Fleet & Mesh

How Atlas reaches, manages, and messages every device and node in the estate — from a client POS terminal in a Tilburg venue back to the single Hetzner VPS that runs the platform.

Three layers cooperate:

Layer	Tool	Role
Device management	MeshCentral	Remote-manage client POS terminals and devices
Private spine	Tailscale	Encrypted private network connecting nodes; internal services published via `tailscale serve`
Node messaging	NATS mesh	Node-to-node messaging between Atlas hosts

All of this is fronted by the same EU-sovereign infrastructure described in Infrastructure, and reachable through the browser desktop documented in Atlas-OS.

MeshCentral — device & POS management

MeshCentral is the remote-management plane for client devices, including the POS terminals that AtlasPOS deploys into venues. It lets the operator see, reach, and service a terminal without being physically present.

MeshCentral is exposed as an app in the Ops category of Atlas-OS, so it opens directly from the browser desktop alongside Forgejo, n8n, Uptime Kuma, Command, and Remote Desktop.

What it provides for a managed device:

Remote control and assistance for client POS terminals and other enrolled devices
A central view of enrolled devices grouped under the operator identity
A reach-back channel for support and maintenance

Like every other public-facing service, MeshCentral sits behind Caddy for TLS and is protected through the platform's SSO and access model — see Security.

Tailscale — the private spine

Tailscale is the private network spine that links Atlas nodes together. It is deliberately kept private:

Internal services are published over the spine with tailscale serve — never exposed publicly.

This gives a clean split between what is public and what is private:

Public services are fronted by Caddy with TLS and gated by Authentik SSO forward_auth (see Architecture and Security).
Private / internal services ride the Tailscale spine and are reached over the tailnet via tailscale serve, with no public route.

The practical effect: administrative and internal tooling stays off the public internet entirely, while only the curated set of public services is reachable from outside.

NATS mesh — node-to-node messaging

NATS provides node-to-node messaging across the Atlas mesh. Where Tailscale is the transport spine and MeshCentral is the device-management plane, NATS is the message bus that lets Atlas hosts talk to each other.

A full round-trip over the NATS mesh has been proven, confirming that nodes can publish and receive across the spine.

This messaging layer is what allows distributed Atlas components to coordinate without each one needing a direct, hand-wired connection to the others.

How a client POS terminal is reached & managed

The diagram below shows the path from the operator, through the platform, out to a client POS terminal in a venue.

%%{init:{'theme':'base','themeVariables':{'primaryColor':'#0c1428','primaryTextColor':'#cfe2ff','primaryBorderColor':'#1F6FE0','lineColor':'#4EA0FF'}}}%%
flowchart TB
    OP["Operator (atlasshb)"]
    OS["Atlas OS desktop<br/>command.atlascorporation.nl/os/"]
    CADDY["Caddy (TLS)<br/>+ Authentik SSO"]
    MC["MeshCentral<br/>device management"]
    TS["Tailscale<br/>private spine"]
    NATS["NATS mesh<br/>node messaging"]
    POS["Client POS terminal<br/>(venue)"]
    NODE["Atlas node"]

    OP --> OS --> CADDY
    CADDY --> MC
    MC -->|remote manage| POS
    CADDY -. internal via tailscale serve .-> TS
    TS --- NODE
    NODE -. NATS round-trip .-> NATS
    NATS --- NODE

Walkthrough:

The operator (atlasshb) opens the browser desktop at command.atlascorporation.nl/os/ and launches MeshCentral from the Ops category.
The request passes through Caddy (TLS) and the Authentik SSO gate — the same front door as every public service.
MeshCentral establishes the remote-management session with the enrolled client POS terminal in the venue.
Internal and node-level traffic stays on the Tailscale spine (published with tailscale serve, never public), and Atlas hosts coordinate over the NATS mesh.

Where this fits

Atlas-OS — the browser desktop where MeshCentral, Command, Uptime Kuma and other Ops apps live
Infrastructure — the single Hetzner VPS, Caddy, and the container estate this all runs on
Security — EU-sovereign hosting, SSO, MFA, and the public/private split
Architecture — how the layers and services compose end to end

Atlas OS

Get started

Technical docs

Platform