]
|
|
C -->|forward_auth| A
|
|
A -->|verified| OS[Atlas OS Desktop]
|
|
A -->|verified| OD[Odoo ERP]
|
|
A -->|verified| NC[Nextcloud]
|
|
A -->|verified| AI[AI Gateway LiteLLM]
|
|
A -->|verified| FG[Forgejo Git]
|
|
A -->|verified| MC[MeshCentral]
|
|
subgraph AIStack["AI Stack"]
|
|
AI --> OL[Ollama Local]
|
|
AI --> GR[Groq / Cerebras]
|
|
AI --> CL[Claude API]
|
|
AB[Atlas Brain] -->|15min| AI
|
|
AB --> ST[atlas-state.json]
|
|
ST --> OS
|
|
end
|
|
subgraph MeshNet["Mesh"]
|
|
NATS[NATS Event Bus] --> TS[Tailscale Devices]
|
|
end
|
|
end
|
|
U -->|HTTPS| C
|
|
iOS -->|Tailscale| TS
|
|
```
|
|
</details>
|
|
|
|
Full detail in [ARCHITECTURE.md](./ARCHITECTURE.md).
|
|
|
|
---
|
|
|
|
## 📦 Service Catalog
|
|
|
|
### 🎯 Cockpit (live data panels)
|
|
| App | Description |
|
|
|-----|-------------|
|
|
| Today | AI daily brief + accountability level |
|
|
| Money | Bank transactions via Enable Banking PSD2 |
|
|
| Inbox | Email + WhatsApp drafts, flagged items |
|
|
| Pipeline | Odoo CRM leads and deal status |
|
|
| Fleet | POS terminals, health, last-seen (MeshCentral) |
|
|
| Control | AI kill-switch, autonomy level, daily spend cap |
|
|
|
|
### 🛡️ Identity
|
|
| App | Description | URL |
|
|
|-----|-------------|-----|
|
|
| Authentik | SSO, OIDC, MFA — gates all services | `auth.{DOMAIN}` |
|
|
| Vaultwarden | Self-hosted Bitwarden (iOS app works) | `vault.{DOMAIN}` |
|
|
|
|
### 🤖 AI
|
|
| App | Description | URL |
|
|
|-----|-------------|-----|
|
|
| Atlas Chat | Open-WebUI — ChatGPT-style on local + cloud models | `chat.{DOMAIN}` |
|
|
| AI Gateway | LiteLLM proxy — unified OpenAI-compat API | `llm.{DOMAIN}` |
|
|
| Mindmap | AI-powered visual thinking | `mindmap.{DOMAIN}` |
|
|
| Leeragent | Learning & knowledge agent | `leeragent.{DOMAIN}` |
|
|
|
|
See the full AI routing stack (local → free cloud → paid) in [docs/ai-stack.md](./docs/ai-stack.md).
|
|
|
|
### 💼 Work
|
|
| App | Description | URL |
|
|
|-----|-------------|-----|
|
|
| Odoo | ERP + CRM (leads, invoices, customers) | `odoo.{DOMAIN}` |
|
|
| CFO / Firefly III | Double-entry bookkeeping + budget intelligence | `cfo.{DOMAIN}` |
|
|
| Bank / Enable Banking | PSD2 bank sync (ING, Knab, etc.) | `fidi.{DOMAIN}` |
|
|
| Paperless-ngx | Document management + OCR | `paperless.{DOMAIN}` |
|
|
| OnlyOffice | Full office suite (Writer, Sheets, Slides) | `office.{DOMAIN}` |
|
|
| Calendar | Nextcloud Calendar (DAV sync to iOS) | `cloud.{DOMAIN}` |
|
|
|
|
### 📁 Files & Comms
|
|
| App | Description | URL |
|
|
|-----|-------------|-----|
|
|
| Nextcloud | File storage, DAV, photos | `cloud.{DOMAIN}` |
|
|
| Stalwart Mail | Self-hosted email (SMTP/IMAP/JMAP) | `stalwart.{DOMAIN}` |
|
|
| Relay | Internal message relay service | `relay.{DOMAIN}` |
|
|
|
|
### ⚙️ Ops
|
|
| App | Description | URL |
|
|
|-----|-------------|-----|
|
|
| Forgejo | Self-hosted Git — this very repo | [git.atlascorporation.nl](https://git.atlascorporation.nl) |
|
|
| n8n | Workflow automation | `n8n.{DOMAIN}` |
|
|
| Uptime Kuma | Service health monitoring | `uptime.{DOMAIN}` |
|
|
| MeshCentral | Fleet management + remote access | `mesh.{DOMAIN}` |
|
|
| Command | Atlas command dashboard | `command.{DOMAIN}` |
|
|
| Remote Desktop | Webtop full Linux desktop (tailnet-only) | `desktop.{DOMAIN} (tailnet-only)` |
|
|
|
|
### 🎓 Atlas Academy
|
|
A full education arm running on the same box — courses, coaching, and an ESF/BiSL/AI curriculum at [atlasacademy.nl](https://atlasacademy.nl). Lead capture posts straight into Odoo CRM via the `atlas-academy-relay` service (creates `crm.lead` records), with an email fallback. Product feed is wired to WooCommerce. See [docs/academy.md](./docs/academy.md).
|
|
|
|
### 🕌 Islamic Layer
|
|
A first-class part of the OS, not an add-on: family-safe DNS (AdGuard Family), Quran at logon, Adhan playback + screen lock at El Feth Tilburg salah times, and recurring sunnah reminders across the device fleet. See [docs/islamic-layer.md](./docs/islamic-layer.md).
