From 24d5e9be428404633c1be1e41f2035096cdb4c31 Mon Sep 17 00:00:00 2001 From: mates Date: Sat, 1 Aug 2026 16:37:32 +0200 Subject: [PATCH] refactor: split into 6 specialized repos - docker-services, ansible, install-scripts -> own repos - macos-setup merged with hermes-install - home-nas-tools (metadata only, no binaries) - docs (architecture, security, contributing) - this repo: index + LICENSE + .gitignore only --- .last-push | 1 - README.md | 112 ++++++----- ansible/README.md | 88 --------- ansible/ansible.cfg | 21 --- ansible/group_vars/all.yml.example | 35 ---- ansible/inventory.example.yml | 28 --- ansible/playbooks/bootstrap-server.yml | 145 -------------- ansible/playbooks/deploy-services.yml | 42 ----- ansible/playbooks/security-hardening.yml | 58 ------ ansible/playbooks/update-services.yml | 22 --- docker-services/README.md | 98 ---------- docker-services/audiobookshelf/.env.example | 4 - docker-services/audiobookshelf/README.md | 57 ------ .../audiobookshelf/docker-compose.yml | 29 --- docker-services/calibre-web/.env.example | 4 - docker-services/calibre-web/README.md | 53 ------ .../calibre-web/docker-compose.yml | 30 --- docker-services/erugo/.env.example | 4 - docker-services/erugo/README.md | 43 ----- docker-services/erugo/docker-compose.yml | 28 --- docker-services/gitea/.env.example | 11 -- docker-services/gitea/README.md | 70 ------- docker-services/gitea/docker-compose.yml | 39 ---- docker-services/jotty/.env.example | 4 - docker-services/jotty/README.md | 59 ------ docker-services/jotty/docker-compose.yml | 35 ---- docker-services/jswiki/.env.example | 9 - docker-services/jswiki/README.md | 54 ------ docker-services/jswiki/docker-compose.yml | 57 ------ docker-services/nextcloud-aio/.env.example | 19 -- docker-services/nextcloud-aio/README.md | 64 ------- .../nextcloud-aio/docker-compose.yml | 40 ---- .../nginx-proxy-manager/.env.example | 8 - docker-services/nginx-proxy-manager/README.md | 62 ------ .../nginx-proxy-manager/docker-compose.yml | 57 ------ docker-services/plex/.env.example | 8 - docker-services/plex/README.md | 58 ------ docker-services/plex/docker-compose.yml | 22 --- docker-services/portainer/.env.example | 9 - docker-services/portainer/README.md | 67 ------- docker-services/portainer/docker-compose.yml | 35 ---- docker-services/rustdesk/.env.example | 7 - docker-services/rustdesk/README.md | 53 ------ docker-services/rustdesk/docker-compose.yml | 53 ------ docker-services/speedtest/.env.example | 10 - docker-services/speedtest/README.md | 51 ----- docker-services/speedtest/docker-compose.yml | 30 --- docker-services/vaultwarden/.env.example | 15 -- docker-services/vaultwarden/README.md | 79 -------- .../vaultwarden/docker-compose.yml | 41 ---- docker-services/watchtower/.env.example | 22 --- docker-services/watchtower/README.md | 61 ------ docker-services/watchtower/docker-compose.yml | 34 ---- docs/architecture.md | 162 ---------------- docs/contributing.md | 116 ------------ docs/security.md | 152 --------------- hermes-install/README.md | 111 ----------- hermes-install/configure-hermes.sh | 115 ----------- hermes-install/hermes-config.example.yml | 69 ------- hermes-install/install-hermes.sh | 65 ------- home-nas-tools/README.md | 171 ----------------- install-scripts/README.md | 66 ------- install-scripts/backup-all.sh | 73 ------- install-scripts/bootstrap-ubuntu-server.sh | 178 ------------------ install-scripts/install-docker.sh | 51 ----- install-scripts/install-nginx-proxy.sh | 64 ------- install-scripts/install-portainer.sh | 43 ----- install-scripts/restore-all.sh | 73 ------- macos-setup/Brewfile | 78 -------- macos-setup/README.md | 85 --------- macos-setup/configure-fish.sh | 65 ------- macos-setup/osx-defaults.sh | 83 -------- 72 files changed, 61 insertions(+), 3904 deletions(-) delete mode 100644 .last-push delete mode 100644 ansible/README.md delete mode 100644 ansible/ansible.cfg delete mode 100644 ansible/group_vars/all.yml.example delete mode 100644 ansible/inventory.example.yml delete mode 100644 ansible/playbooks/bootstrap-server.yml delete mode 100644 ansible/playbooks/deploy-services.yml delete mode 100644 ansible/playbooks/security-hardening.yml delete mode 100644 ansible/playbooks/update-services.yml delete mode 100644 docker-services/README.md delete mode 100644 docker-services/audiobookshelf/.env.example delete mode 100644 docker-services/audiobookshelf/README.md delete mode 100644 docker-services/audiobookshelf/docker-compose.yml delete mode 100644 docker-services/calibre-web/.env.example delete mode 100644 docker-services/calibre-web/README.md delete mode 100644 docker-services/calibre-web/docker-compose.yml delete mode 100644 docker-services/erugo/.env.example delete mode 100644 docker-services/erugo/README.md delete mode 100644 docker-services/erugo/docker-compose.yml delete mode 100644 docker-services/gitea/.env.example delete mode 100644 docker-services/gitea/README.md delete mode 100644 docker-services/gitea/docker-compose.yml delete mode 100644 docker-services/jotty/.env.example delete mode 100644 docker-services/jotty/README.md delete mode 100644 docker-services/jotty/docker-compose.yml delete mode 100644 docker-services/jswiki/.env.example delete mode 100644 docker-services/jswiki/README.md delete mode 100644 docker-services/jswiki/docker-compose.yml delete mode 100644 docker-services/nextcloud-aio/.env.example delete mode 100644 docker-services/nextcloud-aio/README.md delete mode 100644 docker-services/nextcloud-aio/docker-compose.yml delete mode 100644 docker-services/nginx-proxy-manager/.env.example delete mode 100644 docker-services/nginx-proxy-manager/README.md delete mode 100644 docker-services/nginx-proxy-manager/docker-compose.yml delete mode 100644 docker-services/plex/.env.example delete mode 100644 docker-services/plex/README.md delete mode 100644 docker-services/plex/docker-compose.yml delete mode 100644 docker-services/portainer/.env.example delete mode 100644 docker-services/portainer/README.md delete mode 100644 docker-services/portainer/docker-compose.yml delete mode 100644 docker-services/rustdesk/.env.example delete mode 100644 docker-services/rustdesk/README.md delete mode 100644 docker-services/rustdesk/docker-compose.yml delete mode 100644 docker-services/speedtest/.env.example delete mode 100644 docker-services/speedtest/README.md delete mode 100644 docker-services/speedtest/docker-compose.yml delete mode 100644 docker-services/vaultwarden/.env.example delete mode 100644 docker-services/vaultwarden/README.md delete mode 100644 docker-services/vaultwarden/docker-compose.yml delete mode 100644 docker-services/watchtower/.env.example delete mode 100644 docker-services/watchtower/README.md delete mode 100644 docker-services/watchtower/docker-compose.yml delete mode 100644 docs/architecture.md delete mode 100644 docs/contributing.md delete mode 100644 docs/security.md delete mode 100644 hermes-install/README.md delete mode 100644 hermes-install/configure-hermes.sh delete mode 100644 hermes-install/hermes-config.example.yml delete mode 100644 hermes-install/install-hermes.sh delete mode 100644 home-nas-tools/README.md delete mode 100644 install-scripts/README.md delete mode 100644 install-scripts/backup-all.sh delete mode 100644 install-scripts/bootstrap-ubuntu-server.sh delete mode 100644 install-scripts/install-docker.sh delete mode 100644 install-scripts/install-nginx-proxy.sh delete mode 100644 install-scripts/install-portainer.sh delete mode 100644 install-scripts/restore-all.sh delete mode 100644 macos-setup/Brewfile delete mode 100644 macos-setup/README.md delete mode 100644 macos-setup/configure-fish.sh delete mode 100644 macos-setup/osx-defaults.sh diff --git a/.last-push b/.last-push deleted file mode 100644 index e674f13..0000000 --- a/.last-push +++ /dev/null @@ -1 +0,0 @@ -2026-08-01 16:32:27 diff --git a/README.md b/README.md index 341cc36..c757aec 100644 --- a/README.md +++ b/README.md @@ -1,83 +1,93 @@ -# 🔧 mates — Home Infrastructure +# 🏠 mates-infra – Home Infrastructure -> Sbírka šablon, skriptů a Ansible playbooků pro rychlé nasazení self-hostované infrastruktury. -> Veškerý obsah vychází z reálného běhu na serveru `192.168.0.148` (Ubuntu 24.04, Docker 29.x). - -**[![Gitea](https://img.shields.io/badge/Gitea-192.168.0.148:3000-609926?logo=gitea)](http://192.168.0.148:3000)** · **[![Jotty](https://img.shields.io/badge/Jotty-docs-3b82f6)](http://192.168.0.148:1122)** · **[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)** +> Hlavní index pro **home infrastructure as code** projekty. +> Obsah je **rozdělen do 6 specializovaných repozitářů** pro snadnou orientaci a +> samostatné použití. Toto repo slouží jako **orchestrátor + dokumentace**. --- -## 🗂 Co je v tomto repo +## 📦 Repozitáře (6) -| Adresář | Účel | Stav | +| Repo | Obsah | URL | |---|---|---| -| [`docker-services/`](docker-services/) | Generické `docker-compose.yml` pro 14+ služeb (portainer, vaultwarden, nextcloud, …) | ✅ | -| [`install-scripts/`](install-scripts/) | Bash skripty pro nové servery (Ubuntu 22.04/24.04 LTS) | ✅ | -| [`ansible/`](ansible/) | Ansible playbooks + role pro idempotentní deploy | ✅ | -| [`hermes-install/`](hermes-install/) | Instalace a konfigurace Hermes Agent (mě) na macOS | ✅ | -| [`macos-setup/`](macos-setup/) | Homebrew `Brewfile` + skripty pro macOS workstation | ✅ | -| [`home-nas-tools/`](home-nas-tools/) | Rejstřík projektů a nástrojů z NAS (`/Volumes/Backups/Prace/`) | ✅ | -| [`docs/`](docs/) | Architektura, bezpečnost, contributing | ✅ | +| [`mates-docker-services`](https://github.com/mates/mates-docker-services) | 14 generických `docker-compose.yml` (portainer, npm, vaultwarden, gitea, jotty, nextcloud, …) | http://192.168.0.148:3000/mates/mates-docker-services | +| [`mates-ansible`](https://github.com/mates/mates-ansible) | 4 Ansible playbooky (bootstrap, deploy, update, security) | http://192.168.0.148:3000/mates/mates-ansible | +| [`mates-install-scripts`](https://github.com/mates/mates-install-scripts) | Bash skripty pro nový Ubuntu server (bootstrap, docker, portainer, npm, backup, restore) | http://192.168.0.148:3000/mates/mates-install-scripts | +| [`mates-macos-setup`](https://github.com/mates/mates-macos-setup) | macOS workstation (Brewfile, Fish aliasy, osx defaults, Hermes CLI) | http://192.168.0.148:3000/mates/mates-macos-setup | +| [`mates-home-nas-tools`](https://github.com/mates/mates-home-nas-tools) | Rejstřík projektů na NAS (metadata only, žádné binárky) | http://192.168.0.148:3000/mates/mates-home-nas-tools | +| [`mates-docs`](https://github.com/mates/mates-docs) | Architektura, bezpečnost, contributing | http://192.168.0.148:3000/mates/mates-docs | + +> **Proč 6 repo?