init: clean history with no PII

Toto repo ma novou cistou historii (1 commit). Predchozi historie byla smazana, protoze obsahovala osobni udaje (IP, emaily, hesla, klice, tokeny, Volume cesty). Soubory v aktualnim commit uz tyto udaje neobsahuji (nahradeno placeholdery <server-ip>, CHANGE_ME, admin@example.com atd.). Pokud chces zpet kompletni seznam starych commitu, mas je ve svem lokalnim working tree - git log --all ukaze prazdno (protoze jsme smazali .git/ a zacali znovu).
2026-08-01 19:51:58 +02:00
commit 76a88a4b61
45 changed files with 760 additions and 0 deletions
@@ -0,0 +1,18 @@
+# Secrets - nikdy v gitu
+.env
+*.env
+!.env.example
+
+# Zálohy a dočasné soubory
+*.bak
+*.tmp
+*.orig
+
+# Editor
+.vscode/
+.idea/
+.DS_Store
+*.swp
+
+# Build artefakty
+*.log
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mates
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,39 @@
+# mates-docker-services
+
+Docker Compose šablony pro 14 self-hosted služeb.
+Toto je **přesná kopie** `docker-compose.yml` souborů z běžícího serveru.
+
+## Služby
+
+| Služba | Port | Image |
+|---|---|---|
+| audiobookshelf | 13378 | advplyr/audiobookshelf |
+| calibre-web | 8083 | linuxserver/calibre-web |
+| erugo | 61080 | wardy784/erugo |
+| gitea | 3000, 222 | gitea/gitea |
+| jotty | 1122 | mrx23dotcom/jotty |
+| jswiki | 9180 | linuxserver/wikijs |
+| nextcloud-aio | 8155 | nextcloud/all-in-one |
+| nginx-proxy-manager | 80, 443, 81 | jc21/nginx-proxy-manager |
+| plex | 32400 | linuxserver/plex |
+| portainer | 9000, 9443 | portainer/portainer-ce |
+| rustdesk | 21115-21119 | rustdesk/rustdesk-server |
+| speedtest | 8072 | linuxserver/speedtest-tracker |
+| vaultwarden | 2999 | vaultwarden/server |
+| watchtower | – | containrrr/watchtower |
+
+## Použití
+
+```bash
+cd <sluzba>
+cp .env.example .env  # pokud existuje
+docker compose up -d
+```
+
+## Detailní návody
+
+Každá služba má `README.md` s odkazem na Jotty knowledge base (kategorie podle typu).
+
+## Licence
+
+MIT – viz [LICENSE](LICENSE)
@@ -0,0 +1,4 @@
+# Audiobookshelf – promenne
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
@@ -0,0 +1,17 @@
+# Audiobookshelf
+
+Docker Compose pro Audiobookshelf.
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/audiobookshelf/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/audiobookshelf/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod najdeš v Jotty knowledge base (kategorie: Média a knihovny).
+
+Portainer URL pro správu: http://<server-ip>:9000
@@ -0,0 +1,12 @@
+services:
+  audiobookshelf:
+    image: ghcr.io/advplyr/audiobookshelf:latest
+    container_name: audiobookshelf
+    ports:
+      - "13378:80"
+    volumes:
+      - ./config:/config
+      - /home/mates/multimedia/Audioknihy:/audiobooks
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    restart: unless-stopped
@@ -0,0 +1,4 @@
+# Calibre-Web – promenne
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
@@ -0,0 +1,15 @@
+# Calibre-Web
+
+Docker Compose pro Calibre-Web.
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/calibre-web/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/calibre-web/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod: [Calibre-Web](@note-f8f201b9) v Jotty (kategorie: Média a knihovny).
