commit 444191d16d4aadef88be701ae59dc36ec92c4378 Author: mates Date: Sat Aug 1 16:25:58 2026 +0200 feat: initial infra repo - docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower) - install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore - ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton - hermes-install: Hermes CLI setup on macOS - macos-setup: Brewfile + osx-defaults + fish-config - home-nas-tools: metadata index for NAS projects (no binaries) - docs: architecture, security, contributing - README, LICENSE (MIT), .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9075a07 --- /dev/null +++ b/.gitignore @@ -0,0 +1,71 @@ +# ================================================================= +# .gitignore pro mates-infra +# ================================================================= + +# Secrets — NIKDY necommituj +.env +.env.local +*.env.local +*.pem +*.key +*.crt +secrets/ +*.secret + +# Backup soubory (velké, nepatří do gitu) +*.tar.gz +*.tar.bz2 +*.7z +*.zip +*.rar +*.tar + +# Media +*.iso +*.img +*.vhd +*.vmdk +*.qcow2 +*.dmg + +# Logy +*.log +logs/ + +# Database +*.db +*.sqlite +*.sqlite3 + +# Docker data (perzistentní volumes, nikdy v gitu) +docker-data/ + +# IDE +.idea/ +.vscode/ +*.swp +.DS_Store +Thumbs.db + +# OS +.Trash-* +$RECYCLE.BIN/ + +# Pracovní adresáře +*.tmp +*.bak +*~ + +# Node / Python +node_modules/ +__pycache__/ +*.pyc +*.pyo + +# Ansible +*.retry +*.pyc +inventory.yml +group_vars/all/vault.yml +roles/*/vars/main.yml +*.bak diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..17535d5 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 mates + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..341cc36 --- /dev/null +++ b/README.md @@ -0,0 +1,88 @@ +# 🔧 mates — Home Infrastructure + +> Sbírka šablon, skriptů a Ansible playbooků pro rychlé nasazení self-hostované infrastruktury. +> Veškerý obsah vychází z reálného běhu na serveru `192.168.0.148` (Ubuntu 24.04, Docker 29.x). + +**[![Gitea](https://img.shields.io/badge/Gitea-192.168.0.148:3000-609926?logo=gitea)](http://192.168.0.148:3000)** · **[![Jotty](https://img.shields.io/badge/Jotty-docs-3b82f6)](http://192.168.0.148:1122)** · **[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)** + +--- + +## 🗂 Co je v tomto repo + +| Adresář | Účel | Stav | +|---|---|---| +| [`docker-services/`](docker-services/) | Generické `docker-compose.yml` pro 14+ služeb (portainer, vaultwarden, nextcloud, …) | ✅ | +| [`install-scripts/`](install-scripts/) | Bash skripty pro nové servery (Ubuntu 22.04/24.04 LTS) | ✅ | +| [`ansible/`](ansible/) | Ansible playbooks + role pro idempotentní deploy | ✅ | +| [`hermes-install/`](hermes-install/) | Instalace a konfigurace Hermes Agent (mě) na macOS | ✅ | +| [`macos-setup/`](macos-setup/) | Homebrew `Brewfile` + skripty pro macOS workstation | ✅ | +| [`home-nas-tools/`](home-nas-tools/) | Rejstřík projektů a nástrojů z NAS (`/Volumes/Backups/Prace/`) | ✅ | +| [`docs/`](docs/) | Architektura, bezpečnost, contributing | ✅ | + +## 🏗 Aktuální infrastruktura + +``` +┌─────────────────────────────────────────────────────────────────────┐ +│ Internet (Cloudflare Tunnel) │ +└────────────────────┬────────────────────────────────────────────────┘ + │ HTTPS (443) + ▼ +┌─────────────────────────────────────────────────────────────────────┐ +│ Nginx Proxy Manager (192.168.0.148:81, 443) │ +│ ├─ DNS: domácí subdomény → LAN IP │ +│ └─ Let's Encrypt auto-renew │ +└────────────────────┬────────────────────────────────────────────────┘ + │ + ┌─────────────────┼─────────────────┬──────────────┐ + ▼ ▼ ▼ ▼ +┌──────────┐ ┌──────────┐ ┌──────────┐ ┌────────────┐ +│ Nextcloud│ │Vaultwarden│ │ Gitea │ │ Jotty (doc)│ +│ AIO │ │ :2999 │ │ :3000/222 │ │ :1122 │ +│ :11000 │ └──────────┘ └──────────┘ └────────────┘ +└──────────┘ + … dalších 11 služeb (Plex, RustDesk, Calibre, Audiobookshelf, Wikijs, …) +``` + +Detailní seznam: [`docker-services/README.md`](docker-services/README.md) + +## 🚀 Rychlý start (nový server) + +```bash +# 1. Klonuj tento repo +git clone https://github.com//mates-infra.git ~/infra +cd ~/infra + +# 2. Spusť bootstrap (Ubuntu 22.04/24.04 LTS) +sudo bash install-scripts/bootstrap-ubuntu-server.sh + +# 3. Nainstaluj všechny služby +sudo bash install-scripts/install-docker.sh +sudo bash install-scripts/install-portainer.sh +# … další viz install-scripts/ + +# 4. Nebo použij Ansible +cd ansible +ansible-playbook -i inventory.example.yml playbooks/deploy-services.yml +``` + +## 📚 Dokumentace + +- 🏛 [Architektura](docs/architecture.md) – jak to celé funguje +- 🔐 [Bezpečnost](docs/security.md) – hardening, secrets, HTTPS +- 🤝 [Contributing](docs/contributing.md) – jak přispívat +- 📝 [Jotty dokumentace](http://192.168.0.148:1122) – knowledge base v Jotty + +## 🔒 Bezpečnost + +- **Všechna hesla v `.env.example`** – nikdy necommituj `.env` +- **HTTPS** – Let's Encrypt přes NPM +- **Firewall** – UFW + fail2ban +- **Bezpečnostní audit**: viz [`docs/security.md`](docs/security.md) + +## 📜 Licence + +[MIT](LICENSE) – používej jak chceš. + +--- + +**Vyrobeno s ❤️ v homelabu · 2026** diff --git a/ansible/README.md b/ansible/README.md new file mode 100644 index 0000000..b0f865f --- /dev/null +++ b/ansible/README.md @@ -0,0 +1,88 @@ +# 🎭 Ansible Playbooks + +> Ansible role a playbooks pro nasazení a správu home