** Každý má **jiný scope**, **jiný lifecycle**, **jiné uživatele**. +> Např. `mates-install-scripts` se mění zřídka, `mates-docker-services` často. ## 🏗 Aktuální infrastruktura ``` -┌─────────────────────────────────────────────────────────────────────┐ -│ Internet (Cloudflare Tunnel) │ -└────────────────────┬────────────────────────────────────────────────┘ - │ HTTPS (443) - ▼ -┌─────────────────────────────────────────────────────────────────────┐ -│ Nginx Proxy Manager (192.168.0.148:81, 443) │ -│ ├─ DNS: domácí subdomény → LAN IP │ -│ └─ Let's Encrypt auto-renew │ -└────────────────────┬────────────────────────────────────────────────┘ +┌─────────────────────────────────────────────────────────────┐ +│ Nginx Proxy Manager (reverzní proxy + HTTPS) │ +└────────────────────┬────────────────────────────────────────┘ │ ┌─────────────────┼─────────────────┬──────────────┐ ▼ ▼ ▼ ▼ -┌──────────┐ ┌──────────┐ ┌──────────┐ ┌────────────┐ -│ Nextcloud│ │Vaultwarden│ │ Gitea │ │ Jotty (doc)│ -│ AIO │ │ :2999 │ │ :3000/222 │ │ :1122 │ -│ :11000 │ └──────────┘ └──────────┘ └────────────┘ -└──────────┘ - … dalších 11 služeb (Plex, RustDesk, Calibre, Audiobookshelf, Wikijs, …) +┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ +│ Nextcloud│ │Vaultwarden│ │ Gitea │ │ Jotty │ +│ AIO │ │ :2999 │ │ :3000/222│ │ :1122 │ +└──────────┘ └──────────┘ └──────────┘ └──────────┘ + … dalších 11 služeb (Plex, RustDesk, Audiobookshelf, …) ``` -Detailní seznam: [`docker-services/README.md`](docker-services/README.md) +Detailní seznam: [`mates-docker-services/README.md`](https://github.com/mates/mates-docker-services) ## 🚀 Rychlý start (nový server) ```bash -# 1. Klonuj tento repo -git clone https://github.com//mates-infra.git ~/infra -cd ~/infra +# 1. Klonuj všechna relevantní repo +git clone http://192.168.0.148:3000/mates/mates-install-scripts.git +git clone http://192.168.0.148:3000/mates/mates-docker-services.git -# 2. Spusť bootstrap (Ubuntu 22.04/24.04 LTS) -sudo bash install-scripts/bootstrap-ubuntu-server.sh +# 2. Bootstrap +cd mates-install-scripts +sudo bash bootstrap-ubuntu-server.sh +sudo bash install-docker.sh -# 3. Nainstaluj všechny služby -sudo bash install-scripts/install-docker.sh -sudo bash install-scripts/install-portainer.sh -# … další viz install-scripts/ +# 3. Nasaď služby +cd ../mates-docker-services +cp portainer/.env.example portainer/.env # a další služby +docker compose -f portainer/docker-compose.yml up -d +# ... atd. -# 4. Nebo použij Ansible -cd ansible +# 4. (Volitelně) Ansible +git clone http://192.168.0.148:3000/mates/mates-ansible.git +cd mates-ansible ansible-playbook -i inventory.example.yml playbooks/deploy-services.yml ``` ## 📚 Dokumentace -- 🏛 [Architektura](docs/architecture.md) – jak to celé funguje -- 🔐 [Bezpečnost](docs/security.md) – hardening, secrets, HTTPS -- 🤝 [Contributing](docs/contributing.md) – jak přispívat -- 📝 [Jotty dokumentace](http://192.168.0.148:1122) – knowledge base v Jotty +- 🏛 [Architektura](https://github.com/mates/mates-docs) – jak to celé funguje +- 🔐 [Bezpečnost](https://github.com/mates/mates-docs) – hardening, secrets +- 🤝 [Contributing](https://github.com/mates/mates-docs) – jak přispívat +- 📝 [Jotty knowledge base](http://192.168.0.148:1122) – interní dokumentace + +## 🗂 Mapa závislostí + +``` +mates-infra (toto repo – index) + ├──→ mates-docs (architektura, bezpečnost) + ├──→ mates-docker-services (služby) + ├──→ mates-install-scripts (nový server) + ├──→ mates-ansible (idempotentní deploy) + ├──→ mates-macos-setup (workstation) + └──→ mates-home-nas-tools (metadata k NAS) +``` ## 🔒 Bezpečnost -- **Všechna hesla v `.env.example`** – nikdy necommituj `.env` -- **HTTPS** – Let's Encrypt přes NPM -- **Firewall** – UFW + fail2ban -- **Bezpečnostní audit**: viz [`docs/security.md`](docs/security.md) +- Všechna hesla v `.env.example` (šablona), nikdy v `docker-compose.yml` +- API token Gitea uložen v **macOS keychainu** (`gitea:api:192.168.0.148`) +- SSH klíče pro git push přes `credential.helper` +- HTTPS terminuje Nginx Proxy Manager (Let's Encrypt) +- Detailní security hardening: [`mates-docs/security.md`](https://github.com/mates/mates-docs) ## 📜 Licence @@ -85,4 +95,4 @@ ansible-playbook -i inventory.example.yml playbooks/deploy-services.yml --- -**Vyrobeno s ❤️ v homelabu · 2026** +**Home lab · 2026 · Poslední update:** 2026-08-01 diff --git a/ansible/README.md b/ansible/README.md deleted file mode 100644 index b0f865f..0000000 --- a/ansible/README.md +++ /dev/null @@ -1,88 +0,0 @@ -# 🎭 Ansible Playbooks - -> Ansible role a playbooks pro nasazení a správu home infrastruktury. -> Idempotentní, testovatelné, čitelné. - -## 📁 Struktura - -``` -ansible/ -├── README.md # Tento soubor -├── ansible.cfg # Konfigurace -├── requirements.yml # Ansible Galaxy role -├── inventory.example.yml # Ukázkový inventory -├── playbooks/ -│ ├── bootstrap-server.yml # Úvodní setup nového serveru -│ ├── deploy-services.yml # Nasaď všechny Docker služby -│ ├── update-services.yml # Update všech služeb -│ └── security-hardening.yml # Bezpečnostní hardening -├── roles/ -│ ├── common/ # Společné úkoly (update, packages, users) -│ ├── docker/ # Docker + compose -│ ├── portainer/ # Portainer compose -│ ├── nginx-proxy/ # Nginx Proxy Manager -│ ├── vaultwarden/ # Vaultwarden -│ ├── gitea/ # Gitea -│ └── ... -└── group_vars/ - └── all.yml.example # Společné proměnné -``` - -## 🚀 Quickstart - -```bash -# 1. Příprava -pip install ansible -ansible-galaxy install -r requirements.yml - -# 2. Inventory -cp inventory.example.yml inventory.yml -nano inventory.yml # nastavit IP a SSH user - -# 3. Test připojení -ansible all -m ping - -# 4. Bootstrap -ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml - -# 5. Nasaď služby -ansible-playbook -i inventory.yml playbooks/deploy-services.yml --extra-vars "services=[portainer,vaultwarden,gitea]" - -# 6. Update -ansible-playbook -i inventory.yml playbooks/update-services.yml -``` - -## 🎯 Playbooky - -### `bootstrap-server.yml` -- Update OS -- Setup deploy user (UID 1000) -- SSH hardening -- UFW firewall -- fail2ban -- Základní utility - -### `deploy-services.yml` -- Nasaď vybrané Docker služby -- Idempotentní – můžeš spustit víckrát - -### `update-services.yml` -- `docker compose pull && up -d` pro všechny služby -- Watchtower notifikace - -### `security-hardening.yml` -- Sysctl hardening -- AppArmor profily -- Auditd pravidla -- Automatické security updaty - -## 🔐 Bezpečnost - -- **Bez hesel v inventory** – použij `ansible-vault` nebo SSH klíče -- **Privilege escalation** – `become: true` jen kde potřeba -- **Idempotence** – každý task kontroluje stav - -## 📚 Dokumentace - -- [Ansible docs](https://docs.ansible.com/) -- [Best practices](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg deleted file mode 100644 index be1bfff..0000000 --- a/ansible/ansible.cfg +++ /dev/null @@ -1,21 +0,0 @@ -[defaults] -inventory = inventory.yml -roles_path = roles -host_key_checking = False -retry_files_enabled = False -stdout_callback = yaml -forks = 10 -gathering = smart -fact_caching = jsonfile -fact_caching_connection = local -fact_caching_timeout = 86400 - -[privilege_escalation] -become = True -become_method = sudo -become_ask_pass = False - -[ssh_connection] -pipelining = True -ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ServerAliveInterval=30 -control_path = /tmp/ansible-ssh-%%h-%%p-%%r diff --git a/ansible/group_vars/all.yml.example b/ansible/group_vars/all.yml.example deleted file mode 100644 index 7d7c7f8..0000000 --- a/ansible/group_vars/all.yml.example +++ /dev/null @@ -1,35 +0,0 @@ ---- -# Společné proměnné pro všechny playbooks -# Zkopíruj na group_vars/all.yml a doplň - -# Docker -docker_user: deploy -docker_uid: 1000 -docker_gid: 1000 -docker_install_compose_plugin: true - -# Služby k nasazení (seznam názvů adresářů v docker-services/) -services_to_deploy: - - portainer - - nginx-proxy-manager - - vaultwarden - - gitea - - jotty - - nextcloud-aio - - rustdesk - - audiobookshelf - - calibre-web - - plex - - erugo - - jswiki - - speedtest - - watchtower - -# NPM admin (po prvním loginu změnit) -npm_default_email: admin@example.com -npm_default_password: changeme - -# Gitea admin (po instalaci) -gitea_admin_user: admin -gitea_admin_password: changeme -gitea_admin_email: admin@example.com diff --git a/ansible/inventory.example.yml b/ansible/inventory.example.yml deleted file mode 100644 index d059063..0000000 --- a/ansible/inventory.example.