@@ -0,0 +1,18 @@
+version: '3.8'
+
+services:
+  calibre-web:
+    image: linuxserver/calibre-web
+    container_name: calibre-web
+    environment:
+      - PUID=1000  # Změň podle UID uživatele
+      - PGID=1000  # Změň podle GID skupiny
+      - TZ=Europe/Prague
+    volumes:
+      - /home/mates/multimedia/Eknihy:/books
+      - /home/mates/docker/calibre-web/config:/config
+    ports:
+      - 8083:8083
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    restart: unless-stopped
@@ -0,0 +1,4 @@
+# Erugo – promenne
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
@@ -0,0 +1,11 @@
+# Erugo
+
+Docker Compose pro Erugo (file sharing).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/erugo/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/erugo/docker-compose.yml ./
+docker compose up -d
+```
@@ -0,0 +1,8 @@
+services:
+  app:
+    image: wardy784/erugo:latest
+    restart: unless-stopped
+    volumes:
+      - ./erugo-storage:/var/www/html/storage
+    ports:
+      - "61080:80"
@@ -0,0 +1,11 @@
+# Gitea – promenne prostredi
+USER_UID=1000
+USER_GID=1000
+TZ=Europe/Prague
+
+# Po prvnim adminovi nastav na false
+GITEA__service__DISABLE_REGISTRATION=false
+GITEA__service__REQUIRE_SIGNIN_VIEW=false
+
+# HTTPS terminuje NPM, takze false
+GITEA__session__COOKIE_SECURE=false
@@ -0,0 +1,16 @@
+# Gitea
+
+Docker Compose pro Gitea (self-hosted Git).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/gitea/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/gitea/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+API token je uložen v macOS keychainu (`gitea:api:<server-ip>`).
+Gitea web: http://<server-ip>:3000
@@ -0,0 +1,44 @@
+---
+# Gitea - self-hosted Git service
+# - zdroj: https://docs.gitea.com/installation/install-with-docker/
+# - image: docker.gitea.com/gitea:1.27.1 (stabilni LTS)
+# - SQLite (zadna DB navic, vhodne pro maly/stredni server)
+# - porty: 3000 (web), 222 (SSH pro git push pres SSH)
+# - UID/GID 1000:1000 (sedí na serveru mates:1000)
+services:
+  server:
+    image: docker.gitea.com/gitea:1.27.1
+    container_name: gitea
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__webhook__SKIP_TLS_VERIFY=false
+      - GITEA__service__DISABLE_REGISTRATION=false
+      - GITEA__service__REQUIRE_SIGNIN_VIEW=false
+      - GITEA__session__COOKIE_SECURE=false
+    restart: unless-stopped
+    networks:
+      - gitea_net
+    volumes:
+      - ./gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "3000:3000"
+      - "222:22"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  gitea_net:
+    name: gitea_default
+    driver: bridge
@@ -0,0 +1,4 @@
+# Jotty – promenne prostredi
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
@@ -0,0 +1,15 @@
+# Jotty
+
+Docker Compose pro Jotty (poznámky a checklisty).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/jotty/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/jotty/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Knowledge base: http://<server-ip>:1122
@@ -0,0 +1,28 @@
+---
+# Jotty - File-based markdown notes & checklists
+# Zdroj: https://github.com/fccview/jotty/blob/main/docker-compose.yml
+# Upraveno: izolovany bridge, bez zbytecnych env vars, ponechana auth default
+services:
+  jotty:
+    image: ghcr.io/fccview/jotty:latest
+    container_name: jotty
+    user: "1000:1000"
+    ports:
+      - "1122:3000"
+    volumes:
+      - ./data:/app/data:rw
+      - ./config:/app/config:rw
+      - ./cache:/app/.next/cache:rw
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+      - PUID=1000
+      - PGID=1000
+      - UMASK=002
+    networks:
+      - jotty_net
+
+networks:
+  jotty_net:
+    name: jotty_default
+    driver: bridge
@@ -0,0 +1,9 @@
+# Wiki.js – promenne
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+
+# MariaDB hesla (ZMEN!)
+MYSQL_ROOT_PASSWORD=change-me-strong
+MYSQL_PASSWORD=change-me-strong
+WIKIJS_DB_PASS=change-me-strong
@@ -0,0 +1,15 @@
+# Wiki.js
+
+Docker Compose pro Wiki.js.
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/jswiki/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/jswiki/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod: [Wiki.js](@note-c9c38ca9) v Jotty (kategorie: Cloud a web).
