App Catalog

The complete index of the 39 apps inside Atlas-OS — the browser desktop served at command.atlascorporation.nl/os/. Apps are grouped into 7 categories. Every app runs on a single EU-sovereign Hetzner VPS (NL/DE, no US Cloud Act exposure), fronted by Caddy for TLS and gated by Authentik SSO (forward_auth via the embedded outpost). Admin identity: atlasshb.

See also: Architecture · Security · AI-Stack · Fleet-and-Mesh

Categories at a glance

%%{init:{'theme':'base','themeVariables':{'primaryColor':'#0c1428','primaryTextColor':'#cfe2ff','primaryBorderColor':'#1F6FE0','lineColor':'#4EA0FF'}}}%%
flowchart TD
    OS["Atlas OS desktop<br/>command.atlascorporation.nl/os/<br/>39 apps"]
    OS --> C1["Cockpit"]
    OS --> C2["Identity"]
    OS --> C3["AI"]
    OS --> C4["Work"]
    OS --> C5["Files & Comms"]
    OS --> C6["Ops"]
    OS --> C7["Sites"]

Category	What it covers
Cockpit	Daily command surfaces — money, inbox, pipeline, fleet, control
Identity	Single sign-on and secrets
AI	Chat, model routing, knowledge, learning
Work	ERP, finance, documents, office, calendar
Files & Comms	Storage, mail, messaging
Ops	Git, automation, monitoring, remote access, infra
Sites	Public websites and the hub

Access legend: 🔐 = behind Authentik SSO · 🔒 = Tailscale-private (tailscale serve, never public) · 🌐 = public site.

Cockpit

The operator's day-to-day control surfaces — the first screens you reach for.

App	What it does	Access
Today	Daily overview / start-of-day surface	🔐
Money	Finance snapshot and cash position	🔐
Inbox	Consolidated incoming items	🔐
Pipeline	Sales / deal pipeline view	🔐
Fleet	Device and POS fleet status	🔐
Control	Operator control panel	🔐

Identity

App	What it does	Access
Authentik	Identity provider and SSO; the `forward_auth` gate in front of nearly every service	🔐
Vaultwarden	Password and secrets vault	🔐

See Security for how Authentik fronts the stack and where secrets live.

AI

App	What it does	Access
Atlas Chat	Open WebUI front-end — the main chat surface into the AI-Stack	🔐
AI Gateway	Entry point / routing into the model layer	🔐
Mindmap	Visual idea and knowledge mapping	🔐
Leeragent	Learning / study agent	🔐

Note — Atlas Chat. Atlas Chat is Open WebUI. It talks to the LLM router at localhost:8888, which always picks the cheapest capable model first: local models (LLaMA 1B, hermes3, Qwen Coder, Qwen 7B) → free cloud (Groq llama-3.3-70b, Cerebras, OpenRouter) → paid Claude only as a last resort. A Headroom proxy compresses context to keep token use down. Full detail in AI-Stack.

Work

App	What it does	Access
Odoo 19	ERP / CRM — leads from Academy are relayed here	🔐
CFO	Finance / executive financial view	🔐
Bank (Firefly III)	Personal-finance / bank ledger manager	🔐
Paperless-ngx	Document archive with OCR and indexing	🔐
Office	Office / document suite	🔐
Calendar	Scheduling and calendar	🔐

Files & Comms

App	What it does	Access
Nextcloud 31	File storage, sync and sharing	🔐
Mail Admin (Stalwart)	Mail server administration (Stalwart)	🔐
Relay	Messaging / relay service	🔐

Ops

Engineering and infrastructure tooling — including remote access into the Fleet-and-Mesh.

App	What it does	Access
Forgejo	Self-hosted Git (code and this wiki)	🔐
n8n	Workflow automation	🔐
Uptime Kuma	Service uptime monitoring	🔐
MeshCentral	Remote-manage client POS devices and endpoints	🔐
Command	Command / control dashboard	🔐
Remote Desktop	Full Linux desktop in the browser — see note below	🔐
Architecture	Live architecture / topology view	🔐

Note — Remote Desktop. Remote Desktop is a Webtop instance running ubuntu-xfce over Selkies/WebRTC, served at desktop.atlascorporation.nl behind Authentik SSO. It ships with Claude Code and Chromium pre-installed. Because it is a real browser, Claude OAuth login works inside it — making this the standard place to drive agentic sessions from any device.

Sites

Public-facing websites and the internal hub. These are the externally reachable web properties surfaced as desktop apps.

App	What it does	Access
AtlasWorks	AtlasWorks site	🌐
Atlas Corp	Atlas Corporation corporate site	🌐
Agency	Atlas Agency site	🌐
Academy	atlasacademy.nl — BiSL / startup / AI / ESF tracks, coaching, course catalog; leads relayed into Odoo CRM	🌐
AtlasPOS	AtlasPOS site	🌐
Hub + client sites	Internal hub plus hosted client websites	🌐 / 🔐

See Academy for the learning-platform detail.

How access works

Almost every app sits behind one TLS edge and one identity gate:

%%{init:{'theme':'base','themeVariables':{'primaryColor':'#0c1428','primaryTextColor':'#cfe2ff','primaryBorderColor':'#1F6FE0','lineColor':'#4EA0FF'}}}%%
flowchart LR
    U["Browser"] --> CADDY["Caddy<br/>TLS edge"]
    CADDY --> AUTH["Authentik<br/>forward_auth (SSO)"]
    AUTH --> APPS["Atlas OS apps"]
    TS["Tailscale spine<br/>(tailscale serve)"] -. private-only .-> APPS

Public services terminate at Caddy and are protected by Authentik SSO.
Private services are exposed only over the Tailscale spine via tailscale serve — never published to the public internet.
See Architecture for the full ~55-container, ~24-public-service layout and Fleet-and-Mesh for MeshCentral, Tailscale and the NATS mesh.

Atlas OS

Get started

Technical docs

Platform