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -# Ukázkový inventory – zkopíruj na inventory.yml a uprav -all: - vars: - # SSH uživatel (deploy user, UID 1000) - ansible_user: deploy - # Python na cílovém systému - ansible_python_interpreter: /usr/bin/python3 - # Timezone - timezone: Europe/Prague - - children: - # Skupina pro všechny home servery - homeservers: - hosts: - homeserver-01: - ansible_host: 192.168.0.148 - # homeserver-02: - # ansible_host: 192.168.0.149 - - # Skupina pro produkční servery - production: - hosts: - homeserver-01: - ansible_host: 192.168.0.148 - - # Skupina pro test - staging: [] diff --git a/ansible/playbooks/bootstrap-server.yml b/ansible/playbooks/bootstrap-server.yml deleted file mode 100644 index d8b775f..0000000 --- a/ansible/playbooks/bootstrap-server.yml +++ /dev/null @@ -1,145 +0,0 @@ ---- -# Bootstrap nového Ubuntu serveru -# - aktualizace systému -# - deploy user (UID 1000) -# - SSH hardening -# - UFW firewall -# - fail2ban -# - Docker -# -# Použití: -# ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml -# -- name: Bootstrap home server - hosts: homeservers - become: true - gather_facts: true - - vars: - deploy_user: deploy - deploy_uid: 1000 - ssh_port: 22 - deploy_ssh_key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}" - - tasks: - - name: Update apt cache - ansible.builtin.apt: - update_cache: true - cache_valid_time: 3600 - - - name: Upgrade all packages - ansible.builtin.apt: - upgrade: dist - update_cache: true - - - name: Install base packages - ansible.builtin.apt: - name: - - curl - - wget - - git - - vim - - htop - - ca-certificates - - gnupg - - ufw - - fail2ban - - bash-completion - state: present - - - name: Set timezone - community.general.timezone: - name: "{{ timezone }}" - - - name: Create deploy user - ansible.builtin.user: - name: "{{ deploy_user }}" - uid: "{{ deploy_uid }}" - shell: /bin/bash - create_home: true - password: "" - - - name: Setup authorized_keys for deploy user - ansible.posix.authorized_key: - user: "{{ deploy_user }}" - state: present - key: "{{ deploy_ssh_key }}" - - - name: Allow deploy user sudo without password - ansible.builtin.copy: - dest: "/etc/sudoers.d/{{ deploy_user }}" - content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n" - mode: "0440" - - - name: SSH hardening - ansible.builtin.lineinfile: - path: /etc/ssh/sshd_config - regexp: "^#?{{ item.key }}" - line: "{{ item.key }} {{ item.value }}" - state: present - loop: - - { key: "Port", value: "{{ ssh_port }}" } - - { key: "PermitRootLogin", value: "no" } - - { key: "PasswordAuthentication", value: "no" } - - { key: "X11Forwarding", value: "no" } - - { key: "ClientAliveInterval", value: "300" } - - { key: "ClientAliveCountMax", value: "2" } - notify: Restart ssh - - - name: Configure UFW defaults - community.general.ufw: - direction: incoming - policy: deny - notify: Reload ufw - - - name: Allow SSH through UFW - community.general.ufw: - rule: allow - port: "{{ ssh_port }}" - proto: tcp - - - name: Allow HTTP and HTTPS through UFW - community.general.ufw: - rule: allow - port: "{{ item }}" - proto: tcp - loop: - - "80" - - "443" - - - name: Enable UFW - community.general.ufw: - state: enabled - - - name: Configure fail2ban - ansible.builtin.copy: - dest: /etc/fail2ban/jail.local - content: | - [DEFAULT] - bantime = 1h - findtime = 10m - maxretry = 5 - - [sshd] - enabled = true - port = {{ ssh_port }} - filter = sshd - logpath = /var/log/auth.log - maxretry = 3 - mode: "0644" - notify: Restart fail2ban - - handlers: - - name: Restart ssh - ansible.builtin.service: - name: sshd - state: restarted - - - name: Reload ufw - community.general.ufw: - state: reloaded - - - name: Restart fail2ban - ansible.builtin.service: - name: fail2ban - state: restarted diff --git a/ansible/playbooks/deploy-services.yml b/ansible/playbooks/deploy-services.yml deleted file mode 100644 index 6898753..0000000 --- a/ansible/playbooks/deploy-services.yml +++ /dev/null @@ -1,42 +0,0 @@ ---- -# Nasaď Docker služby z docker-services/ adresáře -# -# Použití: -# ansible-playbook -i inventory.yml playbooks/deploy-services.yml -# ansible-playbook -i inventory.yml playbooks/deploy-services.yml --extra-vars "services=[portainer,vaultwarden]" -# -- name: Deploy Docker services - hosts: homeservers - become: true - gather_facts: true - - vars: - services_repo: https://github.com//mates-infra.git - services_path: "/home/{{ docker_user }}/docker-services" - services: "{{ services_to_deploy | default(['portainer', 'vaultwarden', 'gitea']) }}" - - tasks: - - name: Clone services repo - ansible.builtin.git: - repo: "{{ services_repo }}" - dest: "{{ services_path }}" - force: false - update: true - become_user: "{{ docker_user }}" - - - name: Create .env from example - ansible.builtin.copy: - src: "{{ services_path }}/{{ item }}/.env.example" - dest: "{{ services_path }}/{{ item }}/.env" - remote_src: true - force: false - loop: "{{ services }}" - become_user: "{{ docker_user }}" - - - name: Deploy services - community.docker.docker_compose_v2: - project_src: "{{ services_path }}/{{ item }}" - state: present - pull: missing - loop: "{{ services }}" - become_user: "{{ docker_user }}" diff --git a/ansible/playbooks/security-hardening.yml b/ansible/playbooks/security-hardening.yml deleted file mode 100644 index db5bd86..0000000 --- a/ansible/playbooks/security-hardening.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- -# Security hardening – sysctl, AppArmor, auditd, auto-updates -# -# Použití: -# ansible-playbook -i inventory.yml playbooks/security-hardening.yml -# -- name: Security hardening - hosts: homeservers - become: true - - tasks: - - name: Kernel hardening via sysctl - ansible.posix.sysctl: - name: "{{ item.key }}" - value: "{{ item.value }}" - state: present - reload: true - loop: - - { key: "net.ipv4.conf.all.rp_filter", value: "1" } - - { key: "net.ipv4.conf.default.rp_filter", value: "1" } - - { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" } - - { key: "net.ipv4.conf.all.accept_redirects", value: "0" } - - { key: "net.ipv4.conf.default.accept_redirects", value: "0" } - - { key: "net.ipv6.conf.all.accept_redirects", value: "0" } - - { key: "net.ipv4.conf.all.send_redirects", value: "0" } - - { key: "net.ipv4.conf.all.accept_source_route", value: "0" } - - { key: "net.ipv4.conf.default.accept_source_route", value: "0" } - - { key: "net.ipv4.tcp_syncookies", value: "1" } - - { key: "net.ipv4.conf.all.log_martians", value: "1" } - - - name: Install unattended-upgrades - ansible.builtin.apt: - name: - - unattended-upgrades - - apt-listchanges - state: present - - - name: Enable automatic security updates - ansible.builtin.copy: - dest: /etc/apt/apt.conf.d/20auto-upgrades - content: | - APT::Periodic::Update-Package-Lists "1"; - APT::Periodic::Unattended-Upgrade "1"; - APT::Periodic::AutocleanInterval "7"; - mode: "0644" - - - name: Install auditd - ansible.builtin.apt: - name: - - auditd - - audispd-plugins - state: present - - - name: Enable auditd - ansible.builtin.service: - name: auditd - state: started - enabled: true diff --git a/ansible/playbooks/update-services.yml b/ansible/playbooks/update-services.yml deleted file mode 100644 index dfd3248..0000000 --- a/ansible/playbooks/update-services.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# Update všech Docker služeb (docker compose pull + up -d) -# -# Použití: -# ansible-playbook -i inventory.yml playbooks/update-services.yml -# -- name: Update Docker services - hosts: homeservers - become: true - - vars: - services_path: "/home/{{ docker_user }}/docker-services" - services: "{{ services_to_deploy | default([]) }}" - - tasks: - - name: Pull and restart services - community.docker.docker_compose_v2: - project_src: "{{ services_path }}/{{ item }}" - state: present - pull: always - loop: "{{ services }}" - become_user: "{{ docker_user }}" diff --git a/docker-services/README.md b/docker-services/README.md deleted file mode 100644 index 1fb2346..0000000 --- a/docker-services/README.md +++ /dev/null @@ -1,98 +0,0 @@ -# 📦 Docker Services - -> Generické `docker-compose.yml` šablony pro self-hosted služby. -> Každá služba má **vlastní složku**, `.env.example` (šablona) a **README** s dokumentací. - -## 🎯 Jak použít - -```bash -# 1. Vyber službu -cd services/ - -# 2. Vytvoř .env z šablony -cp .env.example .env -nano .env # nastav POUZE potřebné hodnoty (hesla, cesty) - -# 3. Nasaď -docker compose up -d - -# 4. Ověř -docker compose ps -docker compose logs -f -``` - -## 📚 Rejstřík služeb - -| Služba | Účel | Port | Image | -|---|---|---|---| -| [`portainer`](portainer/) | Docker UI management | `9000`, `9443` | `portainer/portainer-ce` | -| [`nginx-proxy-manager`](nginx-proxy-manager/) | Reverse proxy + HTTPS | `80`, `443`, `81` | `jc21/nginx-proxy-manager` | -| [`vaultwarden`](vaultwarden/) | Správce hesel | `2999` | `vaultwarden/server` | -| [`nextcloud-aio`](nextcloud-aio/) | Cloud (soubory, kalendář) | `11000` | `nextcloud/all-in-one` | -| [`gitea`](gitea/) | Git server | `3000`, `222` | `gitea/gitea` | -| [`jotty`](jotty/) | Poznámky & checklisty | `1122` | `mrx23dotcom/jotty` | -| [`rustdesk`](rustdesk/) | Remote desktop | `21115-21119` | `rustdesk/rustdesk-server` | -| [`audiobookshelf`](audiobookshelf/) | Audio knihovna | `13378` | `advplyr/audiobookshelf` | -| [`calibre-web`](calibre-web/) | E-knihovna | `8083` | `linuxserver/calibre-web` | -| [`plex`](plex/) | Media server | `32400` | `linuxserver/plex` | -| [`erugo`](erugo/) | File sharing | `61080` | `wardy784/erugo` | -| [`jswiki`](jswiki/) | Wiki | `9180` | `linuxserver/wikijs` | -| [`speedtest`](speedtest/) | Speedtest tracker | `8072` | `linuxserver/speedtest-tracker` | -| [`watchtower`](watchtower/) | Auto-update kontejnerů | – | `containrrr/watchtower` | - -## 🧱 Společné konvence - -Všechny compose soubory v tomto adresáři dodržují: - -- **Porty:** nikdy nepoužívat konfliktní porty s ostatními službami -- **Volume:** `./data:/data` (host container, snadná záloha) -- **Restart:** `unless-stopped` -- **Network:** výchozí `bridge`, případně vlastní `*-net` -- **User:** `1000:1000` pro souborový přístup -- **Logging:** `json-file` driver, max 