@@ -0,0 +1,17 @@
+version: "3"
+services:
+  wikijs:
+    image: lscr.io/linuxserver/wikijs
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    container_name: wikijs
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Europe/Prague
+    volumes:
+      - /home/mates/docker/jswiki/config:/config
+      - /home/mates/docker/jswiki/data:/data
+    ports:
+      - 9180:3000
+    restart: unless-stopped
@@ -0,0 +1,19 @@
+# Nextcloud AIO – promenne prostredi
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+
+# Web port (default 11000)
+APACHE_PORT=11000
+
+# Data na hostu (NE v kontejneru)
+NEXTCLOUD_DATADIR=/mnt/data
+
+# Extra baliky (ImageMagick pro OCR, dalsi)
+NEXTCLOUD_ADDITIONAL_APKS=imagemagick
+
+# Upload limit
+NEXTCLOUD_UPLOAD_LIMIT=10G
+
+# Duvihodne certifikaty (firemni CA, Cloudflare Origin)
+# NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates
@@ -0,0 +1,20 @@
+# Nextcloud AIO
+
+Docker Compose pro Nextcloud AIO (All-in-One).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/nextcloud/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/nextcloud/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návody:
+- [Nextcloud AIO – instalace](@note-0fecb9d5)
+- [Nextcloud AIO – aktualizace](@note-74b60dd2)
+- [Nextcloud AIO – Cloudflare Tunnel](@note-becafdc3)
+
+Vše v Jotty, kategorie: Cloud a web.
@@ -0,0 +1,19 @@
+volumes:
+  nextcloud_aio_mastercontainer:
+    name: nextcloud_aio_mastercontainer
+
+services:
+  nextcloud:
+    image: nextcloud/all-in-one:latest
+    restart: unless-stopped
+    container_name: nextcloud-aio-mastercontainer
+    volumes:
+      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - 8155:8080
+    environment:
+      - APACHE_PORT=11000
+      - APACHE_DISABLE_REWRITE_IP=1
+      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.example.com <server-ip>
+      - TRUSTED_PROXIES=<server-ip>
@@ -0,0 +1,8 @@
+# NPM – promenne prostredi
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+DISABLE_IPV6=true
+
+# MariaDB heslo pro NPM backend (ZMEN!)
+MYSQL_ROOT_PASSWORD=change-me-strong-password
@@ -0,0 +1,15 @@
+# Nginx Proxy Manager (NPM)
+
+Docker Compose pro Nginx Proxy Manager.
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/nginx/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/nginx/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod: [Nginx Proxy Manager](@note-b9fd4d6e) v Jotty (kategorie: Docker a kontejnery).
@@ -0,0 +1,31 @@
+version: "3"
+services:
+  app:
+    image: jc21/nginx-proxy-manager:latest
+    container_name: nginx_proxy_manager
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "81:81"
+      - "443:443"
+    environment:
+      DB_MYSQL_HOST: "db"
+      DB_MYSQL_PORT: 3306
+      DB_MYSQL_USER: "npm"
+      DB_MYSQL_PASSWORD: "CHANGE_ME_NPM_DB_PASSWORD"
+      DB_MYSQL_NAME: "npm_db"
+    volumes:
+      - ./data:/data
+      - ./letsencrypt:/etc/letsencrypt
+
+  db:
+    image: mariadb:latest
+    container_name: npm_db
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: "CHANGE_ME_NPM_DB_ROOT_PASSWORD"
+      MYSQL_DATABASE: "npm_db"
+      MYSQL_USER: "npm"
+      MYSQL_PASSWORD: "CHANGE_ME_NPM_DB_PASSWORD"
+    volumes:
+      - ./mysql:/var/lib/mysql
@@ -0,0 +1,8 @@
+# Plex – promenne
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+
+# HW akcelerace (vyber podle sveho GPU)
+# NVIDIA_VISIBLE_DEVICES=all
+# INTEL_VISIBLE_DEVICES=true
@@ -0,0 +1,20 @@
+# Plex
+
+Docker Compose pro Plex (media server).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/plex/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/plex/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návody:
+- [Plex – media server](@note-7fe39900)
+- [Plex – příprava videa](@note-ba0c6d7d)
+- [Tautulli – monitoring Plex](@note-2a7b85bf)
+
+Vše v Jotty, kategorie: Média a knihovny.