infrastruktury. +> Idempotentní, testovatelné, čitelné. + +## 📁 Struktura + +``` +ansible/ +├── README.md # Tento soubor +├── ansible.cfg # Konfigurace +├── requirements.yml # Ansible Galaxy role +├── inventory.example.yml # Ukázkový inventory +├── playbooks/ +│ ├── bootstrap-server.yml # Úvodní setup nového serveru +│ ├── deploy-services.yml # Nasaď všechny Docker služby +│ ├── update-services.yml # Update všech služeb +│ └── security-hardening.yml # Bezpečnostní hardening +├── roles/ +│ ├── common/ # Společné úkoly (update, packages, users) +│ ├── docker/ # Docker + compose +│ ├── portainer/ # Portainer compose +│ ├── nginx-proxy/ # Nginx Proxy Manager +│ ├── vaultwarden/ # Vaultwarden +│ ├── gitea/ # Gitea +│ └── ... +└── group_vars/ + └── all.yml.example # Společné proměnné +``` + +## 🚀 Quickstart + +```bash +# 1. Příprava +pip install ansible +ansible-galaxy install -r requirements.yml + +# 2. Inventory +cp inventory.example.yml inventory.yml +nano inventory.yml # nastavit IP a SSH user + +# 3. Test připojení +ansible all -m ping + +# 4. Bootstrap +ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml + +# 5. Nasaď služby +ansible-playbook -i inventory.yml playbooks/deploy-services.yml --extra-vars "services=[portainer,vaultwarden,gitea]" + +# 6. Update +ansible-playbook -i inventory.yml playbooks/update-services.yml +``` + +## 🎯 Playbooky + +### `bootstrap-server.yml` +- Update OS +- Setup deploy user (UID 1000) +- SSH hardening +- UFW firewall +- fail2ban +- Základní utility + +### `deploy-services.yml` +- Nasaď vybrané Docker služby +- Idempotentní – můžeš spustit víckrát + +### `update-services.yml` +- `docker compose pull && up -d` pro všechny služby +- Watchtower notifikace + +### `security-hardening.yml` +- Sysctl hardening +- AppArmor profily +- Auditd pravidla +- Automatické security updaty + +## 🔐 Bezpečnost + +- **Bez hesel v inventory** – použij `ansible-vault` nebo SSH klíče +- **Privilege escalation** – `become: true` jen kde potřeba +- **Idempotence** – každý task kontroluje stav + +## 📚 Dokumentace + +- [Ansible docs](https://docs.ansible.com/) +- [Best practices](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html) diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg new file mode 100644 index 0000000..be1bfff --- /dev/null +++ b/ansible/ansible.cfg @@ -0,0 +1,21 @@ +[defaults] +inventory = inventory.yml +roles_path = roles +host_key_checking = False +retry_files_enabled = False +stdout_callback = yaml +forks = 10 +gathering = smart +fact_caching = jsonfile +fact_caching_connection = local +fact_caching_timeout = 86400 + +[privilege_escalation] +become = True +become_method = sudo +become_ask_pass = False + +[ssh_connection] +pipelining = True +ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ServerAliveInterval=30 +control_path = /tmp/ansible-ssh-%%h-%%p-%%r diff --git a/ansible/group_vars/all.yml.example b/ansible/group_vars/all.yml.example new file mode 100644 index 0000000..7d7c7f8 --- /dev/null +++ b/ansible/group_vars/all.yml.example @@ -0,0 +1,35 @@ +--- +# Společné proměnné pro všechny playbooks +# Zkopíruj na group_vars/all.yml a doplň + +# Docker +docker_user: deploy +docker_uid: 1000 +docker_gid: 1000 +docker_install_compose_plugin: true + +# Služby k nasazení (seznam názvů adresářů v docker-services/) +services_to_deploy: + - portainer + - nginx-proxy-manager + - vaultwarden + - gitea + - jotty + - nextcloud-aio + - rustdesk + - audiobookshelf + - calibre-web + - plex + - erugo + - jswiki + - speedtest + - watchtower + +# NPM admin (po prvním loginu změnit) +npm_default_email: admin@example.com +npm_default_password: changeme + +# Gitea admin (po instalaci) +gitea_admin_user: admin +gitea_admin_password: changeme +gitea_admin_email: admin@example.com diff --git a/ansible/inventory.example.yml b/ansible/inventory.example.yml new file mode 100644 index 0000000..d059063 --- /dev/null +++ b/ansible/inventory.example.yml @@ -0,0 +1,28 @@ +--- +# Ukázkový inventory – zkopíruj na inventory.yml a uprav +all: + vars: + # SSH uživatel (deploy user, UID 1000) + ansible_user: deploy + # Python na cílovém systému + ansible_python_interpreter: /usr/bin/python3 + # Timezone + timezone: Europe/Prague + + children: + # Skupina pro všechny home servery + homeservers: + hosts: + homeserver-01: + ansible_host: 192.168.0.148 + # homeserver-02: + # ansible_host: 192.168.0.149 + + # Skupina pro produkční servery + production: + hosts: + homeserver-01: + ansible_host: 192.168.0.148 + + # Skupina pro test + staging: [] diff --git a/ansible/playbooks/bootstrap-server.yml b/ansible/playbooks/bootstrap-server.yml new file mode 100644 index 0000000..d8b775f --- /dev/null +++ b/ansible/playbooks/bootstrap-server.yml @@ -0,0 +1,145 @@ +--- +# Bootstrap nového Ubuntu serveru +# - aktualizace systému +# - deploy user (UID 1000) +# - SSH hardening +# - UFW firewall +# - fail2ban +# - Docker +# +# Použití: +# ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml +# +- name: Bootstrap home server + hosts: homeservers + become: true + gather_facts: true + + vars: + deploy_user: deploy + deploy_uid: 1000 + ssh_port: 22 + deploy_ssh_key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}" + + tasks: + - name: Update apt cache + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + + - name: Upgrade all packages + ansible.builtin.apt: + upgrade: dist + update_cache: true + + - name: Install base packages + ansible.builtin.apt: + name: + - curl + - wget + - git + - vim + - htop + - ca-certificates + - gnupg + - ufw + - fail2ban + - bash-completion + state: present + + - name: Set timezone + community.general.timezone: + name: "{{ timezone }}" + + - name: Create deploy user + ansible.builtin.user: + name: "{{ deploy_user }}" + uid: "{{ deploy_uid }}" + shell: /bin/bash + create_home: true + password: "" + + - name: Setup authorized_keys for deploy user + ansible.posix.authorized_key: + user: "{{ deploy_user }}" + state: present + key: "{{ deploy_ssh_key }}" + + - name: Allow deploy user sudo without password + ansible.builtin.copy: + dest: "/etc/sudoers.d/{{ deploy_user }}" + content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n" + mode: "0440" + + - name: SSH hardening + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: "^#?{{ item.key }}" + line: "{{ item.key }} {{ item.value }}" + state: present + loop: + - { key: "Port", value: "{{ ssh_port }}" } + - { key: "PermitRootLogin", value: "no" } + - { key: "PasswordAuthentication", value: "no" } + - { key: "X11Forwarding", value: "no" } + - { key: "ClientAliveInterval", value: "300" } + - { key: "ClientAliveCountMax", value: "2" } + notify: Restart ssh + + - name: Configure UFW defaults + community.general.ufw: + direction: incoming + policy: deny + notify: Reload ufw + + - name: Allow SSH through UFW + community.general.ufw: + rule: allow + port: "{{ ssh_port }}" + proto: tcp + + - name: Allow HTTP and HTTPS through UFW + community.general.ufw: + rule: allow + port: "{{ item }}" + proto: tcp + loop: + - "80" + - "443" + + - name: Enable UFW + community.general.ufw: + state: enabled + + - name: Configure fail2ban + ansible.builtin.copy: + dest: /etc/fail2ban/jail.local + content: | + [DEFAULT] + bantime = 1h + findtime = 10m + maxretry = 5 + + [sshd] + enabled = true + port = {{ ssh_port }} + filter = sshd + logpath = /var/log/auth.log + maxretry = 3 + mode: "0644" + notify: Restart fail2ban + + handlers: + - name: Restart ssh + ansible.builtin.service: + name: sshd + state: restarted + + - name: Reload ufw + community.general.ufw: + state: reloaded + + - name: Restart fail2ban + ansible.builtin.service: + name: fail2ban + state: restarted diff --git a/ansible/playbooks/deploy-services.yml b/ansible/playbooks/deploy-services.yml new file mode 100644 index 0000000..6898753 --- /dev/null +++ b/ansible/playbooks/deploy-services.yml @@ -0,0 +1,42 @@ +--- +# Nasaď Docker služby z docker-services/ adresáře +# +# Použití: +# ansible-playbook -i inventory.yml playbooks/deploy-services.yml +# ansible-playbook -i inventory.yml playbooks/deploy-services.yml --extra-vars "services=[portainer,vaultwarden]" +# +- name: Deploy Docker services + hosts: homeservers + become: true + gather_facts: true + + vars: + services_repo: https://github.com//mates-infra.git + services_path: "/home/{{ docker_user }}/docker-services" + services: "{{ services_to_deploy | default(['portainer', 'vaultwarden', 'gitea']) }}" + + tasks: + - name: Clone services repo + ansible.builtin.git: + repo: "{{ services_repo }}" + dest: "{{ services_path }}" + force: false + update: true + become_user: "{{ docker_user }}" + + - name: Create .env from example + ansible.builtin.copy: + src: "{{ services_path }}/{{ item }}/.env.example" + dest: "{{ services_path }}/{{ item }}/.env" + remote_src: true + force: false + loop: "{{ services }}" + become_user: "{{ docker_user }}" + + - name: Deploy services + community.docker.docker_compose_v2: + project_src: "{{ services_path }}/{{ item }}" + state: present + pull: missing + loop: "{{ services }}" + become_user: "{{ docker_user }}" diff --git a/ansible/playbooks/security-hardening.yml b/ansible/playbooks/security-hardening.yml new file mode 100644 index 0000000..db5bd86 --- /dev/null +++ b/ansible/playbooks/security-hardening.yml @@ -0,0 +1,58 @@ +--- +# Security hardening – sysctl, AppArmor, auditd, auto-updates +# +# Použití: +# ansible-playbook -i inventory.yml playbooks/security-hardening.yml +# +- name: Security hardening + hosts: homeservers + become: true + + tasks: + - name: Kernel hardening via sysctl + ansible.posix.sysctl: + name: "{{ item.key }}" + value: "{{ item.value }}" + state: present + reload: true + loop: + - { key: "net.ipv4.conf.all.rp_filter", value: "1" } + - { key: "net.ipv4.conf.default.rp_filter", value: "1" } + - { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" } + - { key: "net.ipv4.conf.all.accept_redirects", value: "0" } + - { key: "net.ipv4.conf.default.accept_redirects", value: "0" } + - { key: "net.ipv6.conf.all.accept_redirects", value: "0" } + - { key: "net.ipv4.conf.all.send_redirects", value: "0" } + - { key: "net.ipv4.conf.all.accept_source_route", value: "0" } + - { key: "net.ipv4.conf.default.accept_source_route", value: "0" } + - { key: "net.ipv4.tcp_syncookies", value: "1" } + - { key: "net.ipv4.conf.all.log_martians", value: "1" } + + - name: Install unattended-upgrades + ansible.builtin.apt: + name: + - unattended-upgrades + - apt-listchanges + state: present + + - name: Enable automatic security updates + ansible.builtin.copy: + dest: /etc/apt/apt.conf.d/20auto-upgrades + content: | + APT::Periodic::Update-Package-Lists "1"; + APT::Periodic::Unattended-Upgrade "1"; + APT::Periodic::AutocleanInterval "7"; + mode: "0644" + + - name: Install auditd + ansible.builtin.apt: + name: + - auditd + - audispd-plugins + state: present + + - name: Enable auditd + ansible.builtin.service: + name: auditd + state: started + enabled: true diff --git a/ansible/playbooks/update-services.yml b/ansible/playbooks/update-services.yml new file mode 100644 index 0000000..dfd3248 --- /dev/null +++ b/ansible/playbooks/update-services.yml @@ -0,0 +1,22 @@ +--- +# Update všech Docker služeb (docker compose pull + up -d) +# +# Použití: +# ansible-playbook -i inventory.yml playbooks/update-services.yml +# +- name: Update Docker services + hosts: homeservers + become: true + + vars: + services_path: "/home/{{ docker_user }}/docker-services" + services: "{{ services_to_deploy | default([]) }}" + + tasks: + - name: Pull and restart services + community.docker.docker_compose_v2: + project_src: "{{ services_path }}/{{ item }}" + state: present + pull: always + loop: "{{ services }}" + become_user: "{{ docker_user }}" diff --git a/docker-services/README.md b/docker-services/README.md new file mode 100644 index 0000000..1fb2346 --- /dev/null +++ b/docker-services/README.md @@ -0,0 +1,98 @@ +# 📦 Docker Services + +> Generické `docker-compose.yml` šablony pro self-hosted služby. +> Každá služba má **vlastní složku**, `.env.example` (šablona) a **README** s dokumentací. + +## 🎯 Jak použít + +```bash +# 1. Vyber službu +cd services/ + +# 2. Vytvoř .env z šablony +cp .env.example .env +nano .env # nastav POUZE potřebné hodnoty (hesla, cesty) + +# 3. Nasaď +docker compose up -d + +# 4. Ověř +docker compose ps +docker compose logs -f +``` + +## 📚 Rejstřík služeb + +| Služba | Účel | Port | Image | +|---|---|---|---| +| [`portainer`](portainer/) | Docker UI management | `9000`, `9443` | `portainer/portainer-ce` | +| [`nginx-proxy-manager`](nginx-proxy-manager/) | Reverse proxy + HTTPS | `80`, `443`, `81` | `jc21/nginx-proxy-manager` | +| [`vaultwarden`](vaultwarden/) | Správce hesel | `2999` | `vaultwarden/server` | +| [`nextcloud-aio`](nextcloud-aio/) | Cloud (soubory, kalendář) | `11000` | `nextcloud/all-in-one` | +| [`gitea`](gitea/) | Git server | `3000`, `222` | `gitea/gitea` | +| [`jotty`](jotty/) | Poznámky & checklisty | `1122` | `mrx23dotcom/jotty` | +| [`rustdesk`](rustdesk/) | Remote desktop | `21115-21119` | `rustdesk/rustdesk-server` | +| [`audiobookshelf`](audiobookshelf/) | Audio knihovna | `13378` | `advplyr/audiobookshelf` | +| [`calibre-web`](calibre-web/) | E-knihovna | `8083` | `linuxserver/calibre-web` | +| [`plex`](plex/) | Media server | `32400` | `linuxserver/plex` | +| [`erugo`](erugo/) | File sharing | `61080` | `wardy784/erugo` | +| [`jswiki`](jswiki/) | Wiki | `9180` | `linuxserver/wikijs` | +| [`speedtest`](speedtest/) | Speedtest tracker | `8072` | `linuxserver/speedtest-tracker` | +| [`watchtower`](watchtower/) | Auto-update kontejnerů | – | `containrrr/watchtower` | + +## 🧱 Společné konvence + +Všechny compose soubory v tomto adresáři dodržují: + +- **Porty:** nikdy nepoužívat konfliktní porty s ostatními službami +- **Volume:** `./data:/data` (host container, snadná záloha) +- **Restart:** `unless-stopped` +- **Network:** výchozí `bridge`, případně vlastní `*-net` +- **User:** `1000:1000` pro souborový přístup +- **Logging:** `json-file` driver, max 10 MB × 3 soubory +- **TZ:** `Europe/Prague` +- **Environment:** `.env` soubor (šablona `.env.example` v gitu) + +## 🛡 Bezpečnost + +- ✅ **Žádná hesla v `docker-compose.yml`** – vše v `.env` (gitignored) +- ✅ **Restart policy** zamezí nechtěnému spuštění po rebootu +- ✅ **Networks** – izolované `bridge` pro každou službu +- ✅ **Read-only filesystémy** kde to jde (`/etc/timezone`, `/etc/localtime`) + +## 🗂 Struktura + +``` +docker-services/ +├── README.md # Tento soubor +├── portainer/ +│ ├── docker-compose.yml +│ ├── .env.example +│ └── README.md +├── nginx-proxy-manager/ +│ ├── docker-compose.yml +│ ├── .env.example +│ └── README.md +└── ... (další služby) +``` + +## 🔄 Aktualizace služeb + +```bash +# Pomocí Watchtower (auto-update) +docker compose pull && docker compose up -d + +# Nebo ručně +cd services/ +docker compose pull +docker compose up -d +``` + +## 📦 Zálohování + +Všechna data jsou v `./data/` uvnitř každé služby. Zálohuj celé adresáře: + +```bash +# Pomocí našeho nástroje z install-scripts/ +sudo bash install-scripts/backup-all.sh +``` diff --git a/docker-services/audiobookshelf/.env.example b/docker-services/audiobookshelf/.env.example new file mode 100644 index 0000000..20e30f0 --- /dev/null +++ b/docker-services/audiobookshelf/.env.example @@ -0,0 +1,4 @@ +# Audiobookshelf – proměnné +TZ=Europe/Prague +PUID=1000 +PGID=1000 diff --git a/docker-services/audiobookshelf/README.md b/docker-services/audiobookshelf/README.md new file mode 100644 index 0000000..96bcaa9 --- /dev/null +++ b/docker-services/audiobookshelf/README.md @@ -0,0 +1,57 @@ +# Audiobookshelf – audio knihovna + +> Self-hosted audio knihovna. Stream audioknih, podcastů. Sledování pokroku. + +## 📋 Přehled + +- **Image:** `advplyr/audiobookshelf:latest` +- **Port:** `13378` (web) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +docker compose up -d +``` + +## 🌐 Přístup + +- **Web:** `http://:13378` +- **Mobile app:** vyhledej "Audiobookshelf" v App Store/Google Play + +## 🎯 Funkce + +- **Audioknihy** – upload (mp3, m4b, m4a, flac, …) +- **Podcasty** – RSS subscribe +- **Progress tracking** – synchronizace mezi zařízeními +- **Multi-user** – každý má svou knihovnu +- **Transkripce** – vyhledávání v textu (s AI) +- **OPDS** – kompatibilní s jinými čtečkami + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/data` | Databáze, config, cache | +| `./audiobooks:/audiobooks` | Tvoje knihovna (readonly) | +| `./podcasts:/podcasts` | Auto-download podcasty | + +## 🔐 Bezpečnost + +- **2FA** – pro admin účet +- **HTTPS** – terminuj v NPM +- **Auth proxy** – integrovaný (OIDC) + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Dokumentace + +- [Audiobookshelf](https://www.audiobookshelf.org/) +- [GitHub](https://github.com/advplyr/audiobookshelf) diff --git a/docker-services/audiobookshelf/docker-compose.yml b/docker-services/audiobookshelf/docker-compose.yml new file mode 100644 index 0000000..094e83b --- /dev/null +++ b/docker-services/audiobookshelf/docker-compose.yml @@ -0,0 +1,29 @@ +# Audiobookshelf – audio knihovna + +services: + audiobookshelf: + image: advplyr/audiobookshelf:latest + container_name: audiobookshelf + restart: unless-stopped + ports: + - "13378:80" + volumes: + - ./data:/data + - ./audiobooks:/audiobooks + - ./podcasts:/podcasts + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + networks: + - audiobookshelf_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + audiobookshelf_net: + name: audiobookshelf_default + driver: bridge diff --git a/docker-services/calibre-web/.env.example b/docker-services/calibre-web/.env.example new file mode 100644 index 0000000..ab90ab6 --- /dev/null +++ b/docker-services/calibre-web/.env.example @@ -0,0 +1,4 @@ +# Calibre-Web – proměnné +TZ=Europe/Prague +PUID=1000 +PGID=1000 diff --git a/docker-services/calibre-web/README.md b/docker-services/calibre-web/README.md new file mode 100644 index 0000000..9c61b4d --- /dev/null +++ b/docker-services/calibre-web/README.md @@ -0,0 +1,53 @@ +# Calibre-Web – e-knihovna + +> Web čtečka e-knihoven. Calibre metadata, OPDS, Kindle send. + +## 📋 Přehled + +- **Image:** `linuxserver/calibre-web:latest` +- **Port:** `8083` (web) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +docker compose up -d +``` + +Pak v prohlížeči otevři `http://:8083` a dokonči setup (admin účet, cesta ke knihovně). + +## 🎯 Funkce + +- **Čtení online** – v prohlížeči, EPUB/PDF +- **Send to Kindle** – email na Kindle +- **OPDS** – kompatibilní s jinými čtečkami +- **Multi-user** – s admin/user oprávněními +- **Metadata** – z Goodreads, Google Books +- **Tagy, série, autoři** – plná Calibre metadata + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/config` | Calibre-Web konfigurace, DB | +| `./books:/books` | Tvoje knihovna (knihy) | + +## 🔐 Bezpečnost + +- **Admin heslo** – silné +- **HTTPS** – terminuj v NPM +- **Magic link** – email login (vyžaduje SMTP) + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Dokumentace + +- [Calibre-Web GitHub](https://github.com/janeczku/calibre-web) +- [LinuxServer.io](https://docs.linuxserver.io/images/docker-calibre-web) diff --git a/docker-services/calibre-web/docker-compose.yml b/docker-services/calibre-web/docker-compose.yml new file mode 100644 index 0000000..5107dfb --- /dev/null +++ b/docker-services/calibre-web/docker-compose.yml @@ -0,0 +1,30 @@ +# Calibre-Web – e-knihovna + +services: + calibre-web: + image: lscr.io/linuxserver/calibre-web:latest + container_name: calibre-web + restart: unless-stopped + ports: + - "8083:8083" + volumes: + - ./data:/config + - ./books:/books + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - DOCKER_MODS=linuxserver/mods:universal-calibre + - OAUTHLIB_RELAX_TOKEN_SCOPE=1 + networks: + - calibre-web_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + calibre-web_net: + name: calibre-web_default + driver: bridge diff --git a/docker-services/erugo/.env.example b/docker-services/erugo/.env.example new file mode 100644 index 0000000..28cc246 --- /dev/null +++ b/docker-services/erugo/.env.example @@ -0,0 +1,4 @@ +# Erugo – proměnné +TZ=Europe/Prague +PUID=1000 +PGID=1000 diff --git a/docker-services/erugo/README.md b/docker-services/erugo/README.md new file mode 100644 index 0000000..f22a05f --- /dev/null +++ b/docker-services/erugo/README.md @@ -0,0 +1,43 @@ +# Erugo – file sharing + +> Jednoduché sdílení souborů s heslem a expirací. + +## 📋 Přehled + +- **Image:** `wardy784/erugo:latest` +- **Port:** `61080` (web) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +docker compose up -d +``` + +## 🌐 Přístup + +- **Web:** `http://:61080` + +## 🎯 Funkce + +- **Upload** – drag & drop souborů +- **Heslo** – volitelné pro každý upload +- **Expirace** – automatické mazání po X dnech +- **Linky** – sdílitelné +- **API** – pro integraci + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/uploads` | Uložené soubory | +| `./db:/db` | SQLite databáze | + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` diff --git a/docker-services/erugo/docker-compose.yml b/docker-services/erugo/docker-compose.yml new file mode 100644 index 0000000..de351d0 --- /dev/null +++ b/docker-services/erugo/docker-compose.yml @@ -0,0 +1,28 @@ +# Erugo – file sharing + +services: + erugo: + image: wardy784/erugo:latest + container_name: erugo + restart: unless-stopped + ports: + - "61080:80" + volumes: + - ./data:/uploads + - ./db:/db + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + networks: + - erugo_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + erugo_net: + name: erugo_default + driver: bridge diff --git a/docker-services/gitea/.env.example b/docker-services/gitea/.env.example new file mode 100644 index 0000000..7e05c15 --- /dev/null +++ b/docker-services/gitea/.env.example @@ -0,0 +1,11 @@ +# Gitea – proměnné prostředí +USER_UID=1000 +USER_GID=1000 +TZ=Europe/Prague + +# Po prvním adminovi nastav na false +GITEA__service__DISABLE_REGISTRATION=false +GITEA__service__REQUIRE_SIGNIN_VIEW=false + +# HTTPS terminuje NPM, takže false +GITEA__session__COOKIE_SECURE=false diff --git a/docker-services/gitea/README.md b/docker-services/gitea/README.md new file mode 100644 index 0000000..e4ac383 --- /dev/null +++ b/docker-services/gitea/README.md @@ -0,0 +1,70 @@ +# Gitea – self-hosted Git + +> Lehký Git server (alternativa k GitLabu). Web UI, API, SSH. + +## 📋 Přehled + +- **Image:** `docker.gitea.com/gitea:1.27.1` +- **Porty:** `3000` (web), `222` (SSH) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env + +docker compose up -d +``` + +Po startu otevři `http://:3000/` a dokonči install wizard: + +1. **Database:** SQLite3 (default) +2. **Site Title:** libovolný +3. **Admin Username:** `admin` (nebo `mates`) +4. **Admin Password:** silné heslo +5. **Admin Email:** tvůj email +6. Ostatní default +7. **Install Gitea** + +## 🌐 Přístup + +- **Web:** `http://:3000` (za HTTPS terminuj v NPM) +- **SSH git push:** `ssh://git@:222//.git` +- **API:** `http://:3000/api/v1/` + +## 🔐 Bezpečnost + +- **Změň admin heslo** hned po instalaci +- **DISABLE_REGISTRATION=false** – po registraci prvního admina vypni +- **HTTPS** – terminuj v NPM a přesměruj HTTP→HTTPS +- **2FA** – aktivuj pro admin účet + +## 🔑 API Token + +Vytvoření tokenu pro skripty: + +1. User Settings → Applications +2. Název: `` +3. Scopes: `read:user`, `write:user`, `read:repository`, `write:repository` +4. **Token ulož do keychainu**, ne do chatu + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +# DB migrace probíhá automaticky +``` + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./gitea:/data` | Repozitáře, DB, konfigurace, hooks | + +## 📚 Dokumentace + +- [Gitea Docker install](https://docs.gitea.com/installation/install-with-docker/) +- [Gitea API](https://docs.gitea.com/api/) diff --git a/docker-services/gitea/docker-compose.yml b/docker-services/gitea/docker-compose.yml new file mode 100644 index 0000000..a206c70 --- /dev/null +++ b/docker-services/gitea/docker-compose.yml @@ -0,0 +1,39 @@ +# Gitea – self-hosted Git server + +services: + server: + image: docker.gitea.com/gitea:1.27.1 + container_name: gitea + environment: + - USER_UID=1000 + - USER_GID=1000 + - GITEA__webhook__SKIP_TLS_VERIFY=false + - GITEA__service__DISABLE_REGISTRATION=false + - GITEA__service__REQUIRE_SIGNIN_VIEW=false + - GITEA__session__COOKIE_SECURE=false + restart: unless-stopped + networks: + - gitea_net + volumes: + - ./gitea:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + ports: + - "3000:3000" + - "222:22" + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + gitea_net: + name: gitea_default + driver: bridge diff --git a/docker-services/jotty/.env.example b/docker-services/jotty/.env.example new file mode 100644 index 0000000..64d29ea --- /dev/null +++ b/docker-services/jotty/.env.example @@ -0,0 +1,4 @@ +# Jotty – proměnné prostředí +TZ=Europe/Prague +PUID=1000 +PGID=1000 diff --git a/docker-services/jotty/README.md b/docker-services/jotty/README.md new file mode 100644 index 0000000..28fabb2 --- /dev/null +++ b/docker-services/jotty/README.md @@ -0,0 +1,59 @@ +# Jotty – poznámky a checklisty + +> Self-hosted alternativa k Obsidian. Markdown poznámky, checklisty, kategorie. + +## 📋 Přehled + +- **Image:** `mrx23dotcom/jotty:latest` +- **Port:** `1122` (web) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env + +docker compose up -d +``` + +## 🌐 Přístup + +- **Web:** `http://:1122` (za HTTPS terminuj v NPM) +- **První registrace:** Setup wizard na hlavní stránce + +## 🎯 Použití + +- **Poznámky** – markdown, interní linky `@note-id`, tagy `#tag` +- **Checklisty** – task management +- **Kategorie** – organizace +- **TipTap editor** – WYSIWYG nebo markdown +- **API** – REST API s API klíčem pro integraci + +## 🔐 Bezpečnost + +- **API klíč** – generuj v Admin → API +- **2FA** – pro admin účet +- **HTTPS** – terminuj v NPM +- **Registry** – vypni po registraci + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +# Data zůstávají v ./data/notes/ +``` + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/app/data` | Poznámky, checklisty, databáze | +| `./config:/app/config` | Konfigurace, themes, custom emojis | + +## 📚 Dokumentace + +- [Jotty GitHub](https://github.com/mrx23dotcom/jotty) +- [Jotty API](https://github.com/mrx23dotcom/jotty/blob/main/howto/API.md) diff --git a/docker-services/jotty/docker-compose.yml b/docker-services/jotty/docker-compose.yml new file mode 100644 index 0000000..d6ad12c --- /dev/null +++ b/docker-services/jotty/docker-compose.yml @@ -0,0 +1,35 @@ +# Jotty – poznámky a checklisty + +services: + jotty: + image: mrx23dotcom/jotty:latest + container_name: jotty + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + restart: unless-stopped + networks: + - jotty_net + volumes: + - ./data:/app/data + - ./config:/app/config + - ./cache:/app/.next/cache + ports: + - "1122:3000" + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 60s + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + jotty_net: + name: jotty_default + driver: bridge diff --git a/docker-services/jswiki/.env.example b/docker-services/jswiki/.env.example new file mode 100644 index 0000000..1a8b709 --- /dev/null +++ b/docker-services/jswiki/.env.example @@ -0,0 +1,9 @@ +# Wiki.js – proměnné +TZ=Europe/Prague +PUID=1000 +PGID=1000 + +# MariaDB hesla (ZMĚŇ!) +MYSQL_ROOT_PASSWORD=change-me-strong +MYSQL_PASSWORD=change-me-strong +WIKIJS_DB_PASS=change-me-strong diff --git a/docker-services/jswiki/README.md b/docker-services/jswiki/README.md new file mode 100644 index 0000000..ec7e74d --- /dev/null +++ b/docker-services/jswiki/README.md @@ -0,0 +1,54 @@ +# Wiki.js – wiki + +> Nejvýkonnější open-source wiki. Markdown, WYSIWYG, DB, fulltext. + +## 📋 Přehled + +- **Image:** `linuxserver/wikijs:latest` +- **Port:** `9180` (web) +- **User:** `1000:1000` +- **DB:** PostgreSQL/SQLite (zde SQLite pro jednoduchost) +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +docker compose up -d +``` + +Pak `http://:9180` – setup wizard. + +## 🎯 Funkce + +- **Editor** – WYSIWYG (TinyMCE), Markdown, AsciiDoc +- **Verzování** – každá stránka má historii +- **Permissions** – skupiny, ACL +- **Search** – fulltext +- **Multi-language** +- **GraphQL API** – pro integrace + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/config` | Wiki.js data, DB, config | +| `./db:/db` | SQLite databáze | + +## 🔐 Bezpečnost + +- **Local auth** – nebo LDAP/OAuth +- **HTTPS** – terminuj v NPM +- **Rate limiting** – default zapnutý + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Dokumentace + +- [Wiki.js](https://wiki.js.org/) +- [GitHub](https://github.com/requarks/wiki) diff --git a/docker-services/jswiki/docker-compose.yml b/docker-services/jswiki/docker-compose.yml new file mode 100644 index 0000000..49e0279 --- /dev/null +++ b/docker-services/jswiki/docker-compose.yml @@ -0,0 +1,57 @@ +# Wiki.js + +services: + db: + image: linuxserver/mariadb:latest + container_name: jswiki_db + restart: unless-stopped + volumes: + - ./db:/config + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - MYSQL_ROOT_PASSWORD=CHANGE_ME_STRONG + - MYSQL_DATABASE=wiki + - MYSQL_USER=wiki + - MYSQL_PASSWORD=CHANGE_ME_STRONG + networks: + - jswiki_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + + wikijs: + image: lscr.io/linuxserver/wikijs:latest + container_name: wikijs + restart: unless-stopped + depends_on: + - db + ports: + - "9180:3000" + volumes: + - ./data:/config + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - WIKIJS_DB_TYPE=mariadb + - WIKIJS_DB_HOST=db + - WIKIJS_DB_PORT=3306 + - WIKIJS_DB_USER=wiki + - WIKIJS_DB_PASS=CHANGE_ME_STRONG + - WIKIJS_DB_NAME=wiki + networks: + - jswiki_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + jswiki_net: + name: jswiki_default + driver: bridge diff --git a/docker-services/nextcloud-aio/.env.example b/docker-services/nextcloud-aio/.env.example new file mode 100644 index 0000000..2f0f0d7 --- /dev/null +++ b/docker-services/nextcloud-aio/.env.example @@ -0,0 +1,19 @@ +# Nextcloud AIO – proměnné prostředí +TZ=Europe/Prague +PUID=1000 +PGID=1000 + +# Web port (default 11000) +APACHE_PORT=11000 + +# Data na hostu (NE containeru) +NEXTCLOUD_DATADIR=/mnt/data + +# Extra balíky (ImageMagick pro OCR, atd.) +NEXTCLOUD_ADDITIONAL_APKS=imagemagick + +# Upload limit +NEXTCLOUD_UPLOAD_LIMIT=10G + +# Důvěryhodné certifikáty (firemní CA, Cloudflare Origin) +# NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates diff --git a/docker-services/nextcloud-aio/README.md b/docker-services/nextcloud-aio/README.md new file mode 100644 index 0000000..0ba02bb --- /dev/null +++ b/docker-services/nextcloud-aio/README.md @@ -0,0 +1,64 @@ +# Nextcloud AIO – vše v jednom + +> All-in-One Nextcloud: soubory, kalendář, kontakty, fotky, videohovory. + +## 📋 Přehled + +- **Image:** `nextcloud/all-in-one:latest` +- **Porty:** `11000` (admin), další interně +- **User:** `1000:1000` +- **Network:** `bridge` + `nextcloud-aio` (interní) + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env # nastavit APACHE_PORT, NEXTCLOUD_DATADIR, NEXTCLOUD_ADDITIONAL_APKS + +docker compose up -d +``` + +Pak otevři `http://:11000/` a dokonči instalaci. + +## 🌐 Přístup + +- **Admin:** `http://:11000` +- **Nextcloud:** `http://:11000` (nebo za reverse proxy) +- **Doporučení:** terminuj HTTPS přes NPM + +## 🔧 Pokročilé nastavení + +- **Cloudflare Tunnel** – pro vzdálený přístup bez veřejné IP +- **Talk (videohovory)** – v AIO default +- **Imaginary (AI)** – rozpoznávání obrázků +- **Fulltextsearch** – indexování souborů +- **Whiteboard** – collaborative kreslení +- **Borg backup** – integrované zálohování + +## 🔐 Bezpečnost + +- **HTTPS terminuj v NPM** (Let's Encrypt) +- **2FA** – povinně pro admin +- **Brute force protection** – default zapnutý +- **Trusted domains** – nastav `NEXTCLOUD_TRUSTED_DOMAINS` +- **Backup** – AIO Borg nebo externí rsync + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +# AIO auto-updates Nextcloud a všechny sub-containery +``` + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./nextcloud_aio_mastercontainer:/mnt/docker-aio-config` | AIO