10 MB × 3 soubory -- **TZ:** `Europe/Prague` -- **Environment:** `.env` soubor (šablona `.env.example` v gitu) - -## 🛡 Bezpečnost - -- ✅ **Žádná hesla v `docker-compose.yml`** – vše v `.env` (gitignored) -- ✅ **Restart policy** zamezí nechtěnému spuštění po rebootu -- ✅ **Networks** – izolované `bridge` pro každou službu -- ✅ **Read-only filesystémy** kde to jde (`/etc/timezone`, `/etc/localtime`) - -## 🗂 Struktura - -``` -docker-services/ -├── README.md # Tento soubor -├── portainer/ -│ ├── docker-compose.yml -│ ├── .env.example -│ └── README.md -├── nginx-proxy-manager/ -│ ├── docker-compose.yml -│ ├── .env.example -│ └── README.md -└── ... (další služby) -``` - -## 🔄 Aktualizace služeb - -```bash -# Pomocí Watchtower (auto-update) -docker compose pull && docker compose up -d - -# Nebo ručně -cd services/ -docker compose pull -docker compose up -d -``` - -## 📦 Zálohování - -Všechna data jsou v `./data/` uvnitř každé služby. Zálohuj celé adresáře: - -```bash -# Pomocí našeho nástroje z install-scripts/ -sudo bash install-scripts/backup-all.sh -``` diff --git a/docker-services/audiobookshelf/.env.example b/docker-services/audiobookshelf/.env.example deleted file mode 100644 index 20e30f0..0000000 --- a/docker-services/audiobookshelf/.env.example +++ /dev/null @@ -1,4 +0,0 @@ -# Audiobookshelf – proměnné -TZ=Europe/Prague -PUID=1000 -PGID=1000 diff --git a/docker-services/audiobookshelf/README.md b/docker-services/audiobookshelf/README.md deleted file mode 100644 index 96bcaa9..0000000 --- a/docker-services/audiobookshelf/README.md +++ /dev/null @@ -1,57 +0,0 @@ -# Audiobookshelf – audio knihovna - -> Self-hosted audio knihovna. Stream audioknih, podcastů. Sledování pokroku. - -## 📋 Přehled - -- **Image:** `advplyr/audiobookshelf:latest` -- **Port:** `13378` (web) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -docker compose up -d -``` - -## 🌐 Přístup - -- **Web:** `http://:13378` -- **Mobile app:** vyhledej "Audiobookshelf" v App Store/Google Play - -## 🎯 Funkce - -- **Audioknihy** – upload (mp3, m4b, m4a, flac, …) -- **Podcasty** – RSS subscribe -- **Progress tracking** – synchronizace mezi zařízeními -- **Multi-user** – každý má svou knihovnu -- **Transkripce** – vyhledávání v textu (s AI) -- **OPDS** – kompatibilní s jinými čtečkami - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/data` | Databáze, config, cache | -| `./audiobooks:/audiobooks` | Tvoje knihovna (readonly) | -| `./podcasts:/podcasts` | Auto-download podcasty | - -## 🔐 Bezpečnost - -- **2FA** – pro admin účet -- **HTTPS** – terminuj v NPM -- **Auth proxy** – integrovaný (OIDC) - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Dokumentace - -- [Audiobookshelf](https://www.audiobookshelf.org/) -- [GitHub](https://github.com/advplyr/audiobookshelf) diff --git a/docker-services/audiobookshelf/docker-compose.yml b/docker-services/audiobookshelf/docker-compose.yml deleted file mode 100644 index 094e83b..0000000 --- a/docker-services/audiobookshelf/docker-compose.yml +++ /dev/null @@ -1,29 +0,0 @@ -# Audiobookshelf – audio knihovna - -services: - audiobookshelf: - image: advplyr/audiobookshelf:latest - container_name: audiobookshelf - restart: unless-stopped - ports: - - "13378:80" - volumes: - - ./data:/data - - ./audiobooks:/audiobooks - - ./podcasts:/podcasts - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - networks: - - audiobookshelf_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - audiobookshelf_net: - name: audiobookshelf_default - driver: bridge diff --git a/docker-services/calibre-web/.env.example b/docker-services/calibre-web/.env.example deleted file mode 100644 index ab90ab6..0000000 --- a/docker-services/calibre-web/.env.example +++ /dev/null @@ -1,4 +0,0 @@ -# Calibre-Web – proměnné -TZ=Europe/Prague -PUID=1000 -PGID=1000 diff --git a/docker-services/calibre-web/README.md b/docker-services/calibre-web/README.md deleted file mode 100644 index 9c61b4d..0000000 --- a/docker-services/calibre-web/README.md +++ /dev/null @@ -1,53 +0,0 @@ -# Calibre-Web – e-knihovna - -> Web čtečka e-knihoven. Calibre metadata, OPDS, Kindle send. - -## 📋 Přehled - -- **Image:** `linuxserver/calibre-web:latest` -- **Port:** `8083` (web) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -docker compose up -d -``` - -Pak v prohlížeči otevři `http://:8083` a dokonči setup (admin účet, cesta ke knihovně). - -## 🎯 Funkce - -- **Čtení online** – v prohlížeči, EPUB/PDF -- **Send to Kindle** – email na Kindle -- **OPDS** – kompatibilní s jinými čtečkami -- **Multi-user** – s admin/user oprávněními -- **Metadata** – z Goodreads, Google Books -- **Tagy, série, autoři** – plná Calibre metadata - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/config` | Calibre-Web konfigurace, DB | -| `./books:/books` | Tvoje knihovna (knihy) | - -## 🔐 Bezpečnost - -- **Admin heslo** – silné -- **HTTPS** – terminuj v NPM -- **Magic link** – email login (vyžaduje SMTP) - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Dokumentace - -- [Calibre-Web GitHub](https://github.com/janeczku/calibre-web) -- [LinuxServer.io](https://docs.linuxserver.io/images/docker-calibre-web) diff --git a/docker-services/calibre-web/docker-compose.yml b/docker-services/calibre-web/docker-compose.yml deleted file mode 100644 index 5107dfb..0000000 --- a/docker-services/calibre-web/docker-compose.yml +++ /dev/null @@ -1,30 +0,0 @@ -# Calibre-Web – e-knihovna - -services: - calibre-web: - image: lscr.io/linuxserver/calibre-web:latest - container_name: calibre-web - restart: unless-stopped - ports: - - "8083:8083" - volumes: - - ./data:/config - - ./books:/books - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - DOCKER_MODS=linuxserver/mods:universal-calibre - - OAUTHLIB_RELAX_TOKEN_SCOPE=1 - networks: - - calibre-web_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - calibre-web_net: - name: calibre-web_default - driver: bridge diff --git a/docker-services/erugo/.env.example b/docker-services/erugo/.env.example deleted file mode 100644 index 28cc246..0000000 --- a/docker-services/erugo/.env.example +++ /dev/null @@ -1,4 +0,0 @@ -# Erugo – proměnné -TZ=Europe/Prague -PUID=1000 -PGID=1000 diff --git a/docker-services/erugo/README.md b/docker-services/erugo/README.md deleted file mode 100644 index f22a05f..0000000 --- a/docker-services/erugo/README.md +++ /dev/null @@ -1,43 +0,0 @@ -# Erugo – file sharing - -> Jednoduché sdílení souborů s heslem a expirací. - -## 📋 Přehled - -- **Image:** `wardy784/erugo:latest` -- **Port:** `61080` (web) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -docker compose up -d -``` - -## 🌐 Přístup - -- **Web:** `http://:61080` - -## 🎯 Funkce - -- **Upload** – drag & drop souborů -- **Heslo** – volitelné pro každý upload -- **Expirace** – automatické mazání po X dnech -- **Linky** – sdílitelné -- **API** – pro integraci - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/uploads` | Uložené soubory | -| `./db:/db` | SQLite databáze | - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` diff --git a/docker-services/erugo/docker-compose.yml b/docker-services/erugo/docker-compose.yml deleted file mode 100644 index de351d0..0000000 --- a/docker-services/erugo/docker-compose.yml +++ /dev/null @@ -1,28 +0,0 @@ -# Erugo – file sharing - -services: - erugo: - image: wardy784/erugo:latest - container_name: erugo - restart: unless-stopped - ports: - - "61080:80" - volumes: - - ./data:/uploads - - ./db:/db - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - networks: - - erugo_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - erugo_net: - name: erugo_default - driver: bridge diff --git a/docker-services/gitea/.env.example b/docker-services/gitea/.env.example deleted file mode 100644 index 7e05c15..0000000 --- a/docker-services/gitea/.env.example +++ /dev/null @@ -1,11 +0,0 @@ -# Gitea – proměnné prostředí -USER_UID=1000 -USER_GID=1000 -TZ=Europe/Prague - -# Po prvním adminovi nastav na false -GITEA__service__DISABLE_REGISTRATION=false -GITEA__service__REQUIRE_SIGNIN_VIEW=false - -# HTTPS terminuje NPM, takže false -GITEA__session__COOKIE_SECURE=false diff --git a/docker-services/gitea/README.md b/docker-services/gitea/README.md deleted file mode 100644 index e4ac383..0000000 --- a/docker-services/gitea/README.md +++ /dev/null @@ -1,70 +0,0 @@ -# Gitea – self-hosted Git - -> Lehký Git server (alternativa k GitLabu). Web UI, API, SSH. - -## 📋 Přehled - -- **Image:** `docker.gitea.com/gitea:1.27.1` -- **Porty:** `3000` (web), `222` (SSH) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env - -docker compose up -d -``` - -Po startu otevři `http://:3000/` a dokonči install wizard: - -1. **Database:** SQLite3 (default) -2. **Site Title:** libovolný -3. **Admin Username:** `admin` (nebo `mates`) -4. **Admin Password:** silné heslo -5. **Admin Email:** tvůj email -6. Ostatní default -7. **Install Gitea** - -## 🌐 Přístup - -- **Web:** `http://:3000` (za HTTPS terminuj v NPM) -- **SSH git push:** `ssh://git@:222//.git` -- **API:** `http://:3000/api/v1/` - -## 🔐 Bezpečnost - -- **Změň admin heslo** hned po instalaci -- **DISABLE_REGISTRATION=false** – po registraci prvního admina vypni -- **HTTPS** – terminuj v NPM a přesměruj HTTP→HTTPS -- **2FA** – aktivuj pro admin účet - -## 🔑 API Token - -Vytvoření tokenu pro skripty: - -1. User Settings → Applications -2. Název: `` -3. Scopes: `read:user`, `write:user`, `read:repository`, `write:repository` -4. **Token ulož do keychainu**, ne do chatu - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -# DB migrace probíhá automaticky -``` - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./gitea:/data` | Repozitáře, DB, konfigurace, hooks | - -## 📚 Dokumentace - -- [Gitea Docker install](https://docs.gitea.com/installation/install-with-docker/) -- [Gitea API](https://docs.gitea.com/api/) diff --git a/docker-services/gitea/docker-compose.yml b/docker-services/gitea/docker-compose.yml deleted file mode 100644 index a206c70..0000000 --- a/docker-services/gitea/docker-compose.yml +++ /dev/null @@ -1,39 +0,0 @@ -# Gitea – self-hosted Git server - -services: - server: - image: docker.gitea.com/gitea:1.27.1 - container_name: gitea - environment: - - USER_UID=1000 - - USER_GID=1000 - - GITEA__webhook__SKIP_TLS_VERIFY=false - - GITEA__service__DISABLE_REGISTRATION=false - - GITEA__service__REQUIRE_SIGNIN_VIEW=false - - GITEA__session__COOKIE_SECURE=false - restart: unless-stopped - networks: - - gitea_net - volumes: - - ./gitea:/data - - /etc/timezone:/etc/timezone:ro - - /etc/localtime:/etc/localtime:ro - ports: - - "3000:3000" - - "222:22" - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 30s - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - gitea_net: - name: gitea_default - driver: bridge diff --git a/docker-services/jotty/.env.example b/docker-services/jotty/.env.example deleted file mode 100644 index 64d29ea..0000000 --- a/docker-services/jotty/.env.example +++ /dev/null @@ -1,4 +0,0 @@ -# Jotty – proměnné prostředí -TZ=Europe/Prague -PUID=1000 -PGID=1000 diff --git a/docker-services/jotty/README.md b/docker-services/jotty/README.md deleted file mode 100644 index 28fabb2..0000000 --- a/docker-services/jotty/README.md +++ /dev/null @@ -1,59 +0,0 @@ -# Jotty – poznámky a checklisty - -> Self-hosted alternativa k Obsidian. Markdown poznámky, checklisty, kategorie. - -## 📋 Přehled - -- **Image:** `mrx23dotcom/jotty:latest` -- **Port:** `1122` (web) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env - -docker compose up -d -``` - -## 🌐 Přístup - -- **Web:** `http://:1122` (za HTTPS terminuj v NPM) -- **První registrace:** Setup wizard na hlavní stránce - -## 🎯 Použití - -- **Poznámky** – markdown, interní linky `@note-id`, tagy `#tag` -- **Checklisty** – task management -- **Kategorie** – organizace -- **TipTap editor** – WYSIWYG nebo markdown -- **API** – REST API s API klíčem pro integraci - -## 🔐 Bezpečnost - -- **API klíč** – generuj v Admin → API -- **2FA** – pro admin účet -- **HTTPS** – terminuj v NPM -- **Registry** – vypni po registraci - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -# Data zůstávají v ./data/notes/ -``` - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/app/data` | Poznámky, checklisty, databáze | -| `./config:/app/config` | Konfigurace, themes, custom emojis | - -## 📚 Dokumentace - -- [Jotty GitHub](https://github.com/mrx23dotcom/jotty) -- [Jotty API](https://github.com/mrx23dotcom/jotty/blob/main/howto/API.md) diff --git a/docker-services/jotty/docker-compose.yml b/docker-services/jotty/docker-compose.yml deleted file mode 100644 index d6ad12c..0000000 --- a/docker-services/jotty/docker-compose.yml +++ /dev/null @@ -1,35 +0,0 @@ -# Jotty – poznámky a checklisty - -services: - jotty: - image: mrx23dotcom/jotty:latest - container_name: jotty - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - restart: unless-stopped - networks: - - jotty_net - volumes: - - ./data:/app/data - - ./config:/app/config - - ./cache:/app/.next/cache - ports: - - "1122:3000" - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 60s - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - jotty_net: - name: jotty_default - driver: bridge diff --git a/docker-services/jswiki/.env.example b/docker-services/jswiki/.env.example deleted file mode 100644 index 1a8b709..0000000 --- a/docker-services/jswiki/.env.example +++ /dev/null @@ -1,9 +0,0 @@ -# Wiki.js – proměnné -TZ=Europe/Prague -PUID=1000 -PGID=1000 - -# MariaDB hesla (ZMĚŇ!) -MYSQL_ROOT_PASSWORD=change-me-strong -MYSQL_PASSWORD=change-me-strong -WIKIJS_DB_PASS=change-me-strong diff --git a/docker-services/jswiki/README.md b/docker-services/jswiki/README.md deleted file mode 100644 index ec7e74d..0000000 --- a/docker-services/jswiki/README.md +++ /dev/null @@ -1,54 +0,0 @@ -# Wiki.js – wiki - -> Nejvýkonnější open-source wiki. Markdown, WYSIWYG, DB, fulltext. - -## 📋 Přehled - -- **Image:** `linuxserver/wikijs:latest` -- **Port:** `9180` (web) -- **User:** `1000:1000` -- **DB:** PostgreSQL/SQLite (zde SQLite pro jednoduchost) -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -docker compose up -d -``` - -Pak `http://:9180` – setup wizard. - -## 🎯 Funkce - -- **Editor** – WYSIWYG (TinyMCE), Markdown, AsciiDoc -- **Verzování** – každá stránka má historii -- **Permissions** – skupiny, ACL -- **Search** – fulltext -- **Multi-language** -- **GraphQL API** – pro integrace - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/config` | Wiki.js data, DB, config | -| `./db:/db` | SQLite databáze | - -## 🔐 Bezpečnost - -- **Local auth** – nebo LDAP/OAuth -- **HTTPS** – terminuj v NPM -- **Rate limiting** – default zapnutý - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Dokumentace - -- [Wiki.js](https://wiki.js.org/) -- [GitHub](https://github.com/requarks/wiki) diff --git a/docker-services/jswiki/docker-compose.yml b/docker-services/jswiki/docker-compose.yml deleted file mode 100644 index 49e0279..0000000 --- a/docker-services/jswiki/docker-compose.yml +++ /dev/null @@ -1,57 +0,0 @@ -# Wiki.js - -services: - db: - image: linuxserver/mariadb:latest - container_name: jswiki_db - restart: unless-stopped - volumes: - - ./db:/config - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - MYSQL_ROOT_PASSWORD=CHANGE_ME_STRONG - - MYSQL_DATABASE=wiki - - MYSQL_USER=wiki - - MYSQL_PASSWORD=CHANGE_ME_STRONG - networks: - - jswiki_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - - wikijs: - image: lscr.io/linuxserver/wikijs:latest - container_name: wikijs - restart: unless-stopped - depends_on: - - db - ports: - - "9180:3000" - volumes: - - ./data:/config - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - WIKIJS_DB_TYPE=mariadb - - WIKIJS_DB_HOST=db - - WIKIJS_DB_PORT=3306 - - WIKIJS_DB_USER=wiki - - WIKIJS_DB_PASS=CHANGE_ME_STRONG - - WIKIJS_DB_NAME=wiki - networks: - - jswiki_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - jswiki_net: - name: jswiki_default - driver: bridge diff --git a/docker-services/nextcloud-aio/.env.example b/docker-services/nextcloud-aio/.env.example deleted file mode 100644 index 2f0f0d7..0000000 --- a/docker-services/nextcloud-aio/.env.example +++ /dev/null @@ -1,19 +0,0 @@ -# Nextcloud AIO – proměnné prostředí -TZ=Europe/Prague -PUID=1000 -PGID=1000 - -# Web port (default 11000) -APACHE_PORT=11000 - -# Data na hostu (NE containeru) -NEXTCLOUD_DATADIR=/mnt/data - -# Extra balíky (ImageMagick pro OCR, atd.) -NEXTCLOUD_ADDITIONAL_APKS=imagemagick - -# Upload limit -NEXTCLOUD_UPLOAD_LIMIT=10G - -# Důvěryhodné certifikáty (firemní CA, Cloudflare Origin) -# NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates diff --git a/docker-services/nextcloud-aio/README.md b/docker-services/nextcloud-aio/README.md deleted file mode 100644 index 0ba02bb..0000000 --- a/docker-services/nextcloud-aio/README.md +++ /dev/null @@ -1,64 +0,0 @@ -# Nextcloud AIO – vše v jednom - -> All-in-One Nextcloud: soubory, kalendář, kontakty, fotky, videohovory. - -## 📋 Přehled - -- **Image:** `nextcloud/all-in-one:latest` -- **Porty:** `11000` (admin), další interně -- **User:** `1000:1000` -- **Network:** `bridge` + `nextcloud-aio` (interní) - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env # nastavit APACHE_PORT, NEXTCLOUD_DATADIR, NEXTCLOUD_ADDITIONAL_APKS - -docker compose up -d -``` - -Pak otevři `http://:11000/` a dokonči instalaci. - -## 🌐 Přístup - -- **Admin:** `http://:11000` -- **Nextcloud:** `http://:11000` (nebo za reverse proxy) -- **Doporučení:** terminuj HTTPS přes NPM - -## 🔧 Pokročilé nastavení - -- **Cloudflare Tunnel** – pro vzdálený přístup bez veřejné IP -- **Talk (videohovory)** – v AIO default -- **Imaginary (AI)** – rozpoznávání obrázků -- **Fulltextsearch** – indexování souborů -- **Whiteboard** – collaborative kreslení -- **Borg backup** – integrované zálohování - -## 🔐 Bezpečnost - -- **HTTPS terminuj v NPM** (Let's Encrypt) -- **2FA** – povinně pro admin -- **Brute force protection** – default zapnutý -- **Trusted domains** – nastav `NEXTCLOUD_TRUSTED_DOMAINS` -- **Backup** – AIO Borg nebo externí rsync - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -# AIO auto-updates Nextcloud a všechny sub-containery -``` - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./nextcloud_aio_mastercontainer:/mnt/docker-aio-config` | AIO master data | -| `./data:/mnt/data` | Nextcloud data (files, DB) | - -## 📚 Dokumentace - -- [Nextcloud AIO](https://github.com/nextcloud/all-in-one) -- [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/) diff --git a/docker-services/nextcloud-aio/docker-compose.yml b/docker-services/nextcloud-aio/docker-compose.yml deleted file mode 100644 index 53d0afb..0000000 --- a/docker-services/nextcloud-aio/docker-compose.yml +++ /dev/null @@ -1,40 +0,0 @@ -# Nextcloud All-in-One - -services: - nextcloud-aio-mastercontainer: - image: nextcloud/all-in-one:latest - container_name: nextcloud-aio-mastercontainer - restart: unless-stopped - init: true - ports: - - "11000:8080" - volumes: - - ./nextcloud_aio_mastercontainer:/mnt/docker-aio-config - - ./data:/mnt/data - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - APACHE_PORT=11000 - - NEXTCLOUD_DATADIR=/mnt/data - - NEXTCLOUD_ADDITIONAL_APKS=imagemagick - - NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates - - NEXTCLOUD_UPLOAD_LIMIT=10G - networks: - - nextcloud_net - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:8080"] - interval: 60s - timeout: 10s - retries: 5 - start_period: 120s - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - nextcloud_net: - name: nextcloud_default - driver: bridge diff --git a/docker-services/nginx-proxy-manager/.env.example b/docker-services/nginx-proxy-manager/.env.example deleted file mode 100644 index 3e7a3a2..0000000 --- a/docker-services/nginx-proxy-manager/.env.example +++ /dev/null @@ -1,8 +0,0 @@ -# NPM – proměnné prostředí -TZ=Europe/Prague -PUID=1000 -PGID=1000 -DISABLE_IPV6=true - -# MariaDB heslo pro NPM backend (ZMĚŇ!) -MYSQL_ROOT_PASSWORD=change-me-strong-password diff --git a/docker-services/nginx-proxy-manager/README.md b/docker-services/nginx-proxy-manager/README.md deleted file mode 100644 index c5ff8c6..0000000 --- a/docker-services/nginx-proxy-manager/README.md +++ /dev/null @@ -1,62 +0,0 @@ -# Nginx Proxy Manager - -> Reverzní proxy s HTTPS (Let's Encrypt), web UI, ACL. - -## 📋 Přehled - -- **Image:** `jc21/nginx-proxy-manager:latest` -- **Porty:** `80`, `443`, `81` (admin UI) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env - -docker compose up -d -``` - -## 🌐 Přístup - -- **Admin UI:** `http://:81` (default `admin@example.com` / `changeme`) -- **Změň heslo hned po prvním přihlášení!