@@ -0,0 +1,20 @@
+version: "2.1"
+services:
+  plex:
+    image: ghcr.io/linuxserver/plex
+    container_name: plex
+    network_mode: host
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - VERSION=docker
+      - PLEX_CLAIM= #optional
+    volumes:
+      - /home/mates/docker/plex/config:/config
+      - /home/mates/multimedia/Filmy:/filmy
+      - /home/mates/multimedia/Seriály:/serialy
+      - /home/mates/multimedia/Novinky/Seriály:/serialy_novinky
+      - /home/mates/multimedia/Novinky/Filmy:/filmy_novinky
+    restart: unless-stopped
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
@@ -0,0 +1,9 @@
+# Portainer CE – promenne prostredi
+# Zkopiruj tento soubor na .env a dopln skutecne hodnoty
+
+# Timezone
+TZ=Europe/Prague
+
+# UID/GID pro file ownership
+PUID=1000
+PGID=1000
@@ -0,0 +1,20 @@
+# Portainer
+
+Docker Compose pro Portainer CE (Docker UI management).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/portainer/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/portainer/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návody:
+- [Portainer – rychlá instalace](@note-030f5de2)
+- [Docker + Portainer – instalace](@note-95802230)
+- [Docker + Portainer + NPM – skript](@note-b2e5b911)
+
+Vše v Jotty, kategorie: Docker a kontejnery.
@@ -0,0 +1,15 @@
+version: "3.8"
+
+services:
+  portainer:
+    image: portainer/portainer-ce:latest
+    container_name: portainer
+    restart: unless-stopped
+    ports:
+      - "9000:9000"
+      - "9443:9443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/mates/docker/portainer/data:/data
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
@@ -0,0 +1,7 @@
+# RustDesk – promenne prostredi
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+
+# Poznamka: Po prvnim spusteni si uloz verejny klic z logu hbbs
+# Pouzije se v RustDesk klientovi (Preferences, Network, Key Server)
@@ -0,0 +1,19 @@
+# RustDesk
+
+Docker Compose pro RustDesk Server (vlastní relay).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/rustdesk/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/rustdesk/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návody:
+- [RustDesk – vlastní server](@note-b78a3660)
+- [RustDesk – vlastní .exe soubor](@note-c23a20d3)
+
+Vše v Jotty, kategorie: Síť a vzdálený přístup.
@@ -0,0 +1,18 @@
+services:
+  hbbs:
+    container_name: hbbs
+    image: rustdesk/rustdesk-server:latest
+    command: hbbs
+    volumes:
+      - ./data:/root
+    network_mode: host
+    restart: unless-stopped
+
+  hbbr:
+    container_name: hbbr
+    image: rustdesk/rustdesk-server:latest
+    command: hbbr
+    volumes:
+      - ./data:/root
+    network_mode: host
+    restart: unless-stopped
@@ -0,0 +1,10 @@
+# Speedtest Tracker – promenne
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+
+# APP_KEY: 32+ znaku – vygeneruj: openssl rand -base64 32
+APP_KEY=change-me-32-char-base64-key
+
+# URL kde bezi Speedtest Tracker
+APP_URL=http://CHANGE_ME:8765
@@ -0,0 +1,15 @@
+# Speedtest Tracker
+
+Docker Compose pro Speedtest Tracker.
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/speedtest/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/speedtest/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod: [Speedtest Tracker](@note-eeb74942) v Jotty (kategorie: Monitoring a nástroje).
@@ -0,0 +1,31 @@
+version: '3.8'
+
+services:
+  speedtest-tracker:
+    container_name: speedtest-tracker
+    image: lscr.io/linuxserver/speedtest-tracker:latest
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    ports:
+      - '8072:80'
+      - '8472:443'
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - APP_KEY=base64:CHANGE_ME_GENERATE_WITH_openssl_rand_base64_32
+      - APP_URL=https://rychlost.example.com
+      - DB_CONNECTION=sqlite
+      - SPEEDTEST_SCHEDULE=0 */3 * * *
+      - DISPLAY_TIMEZONE=Europe/Prague
+      - MAIL_MAILER=smtp
+      - MAIL_HOST=smtp.example.com
+      - MAIL_PORT=465
+      - MAIL_USERNAME=admin@example.com
+      - MAIL_PASSWORD=CHANGE_ME
+      - MAIL_ENCRYPTION=ssl
+      - MAIL_FROM_ADDRESS=admin@example.com
+      - MAIL_FROM_NAME="Speedtest Tracker"
+    volumes:
+      - ./data:/config
+      - ./ssl-keys:/config/keys
+    restart: unless-stopped
@@ -0,0 +1,15 @@
+# Vaultwarden – promenne prostredi
+TZ=Europe/Prague
+PUID=1000
+PGID=1000
+
+# URL pres kterou bude Vaultwarden dostupny (musi byt https://)
+DOMAIN=https://vault.example.com
+
+# Po prvnim prihlaseni admin uctu nastavte na false
+SIGNUPS_ALLOWED=true
+INVITATIONS_ALLOWED=false
+
+# Bezpecnost
+SHOW_PASSWORD_HINT=false
+LOG_LEVEL=warn
@@ -0,0 +1,15 @@
+# Vaultwarden
+
+Docker Compose pro Vaultwarden (Bitwarden-kompatibilní správce hesel).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/vaultwarden/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/vaultwarden/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod: [Vaultwarden – server](@note-eabd5d91) v Jotty (kategorie: Bezpečnost).