|
|
|
|
### 🌐 Managed Sites
|
|
Your own brand sites and any client WordPress sites — each in an isolated Docker stack behind Caddy.
|
|
|
|
---
|
|
|
|
## 🤖 AI Stack
|
|
|
|
Atlas OS has a 4-tier AI routing stack — zero-cost local first, paid cloud only when needed. Full table and routing decision tree in **[docs/ai-stack.md](./docs/ai-stack.md)**.
|
|
|
|
| Tier | Example | Use |
|
|
|------|---------|-----|
|
|
| 0 — Local | `atlas-auto` (Ollama on RTX A2000) | Classification, Dutch copy, code, summaries |
|
|
| 1 — Free Cloud | Groq / Cerebras 70B · Gemini (1M ctx) | Fast reasoning, bulk tasks, vision |
|
|
| 2 — Paid | Claude Haiku / Sonnet / Opus | Code, multi-step reasoning, architecture |
|
|
|
|
**Always-on AI services:** `atlas-brain` (15-min signal cycle), `atlas-loop` (NATS nudges), `atlas-meridian` (autonomous decisions), `atlas-litellm` (unified proxy), Langfuse (full LLM tracing).
|
|
|
|
---
|
|
|
|
## 🚀 Quick Deploy
|
|
|
|
> **Requirements:** Debian 12 or Ubuntu 24.04, a domain with DNS pointed at the server, a Tailscale account.
|
|
|
|
```bash
|
|
git clone https://git.atlascorporation.nl/chaib/atlas-os
|
|
cd atlas-os
|
|
chmod +x deploy/install.sh
|
|
./deploy/install.sh --domain yourdomain.com --email admin@yourdomain.com
|
|
```
|
|
|
|
The installer sets up Docker, Caddy, Tailscale, and the core compose stacks. After install, configure Authentik at `https://auth.yourdomain.com`, then log in to `https://command.yourdomain.com/os/`. Full guide: [deploy/README.md](./deploy/README.md).
|
|
|
|
---
|
|
|
|
## 📁 Repository Structure
|
|
|
|
```
|
|
atlas-os/
|
|
├── assets/ # Animated header, desktop preview, architecture SVGs
|
|
├── web/os/index.html # The browser OS desktop (production copy)
|
|
├── server/ # Sanitized production Python (atlas_brain, meridian, ...)
|
|
│ └── systemd/ # Service unit files
|
|
├── scripts/ # Export + automation scripts
|
|
├── deploy/
|
|
│ ├── install.sh # One-command installer
|
|
│ ├── compose/ # atlas-core.yml (+ ai stack)
|
|
│ └── caddy/ # Caddyfile.template (Authentik SSO pattern)
|
|
├── docs/ # ai-stack · academy · islamic-layer · security · deployment
|
|
├── ARCHITECTURE.md · SERVICES.md · CHANGELOG.md · README.md
|
|
```
|
|
|
|
---
|
|
|
|
## 🔒 Security Model
|
|
|
|
| Layer | Implementation |
|
|
|-------|---------------|
|
|
| Identity | Authentik SSO — single source of truth for all services |
|
|
| TLS | Caddy automatic HTTPS on every public endpoint |
|
|
| Network | Public services behind SSO · internal services on Tailscale only |
|
|
| Secrets | Vaultwarden (E2E) · age-encrypted vault for sync · chmod 600 on disk |
|
|
| Remote desktop | Webtop is tailnet-only — never exposed to the public internet |
|
|
| Backups | `atlas-backup-*` services for Forgejo, Nextcloud, Authentik |
|
|
|
|
**Rule:** anything root-level stays tailnet-only. Public services must pass Authentik `forward_auth`. No bare basic-auth on the public internet. Full model in [docs/security.md](./docs/security.md).
|
|
|
|
---
|
|
|
|
## 🛠️ Tech Stack
|
|
|
|
[Caddy](https://caddyserver.com) · [Authentik](https://goauthentik.io) · Docker Compose · [Tailscale](https://tailscale.com) · [NATS](https://nats.io) · [Odoo 19](https://odoo.com) · [Nextcloud](https://nextcloud.com) · [Firefly III](https://firefly-iii.org) · [Paperless-ngx](https://docs.paperless-ngx.com) · [Stalwart](https://stalw.art) · [Forgejo](https://forgejo.org) · [n8n](https://n8n.io) · [Vaultwarden](https://github.com/dani-garcia/vaultwarden) · [LiteLLM](https://litellm.ai) · [Open-WebUI](https://openwebui.com) · [Langfuse](https://langfuse.com) · [Webtop](https://docs.linuxserver.io/images/docker-webtop/) · [MeshCentral](https://meshcentral.com) · [Uptime Kuma](https://uptime.kuma.pet) · [Ollama](https://ollama.com)
|
|
|
|
---
|
|
|
|
<div align="center">
|
|
|
|
Built with obsession by **Chaib Aarab** · Atlas Corporation · Tilburg, NL
|
|
|
|
⟡ [atlascorporation.nl](https://atlascorporation.nl) · [atlasworks.nl](https://atlasworks.nl) · [atlasacademy.nl](https://atlasacademy.nl) · [atlaspos.nl](https://atlaspos.nl) ⟡
|
|
|
|
*"Your business on one box — space grade."*
|
|
|
|
</div>
|