** - -## 🔒 HTTPS - -NPM umí automaticky generovat Let's Encrypt certifikáty: - -1. **DNS A záznam** domény → server IP -2. NPM UI → Proxy Hosts → Add Proxy Host -3. Domain Names: `service.example.com` -4. Scheme: `http`, Forward: `:PORT` -5. Záložka **SSL:** Request SSL Certificate, Let's Encrypt -6. Force SSL, HTTP/2, HSTS – vše zapnout - -## 🔧 Pokročilé - -- **Cloudflare DNS-01 challenge** – pro wildcard certifikáty -- **Access Lists** – whitelist IP pro citlivé služby -- **Redirection** – 301/302 přesměrování -- **Streams** – TCP/UDP proxy (SSH, databáze) - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/data` | NPM data, certifikáty, konfigurace | -| `./letsencrypt:/etc/letsencrypt` | Let's Encrypt certifikáty | - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -# Certifikáty zůstávají v ./letsencrypt/ -``` - -## 📚 Dokumentace - -- [NPM oficiální dokumentace](https://nginxproxymanager.com/docs/) -- [Let's Encrypt s NPM](https://nginxproxymanager.com/advanced-config/#ssl-certificates) diff --git a/docker-services/nginx-proxy-manager/docker-compose.yml b/docker-services/nginx-proxy-manager/docker-compose.yml deleted file mode 100644 index a4fe380..0000000 --- a/docker-services/nginx-proxy-manager/docker-compose.yml +++ /dev/null @@ -1,57 +0,0 @@ -# Nginx Proxy Manager - -services: - nginx-proxy-manager: - image: jc21/nginx-proxy-manager:latest - container_name: nginx-proxy-manager - restart: unless-stopped - ports: - - "80:80" - - "443:443" - - "81:81" - volumes: - - ./data:/data - - ./letsencrypt:/etc/letsencrypt - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - DISABLE_IPV6=true - networks: - - npm_net - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:81"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 30s - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - - # NPM vyžaduje vlastní MariaDB backend - db: - image: jc21/mariadb-aria:latest - container_name: npm_db - restart: unless-stopped - volumes: - - ./mysql:/var/lib/mysql - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - MYSQL_ROOT_PASSWORD=CHANGE_ME - networks: - - npm_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - npm_net: - name: nginx_proxy_manager_default - driver: bridge diff --git a/docker-services/plex/.env.example b/docker-services/plex/.env.example deleted file mode 100644 index 322e31c..0000000 --- a/docker-services/plex/.env.example +++ /dev/null @@ -1,8 +0,0 @@ -# Plex – proměnné -TZ=Europe/Prague -PUID=1000 -PGID=1000 - -# HW akcelerace (vyber podle sveho GPU) -# NVIDIA_VISIBLE_DEVICES=all -# INTEL_VISIBLE_DEVICES=true diff --git a/docker-services/plex/README.md b/docker-services/plex/README.md deleted file mode 100644 index 3aa9499..0000000 --- a/docker-services/plex/README.md +++ /dev/null @@ -1,58 +0,0 @@ -# Plex – media server - -> Stream filmů, seriálů, hudby, fotek. HW transkódování. - -## 📋 Přehled - -- **Image:** `linuxserver/plex:latest` -- **Porty:** `32400` (web), `1900` (DLNA), `5353` (Bonjour), `8324` (plex.tv) -- **User:** `1000:1000` -- **Network:** `host` (doporučeno) – kvůli HW transkódování - -## 🚀 Instalace - -```bash -cp .env.example .env -docker compose up -d -``` - -Pak `http://:32400/web` – setup wizard. - -## 🎯 Funkce - -- **Hardware transkódování** – Intel/AMD/NVIDIA GPU akcelerace -- **Plex Pass** – Live TV, DVR, HW encoding (placené) -- **Mobile app** – iOS/Android/Apple TV -- **Plex.tv** – vzdálený přístup -- **Share** – s přáteli - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/config` | Plex konfigurace, DB | -| `./media:/media` | Tvoje knihovna (filmy, seriály, hudba) | - -## 🔧 HW transkódování - -V `.env` nastavit: -- `NVIDIA_VISIBLE_DEVICES=all` – pro NVIDIA -- `INTEL_VISIBLE_DEVICES=true` – pro Intel QuickSync - -## 🔐 Bezpečnost - -- **HTTPS** – terminuj v NPM -- **Plex.tv účet** – nepoužívej guest účet -- **Network discovery** – vypni pokud nepotřebuješ - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Dokumentace - -- [Plex Support](https://support.plex.tv/) -- [Plex Media Server](https://www.plex.tv/media-server-downloads/) diff --git a/docker-services/plex/docker-compose.yml b/docker-services/plex/docker-compose.yml deleted file mode 100644 index f317533..0000000 --- a/docker-services/plex/docker-compose.yml +++ /dev/null @@ -1,22 +0,0 @@ -# Plex Media Server - -services: - plex: - image: lscr.io/linuxserver/plex:latest - container_name: plex - restart: unless-stopped - network_mode: host # Pro HW transkódování a DLNA - volumes: - - ./data:/config - - ./media:/media - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - VERSION=docker - - NVIDIA_VISIBLE_DEVICES=all - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" diff --git a/docker-services/portainer/.env.example b/docker-services/portainer/.env.example deleted file mode 100644 index fe9adec..0000000 --- a/docker-services/portainer/.env.example +++ /dev/null @@ -1,9 +0,0 @@ -# Portainer CE – proměnné prostředí -# Zkopíruj tento soubor na .env a doplň skutečné hodnoty - -# Timezone -TZ=Europe/Prague - -# UID/GID pro file ownership -PUID=1000 -PGID=1000 diff --git a/docker-services/portainer/README.md b/docker-services/portainer/README.md deleted file mode 100644 index 6fa7363..0000000 --- a/docker-services/portainer/README.md +++ /dev/null @@ -1,67 +0,0 @@ -# Portainer – Docker UI management - -> Webové UI pro správu Dockeru (kontejnery, image, sítě, volumes, swarm, kubernetes). - -## 📋 Přehled - -- **Image:** `portainer/portainer-ce:latest` -- **Porty:** `9000` (HTTP), `9443` (HTTPS) -- **User:** `1000:1000` -- **Network:** `bridge` (default) - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env # nastavit SECRET, PUID, PGID - -docker compose up -d -``` - -## 🌐 Přístup - -- **HTTP:** `http://:9000` -- **HTTPS:** `https://:9443` (self-signed, akceptuj varování) - -**První přihlášení:** -1. Vytvoř admin účet (zobrazí se při prvním přístupu) -2. Připoj se k lokálnímu Docker endpointu -3. Spravuj kontejnery přes web UI - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/data` | Portainer data (DB, certifikáty, zálohy) | -| `/var/run/docker.sock:/var/run/docker.sock` | Přístup k Docker daemonu | - -## 🔐 Bezpečnost - -- **Heslo pro admin:** silné, 12+ znaků -- **HTTPS:** nastavit v Settings → SSL (nebo terminovat v NPM) -- **2FA:** aktivovat pro admin účet v Settings → Users -- **Dostupnost:** portainer nemá remote auth → zařadit za reverse proxy - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Další informace - -- [Oficiální dokumentace](https://docs.portainer.io/) -- [Portainer CE vs Business](https://www.portainer.io/pricing) - -## 🛠 Troubleshooting - -**Portainer se nemůže připojit k Dockeru:** -- Zkontroluj `/var/run/docker.sock` oprávnění -- Portainer musí mít stejný UID jako docker socket (typicky root, ale v CE to funguje) - -**Zapomenuté heslo:** -```bash -docker exec -u root portainer /bin/sh -# Pak resetuj v DB (složitější, doporučuji reinstalaci) -``` diff --git a/docker-services/portainer/docker-compose.yml b/docker-services/portainer/docker-compose.yml deleted file mode 100644 index 21c3993..0000000 --- a/docker-services/portainer/docker-compose.yml +++ /dev/null @@ -1,35 +0,0 @@ -# Portainer Community Edition - -services: - portainer: - image: portainer/portainer-ce:latest - container_name: portainer - restart: unless-stopped - ports: - - "9000:9000" - - "9443:9443" - volumes: - - ./data:/data - - /var/run/docker.sock:/var/run/docker.sock - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - networks: - - portainer_net - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:9000/api/status"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 30s - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - portainer_net: - name: portainer_default - driver: bridge diff --git a/docker-services/rustdesk/.env.example b/docker-services/rustdesk/.env.example deleted file mode 100644 index e8bfe6e..0000000 --- a/docker-services/rustdesk/.env.example +++ /dev/null @@ -1,7 +0,0 @@ -# RustDesk – proměnné prostředí -TZ=Europe/Prague -PUID=1000 -PGID=1000 - -# Poznámka: Po prvním spuštění si ulož veřejný klíč z logu hbbs -# Použije se v RustDesk klientovi (Preferences → Network → Key Server) diff --git a/docker-services/rustdesk/README.md b/docker-services/rustdesk/README.md deleted file mode 100644 index 5d867eb..0000000 --- a/docker-services/rustdesk/README.md +++ /dev/null @@ -1,53 +0,0 @@ -# RustDesk Server – remote desktop - -> Vlastní relay server pro RustDesk. Bez závislosti na veřejném RustDesk serveru. - -## 📋 Přehled - -- **Image:** `rustdesk/rustdesk-server:latest` -- **Porty:** `21115-21119` (TCP+UDP), `21116` (WebSocket) -- **User:** `1000:1000` -- **Network:** `host` (lepší pro P2P) - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env - -docker compose up -d -``` - -## 🌐 Konfigurace