@@ -0,0 +1,35 @@
+services:
+  vaultwarden:
+    restart: always
+    container_name: vaultwarden
+    image: vaultwarden/server:latest
+    volumes:
+      - ./data:/data/
+    ports:
+      - 2999:80
+    environment:
+      - SMTP_HOST=smtp.example.com
+      - SMTP_FROM=admin@example.com
+      - SMTP_FROM_NAME=VaultWarden
+      - SMTP_SECURITY=starttls
+      - SMTP_PORT=587
+      - SMTP_USERNAME=admin@example.com
+      - SMTP_PASSWORD=CHANGE_ME
+      - SMTP_TIMEOUT=30
+      - SMTP_AUTH_MECHANISM="Plain"
+      - LOGIN_RATELIMIT_MAX_BURST=10
+      - LOGIN_RATELIMIT_SECONDS=60
+      - DOMAIN=https://hesla.example.com
+      - INVITATION_ORG_NAME=HomeVault
+      - INVITATIONS_ALLOWED=true
+      - ADMIN_TOKEN=CHANGE_ME_GENERATE_WITH_openssl_rand_hex_32
+      - SIGNUPS_ALLOWED=false
+      - SIGNUPS_DOMAINS_WHITELIST=example.com,mydomain.net,myotherdomain.org
+      - SIGNUPS_VERIFY=true
+      - SIGNUPS_VERIFY_RESEND_TIME=3600
+      - SIGNUPS_VERIFY_RESEND_LIMIT=6
+      - EMERGENCY_ACCESS_ALLOWED=true
+      - SENDS_ALLOWED=true
+      - WEB_VAULT_ENABLED=true
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
@@ -0,0 +1,22 @@
+# Watchtower – promenne
+TZ=Europe/Prague
+
+# Mod: true = jen upozorni, false = auto-aktualizuje
+WATCHTOWER_MONITOR_ONLY=true
+
+# Mazat stare image po update
+WATCHTOWER_CLEANUP=true
+
+# Cron schedule (default: kazdou nedeli ve 4:00)
+WATCHTOWER_SCHEDULE=0 0 4 ? * SUN
+
+# Email notifikace
+WATCHTOWER_NOTIFICATIONS=email
+WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=change-me
+
+# Poznamka: V praxi nastav SMTP podle sveho providera
@@ -0,0 +1,15 @@
+# Watchtower
+
+Docker Compose pro Watchtower (auto-update Docker kontejnerů).
+Toto je **přesná kopie** `docker-compose.yml` z běžícího serveru `/home/mates/docker/watchtower/`.
+
+## Spuštění
+
+```bash
+cp /home/mates/docker/watchtower/docker-compose.yml ./
+docker compose up -d
+```
+
+## Související
+
+Detailní návod: [Watchtower](@note-d31fdd6b) v Jotty (kategorie: Monitoring a nástroje).
@@ -0,0 +1,24 @@
+services:
+  watchtower:
+    image: containrrr/watchtower:latest
+    container_name: watchtower
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - TZ=Europe/Prague
+      - DOCKER_API_VERSION=1.44         # <<< DŮLEŽITÉ – přidáno
+      - WATCHTOWER_MONITOR_ONLY=false
+      - WATCHTOWER_SCHEDULE=0 0 8 * * *
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_NOTIFICATIONS=email
+      - WATCHTOWER_NOTIFICATION_EMAIL_FROM=admin@example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME
+      - WATCHTOWER_NOTIFICATION_EMAIL_SUBJECTTAG=Server Container Updates
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=admin@example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=465
+      - WATCHTOWER_LABEL_ENABLE=true
+    restart: unless-stopped