klienta - -V RustDesk klientovi (Preferences → Network): - -- **ID Server:** `:21116` -- **Key Server:** `:21116` -- **Relay Server:** `:21117` - -**Veřejný klíč** získáš z logu kontejneru `hbbs` (první spuštění). - -## 🔐 Bezpečnost - -- **Firewall:** otevři jen potřebné porty -- **HTTPS** – na relay lze nastavit terminaci -- **WebSocket** – `ws://` nebo `wss://` (doporučeno za HTTPS) - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/root` | Databáze, klíče, data | - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Dokumentace - -- [RustDesk Server](https://rustdesk.com/docs/en/self-host/) -- [Docker compose](https://rustdesk.com/docs/en/self-host/rustdesk-server-oss/docker/) diff --git a/docker-services/rustdesk/docker-compose.yml b/docker-services/rustdesk/docker-compose.yml deleted file mode 100644 index 0957225..0000000 --- a/docker-services/rustdesk/docker-compose.yml +++ /dev/null @@ -1,53 +0,0 @@ -# RustDesk Server – vlastní relay - -services: - hbbs: - image: rustdesk/rustdesk-server:latest - container_name: hbbs - command: hbbs - restart: unless-stopped - volumes: - - ./data:/root - ports: - - "21115:21115" - - "21116:21116" - - "21116:21116/udp" - - "21118:21118" - networks: - - rustdesk_net - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - - hbbr: - image: rustdesk/rustdesk-server:latest - container_name: hbbr - command: hbbr - restart: unless-stopped - volumes: - - ./data:/root - ports: - - "21117:21117" - - "21119:21119" - networks: - - rustdesk_net - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - rustdesk_net: - name: rustdesk_default - driver: bridge diff --git a/docker-services/speedtest/.env.example b/docker-services/speedtest/.env.example deleted file mode 100644 index 3248209..0000000 --- a/docker-services/speedtest/.env.example +++ /dev/null @@ -1,10 +0,0 @@ -# Speedtest Tracker – proměnné -TZ=Europe/Prague -PUID=1000 -PGID=1000 - -# APP_KEY: 32+ znaků – vygeneruj: openssl rand -base64 32 -APP_KEY=change-me-32-char-base64-key - -# URL kde běží Speedtest Tracker -APP_URL=http://CHANGE_ME:8765 diff --git a/docker-services/speedtest/README.md b/docker-services/speedtest/README.md deleted file mode 100644 index 7a951c7..0000000 --- a/docker-services/speedtest/README.md +++ /dev/null @@ -1,51 +0,0 @@ -# Speedtest Tracker – rychlost internetu - -> Sledování rychlosti internetu v čase. Grafy, alerty, statistiky. - -## 📋 Přehled - -- **Image:** `linuxserver/speedtest-tracker:latest` -- **Porty:** `8765` (web), `8443` (HTTPS) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -docker compose up -d -``` - -## 🌐 Přístup - -- **Web:** `http://:8765` - -## 🎯 Funkce - -- **Automatický speedtest** – každých X minut -- **Grafy** – rychlost stahování, odesílání, ping -- **Alert** – notifikace když rychlost klesne -- **Multi-server** – sleduj víc linek - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/config` | Speedtest Tracker data | - -## 🔧 Pokročilé - -- **Ookla CLI** – integrovaný -- **Cloudflare** – speedtest.cloudflare.com -- **Notifikace** – email, Telegram, Discord, Slack - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -``` - -## 📚 Dokumentace - -- [Speedtest Tracker](https://docs.speedtest-tracker.dev/) diff --git a/docker-services/speedtest/docker-compose.yml b/docker-services/speedtest/docker-compose.yml deleted file mode 100644 index 854e1c5..0000000 --- a/docker-services/speedtest/docker-compose.yml +++ /dev/null @@ -1,30 +0,0 @@ -# Speedtest Tracker - -services: - speedtest: - image: lscr.io/linuxserver/speedtest-tracker:latest - container_name: speedtest - restart: unless-stopped - ports: - - "8765:80" - - "8443:443" - volumes: - - ./data:/config - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - APP_KEY=CHANGE_ME_32_CHAR_KEY - - APP_URL=http://CHANGE_ME:8765 - networks: - - speedtest_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - speedtest_net: - name: speedtest_default - driver: bridge diff --git a/docker-services/vaultwarden/.env.example b/docker-services/vaultwarden/.env.example deleted file mode 100644 index 4b9cb6f..0000000 --- a/docker-services/vaultwarden/.env.example +++ /dev/null @@ -1,15 +0,0 @@ -# Vaultwarden – proměnné prostředí -TZ=Europe/Prague -PUID=1000 -PGID=1000 - -# URL přes kterou bude Vaultwarden dostupný (musí být https://) -DOMAIN=https://vault.example.com - -# Po prvním přihlášení admin účtu nastavte na false -SIGNUPS_ALLOWED=true -INVITATIONS_ALLOWED=false - -# Bezpečnost -SHOW_PASSWORD_HINT=false -LOG_LEVEL=warn diff --git a/docker-services/vaultwarden/README.md b/docker-services/vaultwarden/README.md deleted file mode 100644 index 3bd3693..0000000 --- a/docker-services/vaultwarden/README.md +++ /dev/null @@ -1,79 +0,0 @@ -# Vaultwarden – self-hosted správce hesel - -> Kompatibilní s Bitwarden klienty. Open-source, lehký (Rust). - -## 📋 Přehled - -- **Image:** `vaultwarden/server:latest` -- **Porty:** `2999` (HTTP), `3012` (WebSocket, interní) -- **User:** `1000:1000` -- **Network:** `bridge` - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env # nastavit DOMAIN, ROCKET_PORT, hesla - -docker compose up -d -``` - -## 🌐 Přístup - -- **Web vault:** `http://:2999` (za HTTPS terminuj v NPM) -- **Bitwarden app:** stejná URL jako vault -- **Doporučení:** terminuj HTTPS přes NPM a nepoužívej HTTP přímo - -## 🔐 Bezpečnost - -- **DOMAIN** musí být `https://vault.example.com` (ne `http`) -- **SIGNUPS_ALLOWED=false** po registraci admin účtu -- **INVITATIONS_ALLOWED=false** pokud nechceš zvát další -- **SHOW_PASSWORD_HINT=false** (odhalování hesel) -- **DATABASE_URL** – zálohuj SQLite pravidelně - -## 🔑 Záloha - -```bash -# Zastavit kontejner -docker compose stop - -# Zazálohovat SQLite DB -cp ./data/db.sqlite3 /backup/vaultwarden-$(date +%Y%m%d).sqlite3 - -# Restart -docker compose start -``` - -## 👥 Organizace - -- **1 user** (ty) – self-hosted -- **2FA** – povinně aktivuj po registraci -- **FIDO2/WebAuthn** – podpora hardwarových klíčů (YubiKey) -- **Organizace** – pro sdílení hesel s rodinou - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `./data:/data` | SQLite DB, attachmenty, ikony, config | - -## 📚 Klienti - -- **Mobil:** Bitwarden (iOS/Android) -- **Desktop:** Bitwarden (Win/Mac/Linux) -- **Browser:** Bitwarden extension (Chrome/Firefox/Edge) -- **CLI:** `rbw` (Rust) nebo `bitwarden-cli` - -## 🔄 Aktualizace - -```bash -docker compose pull -docker compose up -d -# DB migrace probíhá automaticky -``` - -## 📚 Dokumentace - -- [Vaultwarden Wiki](https://github.com/dani-garcia/vaultwarden/wiki) -- [Bitwarden klienti](https://bitwarden.com/download/) diff --git a/docker-services/vaultwarden/docker-compose.yml b/docker-services/vaultwarden/docker-compose.yml deleted file mode 100644 index 17e8fcb..0000000 --- a/docker-services/vaultwarden/docker-compose.yml +++ /dev/null @@ -1,41 +0,0 @@ -# Vaultwarden – kompatibilní Bitwarden server - -services: - vaultwarden: - image: vaultwarden/server:latest - container_name: vaultwarden - restart: unless-stopped - ports: - - "2999:80" - volumes: - - ./data:/data - environment: - - PUID=1000 - - PGID=1000 - - TZ=Europe/Prague - - DOMAIN=https://CHANGE_ME - - ROCKET_PORT=80 - - SIGNUPS_ALLOWED=true - - INVITATIONS_ALLOWED=false - - SHOW_PASSWORD_HINT=false - - LOG_LEVEL=warn - - EXTENDED_LOGGING=true - - RUST_BACKTRACE=1 - networks: - - vaultwarden_net - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:80/alive"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 30s - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - vaultwarden_net: - name: vaultwarden_default - driver: bridge diff --git a/docker-services/watchtower/.env.example b/docker-services/watchtower/.env.example deleted file mode 100644 index 0e394ef..0000000 --- a/docker-services/watchtower/.env.example +++ /dev/null @@ -1,22 +0,0 @@ -# Watchtower – proměnné -TZ=Europe/Prague - -# Mód: true = jen upozorni, false = auto-aktualizuje -WATCHTOWER_MONITOR_ONLY=true - -# Mazat stare image po update -WATCHTOWER_CLEANUP=true - -# Cron schedule (default: kazdou nedeli ve 4:00) -WATCHTOWER_SCHEDULE=0 0 4 ? * SUN - -# Email notifikace -WATCHTOWER_NOTIFICATIONS=email -WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com -WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com -WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com -WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 -WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com -WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=change-me - -# Poznámka: V praxi nastav SMTP podle sveho providera diff --git a/docker-services/watchtower/README.md b/docker-services/watchtower/README.md deleted file mode 100644 index 2de6e1f..0000000 --- a/docker-services/watchtower/README.md +++ /dev/null @@ -1,61 +0,0 @@ -# Watchtower – automatické aktualizace - -> Sleduje nové verze Docker image a automaticky restartuje kontejnery. - -## 📋 Přehled - -- **Image:** `containrrr/watchtower:latest` -- **Network:** `bridge` (musí mít přístup k Docker socketu) -- **Mód:** monitor-only (default) – jen upozorňuje, NEaktualizuje - -## 🚀 Instalace - -```bash -cp .env.example .env -nano .env # nastavit WATCHTOWER_MONITOR_ONLY podle potřeby - -docker compose up -d -``` - -## 🎯 Módy - -- **Monitor only** (default) – posílá email/notifikaci, NEaktualizuje -- **Auto update** – stáhne nový image, restartuje kontejner - -## 📧 Notifikace (email) - -```env -WATCHTOWER_NOTIFICATIONS=email -WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com -WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com -WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com -WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 -WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com -WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME -``` - -## 🔧 Pokročilé - -- **Schedule** – cron-like: `0 0 4 ? * SUN` (každou neděli v 4:00) -- **Cleanup** – smaže staré image (`WATCHTOWER_CLEANUP=true`) -- **Notifications** – shoutrrr (Telegram, Discord, Slack, …) - -## 📁 Volumes - -| Mount | Účel | -|---|---| -| `/var/run/docker.sock:/var/run/docker.sock` | Přístup k Docker daemonu | - -## 🔐 Bezpečnost - -- **Doporučeno:** monitor-only s email notifikací -- **Auto-update** riskantní – může rozbít službu -- **Manuální update:** `docker compose pull && docker compose up -d` - -## 🔄 Restart - -Watchtower se automaticky restartuje. **Nemusíte na něj sahat.** - -## 📚 Dokumentace - -- [Watchtower GitHub](https://github.com/containrrr/watchtower) diff --git a/docker-services/watchtower/docker-compose.yml b/docker-services/watchtower/docker-compose.yml deleted file mode 100644 index 5659cb2..0000000 --- a/docker-services/watchtower/docker-compose.yml +++ /dev/null @@ -1,34 +0,0 @@ -# Watchtower – monitor + auto-update - -services: - watchtower: - image: containrrr/watchtower:latest - container_name: watchtower - restart: unless-stopped - volumes: - - /var/run/docker.sock:/var/run/docker.sock - environment: - - TZ=Europe/Prague - - WATCHTOWER_MONITOR_ONLY=true - - WATCHTOWER_CLEANUP=true - - WATCHTOWER_SCHEDULE=0 0 4 ? * SUN - - WATCHTOWER_NOTIFICATIONS=email - - WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com - - WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com - - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com - - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 - - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com - - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME - - WATCHTOWER_NOTIFICATION_EMAIL_SUBJECTTAG=Watchtower - networks: - - watchtower_net - logging: - driver: json-file - options: - max-size: "10m" - max-file: "3" - -networks: - watchtower_net: - name: watchtower_default - driver: bridge diff --git a/docs/architecture.md b/docs/architecture.md deleted file mode 100644 index c105531..0000000 --- a/docs/architecture.md +++ /dev/null @@ -1,162 +0,0 @@ -# 🏛 Architecture - -> Jak je celá home infrastruktura poskládaná. - -## 🎯 Přehled - -Home lab běží na jednom fyzickém serveru (Ubuntu 22.04/24.04 LTS) s Docker. -Všechny služby jsou **containerizované**, za **Nginx Proxy Manager** (reverse proxy + HTTPS). - -## 🌐 Vrstvy - -``` -┌─────────────────────────────────────────────────────────────┐ -│ Layer 7: Aplikační služby │ -│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ -│ │Nextcloud │ │Vaultwarden│ │ Gitea │ │ Jotty │ │ -│ │ :11000 │ │ :2999 │ │ :3000/222│ │ :1122 │ │ -│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │ -│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ -│ │ Portainer│ │ Plex │ │Audiobook-│ │ Calibre │ │ -│ │ :9000 │ │ :32400 │ │shelf:13378│ │-Web:8083 │ │ -│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │ -│ ... dalších 7 služeb (rustdesk, wikijs, speedtest, ...) │ -└─────────────────────────────────────────────────────────────┘ - ▲ - │ HTTPS -┌─────────────────────────────────────────────────────────────┐ -│ Layer 4-7: Reverzní proxy + Let's Encrypt │ -│ ┌──────────────────────────────────────────────────┐ │ -│ │ Nginx Proxy Manager (:80, :443) │ │ -│ │ - SSL terminace (Let's Encrypt) │ │ -│ │ - HTTP → HTTPS redirect │ │ -│ │ - Access Lists │ │ -│ │ - Load balancing (volitelně) │ │ -│ └──────────────────────────────────────────────────┘ │ -└─────────────────────────────────────────────────────────────┘ - ▲ - │ HTTP -┌─────────────────────────────────────────────────────────────┐ -│ Layer 2-3: Docker bridge networks │ -│ Každá služba má vlastní bridge: │ -│ portainer_default, vaultwarden_default, gitea_default, ... │ -│ Izolace: služby mezi sebou nekomunikují (default) │ -│ Komunikace: přes reverzní proxy (NPM) │ -└─────────────────────────────────────────────────────────────┘ - ▲ - │ Docker API -┌─────────────────────────────────────────────────────────────┐ -│ Layer 1: Fyzický server │ -│ ┌──────────────────────────────────────────────────┐ │ -│ │ Ubuntu 22.04/24.04 LTS │ │ -│ │ - Docker CE 29.x │ │ -│ │ - Portainer CE (UI pro Docker) │ │ -│ │ - Watchtower (auto-update monitoring) │ │ -│ │ - deploy user (UID 1000) │ │ -│ │ - UFW firewall + fail2ban │ │ -│ │ - SSH hardening │ │ -│ └──────────────────────────────────────────────────┘ │ -└─────────────────────────────────────────────────────────────┘ -``` - -## 🔌 Služby (detail) - -| Služba | Port | Databáze | Volume | Backup | -|---|---|---|---|---| -| Portainer | 9000, 9443 | SQLite (interní) | `./data` | rsync | -| Nginx Proxy Manager | 80, 443, 81 | MariaDB | `./data`, `./letsencrypt` | rsync | -| Vaultwarden | 2999 | SQLite | `./data` | rsync (kritické!) | -| Nextcloud AIO | 11000 | MariaDB | `./data` | AIO Borg | -| Gitea | 3000, 222 | SQLite | `./gitea` | rsync | -| Jotty | 1122 | SQLite | `./data` | rsync | -| RustDesk | 21115-21119 | SQLite | `./data` | rsync | -| Audiobookshelf | 13378 | SQLite | `./data` + `./audiobooks` | rsync | -| Calibre-Web | 8083 | SQLite | `./data` + `./books` | rsync | -| Plex | 32400 | SQLite | `./data` + `./media` | rsync | -| Erugo | 61080 | SQLite | `./data` | rsync | -| Wiki.js | 9180 | MariaDB | `./data` | rsync | -| Speedtest | 8765 | SQLite | `./data` | rsync | -| Watchtower | – | – | – | – | - -## 💾 Zálohovací schéma - -``` -┌────────────┐ -│ Server │ rsync (denně, 03:00) → NAS /Volumes/Backups -│ /home/.../│ -└────────────┘ - │ - ▼ -┌────────────┐ -│ NAS │ Off-site sync (Backblaze B2, týdně) -│ /Backups/ │ -└────────────┘ -``` - -Viz `install-scripts/backup-all.sh` a `install-scripts/restore-all.sh`. - -## 🔐 Bezpečnost - -### Perimetrie -- **UFW** – default deny, povoleno: SSH, HTTP, HTTPS -- **fail2ban** – ban po 3 neúspěšných SSH pokusech -- **Cloudflare Tunnel** (volitelně) – přístup zvenčí bez veřejné IP - -### Auth -- **SSH klíče** – hesla zakázána (`PasswordAuthentication no`) -- **2FA** – na všech web službách (Gitea, Vaultwarden, Nextcloud, …) -- **Vaultwarden** – single source of truth pro hesla - -### Network -- **Bridge isolation** – služby spolu nekomunikují (default) -- **No host network** – kromě Plex (HW transkódování) -- **DNS-over-HTTPS** (volitelně) - -## 🔄 Deployment workflow - -``` -Developer - │ - ├─→ git push (do Gitea) - │ - ├─→ Ansible (na server) - │ │ - │ └─→ docker compose pull && up -d - │ - └─→ Watchtower (auto, týdně) - └─→ image: pull, container: restart -``` - -Viz `ansible/playbooks/`. - -## 📊 Monitoring - -- **Watchtower** – Docker image notifikace (email/Telegram) -- **Speedtest Tracker** – internet speed -- **Nextcloud Talk** – interní chat -- **Portainer** – Docker container status - -## 🛠 Maintenance - -| Úkol | Jak často | Skript/Ansible | -|---|---|---| -| Backup | Denně 03:00 | `backup-all.sh` (cron) | -| Update OS | Týdně | `apt update && apt upgrade` | -| Update Docker image | Týdně (auto) | Watchtower | -| Cert renewal | Auto (Let's Encrypt 30d) | NPM interní | -| Health check | Denně | `docker ps` + alerting | - -## 🔮 Roadmap - -- **Kubernetes** – přechod z docker compose na k3s (1 server node, multi-workload) -- **GitOps** – ArgoCD pro plnou automatizaci -- **CI/CD** – Gitea Actions pro testování Ansible playbooks -- **Off-site backup** – Backblaze B2 s encryption -- **Monitoring stack** – Prometheus + Grafana + Loki - -## 📚 Reference - -- [Docker docs](https://docs.docker.com/) -- [Nginx Proxy Manager](https://nginxproxymanager.com/) -- [Ansible best practices](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html) -- [12-factor app](https://12factor.net/) diff --git a/docs/contributing.md b/docs/contributing.md deleted file mode 100644 index c3ddf71..0000000 --- a/docs/contributing.md +++ /dev/null @@ -1,116 +0,0 @@ -# 🤝 Contributing - -> Jak přispívat do tohoto repozitáře. - -## 📝 Pravidla - -### Commit messages - -Používej **Conventional Commits**: - -- `feat:` – nová služba nebo funkce -- `fix:` – oprava chyby -- `docs:` – pouze dokumentace -- `chore:` – údržba, refactoring -- `style:` – formatting, bez funkční změny -- `refactor:` – přestavba kódu -- `test:` – přidání testů - -Příklad: `feat(vaultwarden): přidat 2FA podporu` - -### Branch naming - -- `feature/` – nová feature -- `fix/` – bugfix -- `docs/` – dokumentace - -Příklad: `feature/audiobookshelf-metadata` - -### Pull Request - -1. Fork → branch → commit → push → PR -2. **Titulek PR** – krátký, výstižný -3. **Popis** – co, proč, jak -4. **Screenshoty** – pokud měníš UI/dokumentaci -5. **Testy** – pokud měníš Ansible playbooks - -## 🏗 Struktura - -``` -repo/ -├── docker-services/ # Každá služba v samostatném adresáři -├── install-scripts/ # Bash skripty pro nové servery -├── ansible/ # Playbooky + role -├── hermes-install/ # Hermes CLI setup -├── macos-setup/ # Homebrew + macOS defaults -├── home-nas-tools/ # Metadata (žádné binárky!) -└── docs/ # Architektura, bezpečnost -``` - -## ✅ Checklist pro novou službu - -- [ ] `docker-services//docker-compose.yml` – generický, placeholders -- [ ] `docker-services//.env.example` – šablona env vars -- [ ] `docker-services//README.md` – dokumentace -- [ ] Aktualizován `docker-services/README.md` (tabulka) -- [ ] Aktualizován hlavní `README.md` (pokud je service klíčová) -- [ ] **Žádné citlivé údaje** v commitu - -## 🔐 Bezpečnost - -- ❌ **NEcommituj** hesla, API klíče, IP adresy serveru -- ❌ **NEcommituj** `~/.env` (je v `.gitignore`) -- ❌ **NEcommituj** SSH klíče -- ✅ **Vždy** používej `.env.example` jako šablonu -- ✅ **Vždy** testuj nové compose lokálně před commitem - -## 🧪 Testování - -Před commitem: - -```bash -# Validace YAML -python3 -c "import yaml; yaml.safe_load(open('docker-services//docker-compose.yml'))" - -# Validace compose (na serveru) -docker compose -f docker-services//docker-compose.yml config - -# Syntax check bash -shellcheck install-scripts/