master data | +| `./data:/mnt/data` | Nextcloud data (files, DB) | + +## 📚 Dokumentace + +- [Nextcloud AIO](https://github.com/nextcloud/all-in-one) +- [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/) diff --git a/docker-services/nextcloud-aio/docker-compose.yml b/docker-services/nextcloud-aio/docker-compose.yml new file mode 100644 index 0000000..53d0afb --- /dev/null +++ b/docker-services/nextcloud-aio/docker-compose.yml @@ -0,0 +1,40 @@ +# Nextcloud All-in-One + +services: + nextcloud-aio-mastercontainer: + image: nextcloud/all-in-one:latest + container_name: nextcloud-aio-mastercontainer + restart: unless-stopped + init: true + ports: + - "11000:8080" + volumes: + - ./nextcloud_aio_mastercontainer:/mnt/docker-aio-config + - ./data:/mnt/data + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - APACHE_PORT=11000 + - NEXTCLOUD_DATADIR=/mnt/data + - NEXTCLOUD_ADDITIONAL_APKS=imagemagick + - NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates + - NEXTCLOUD_UPLOAD_LIMIT=10G + networks: + - nextcloud_net + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8080"] + interval: 60s + timeout: 10s + retries: 5 + start_period: 120s + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + nextcloud_net: + name: nextcloud_default + driver: bridge diff --git a/docker-services/nginx-proxy-manager/.env.example b/docker-services/nginx-proxy-manager/.env.example new file mode 100644 index 0000000..3e7a3a2 --- /dev/null +++ b/docker-services/nginx-proxy-manager/.env.example @@ -0,0 +1,8 @@ +# NPM – proměnné prostředí +TZ=Europe/Prague +PUID=1000 +PGID=1000 +DISABLE_IPV6=true + +# MariaDB heslo pro NPM backend (ZMĚŇ!) +MYSQL_ROOT_PASSWORD=change-me-strong-password diff --git a/docker-services/nginx-proxy-manager/README.md b/docker-services/nginx-proxy-manager/README.md new file mode 100644 index 0000000..c5ff8c6 --- /dev/null +++ b/docker-services/nginx-proxy-manager/README.md @@ -0,0 +1,62 @@ +# Nginx Proxy Manager + +> Reverzní proxy s HTTPS (Let's Encrypt), web UI, ACL. + +## 📋 Přehled + +- **Image:** `jc21/nginx-proxy-manager:latest` +- **Porty:** `80`, `443`, `81` (admin UI) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env + +docker compose up -d +``` + +## 🌐 Přístup + +- **Admin UI:** `http://:81` (default `admin@example.com` / `changeme`) +- **Změň heslo hned po prvním přihlášení!** + +## 🔒 HTTPS + +NPM umí automaticky generovat Let's Encrypt certifikáty: + +1. **DNS A záznam** domény → server IP +2. NPM UI → Proxy Hosts → Add Proxy Host +3. Domain Names: `service.example.com` +4. Scheme: `http`, Forward: `:PORT` +5. Záložka **SSL:** Request SSL Certificate, Let's Encrypt +6. Force SSL, HTTP/2, HSTS – vše zapnout + +## 🔧 Pokročilé + +- **Cloudflare DNS-01 challenge** – pro wildcard certifikáty +- **Access Lists** – whitelist IP pro citlivé služby +- **Redirection** – 301/302 přesměrování +- **Streams** – TCP/UDP proxy (SSH, databáze) + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/data` | NPM data, certifikáty, konfigurace | +| `./letsencrypt:/etc/letsencrypt` | Let's Encrypt certifikáty | + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +# Certifikáty zůstávají v ./letsencrypt/ +``` + +## 📚 Dokumentace + +- [NPM oficiální dokumentace](https://nginxproxymanager.com/docs/) +- [Let's Encrypt s NPM](https://nginxproxymanager.com/advanced-config/#ssl-certificates) diff --git a/docker-services/nginx-proxy-manager/docker-compose.yml b/docker-services/nginx-proxy-manager/docker-compose.yml new file mode 100644 index 0000000..a4fe380 --- /dev/null +++ b/docker-services/nginx-proxy-manager/docker-compose.yml @@ -0,0 +1,57 @@ +# Nginx Proxy Manager + +services: + nginx-proxy-manager: + image: jc21/nginx-proxy-manager:latest + container_name: nginx-proxy-manager + restart: unless-stopped + ports: + - "80:80" + - "443:443" + - "81:81" + volumes: + - ./data:/data + - ./letsencrypt:/etc/letsencrypt + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - DISABLE_IPV6=true + networks: + - npm_net + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:81"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + + # NPM vyžaduje vlastní MariaDB backend + db: + image: jc21/mariadb-aria:latest + container_name: npm_db + restart: unless-stopped + volumes: + - ./mysql:/var/lib/mysql + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - MYSQL_ROOT_PASSWORD=CHANGE_ME + networks: + - npm_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + npm_net: + name: nginx_proxy_manager_default + driver: bridge diff --git a/docker-services/plex/.env.example b/docker-services/plex/.env.example new file mode 100644 index 0000000..322e31c --- /dev/null +++ b/docker-services/plex/.env.example @@ -0,0 +1,8 @@ +# Plex – proměnné +TZ=Europe/Prague +PUID=1000 +PGID=1000 + +# HW akcelerace (vyber podle sveho GPU) +# NVIDIA_VISIBLE_DEVICES=all +# INTEL_VISIBLE_DEVICES=true diff --git a/docker-services/plex/README.md b/docker-services/plex/README.md new file mode 100644 index 0000000..3aa9499 --- /dev/null +++ b/docker-services/plex/README.md @@ -0,0 +1,58 @@ +# Plex – media server + +> Stream filmů, seriálů, hudby, fotek. HW transkódování. + +## 📋 Přehled + +- **Image:** `linuxserver/plex:latest` +- **Porty:** `32400` (web), `1900` (DLNA), `5353` (Bonjour), `8324` (plex.tv) +- **User:** `1000:1000` +- **Network:** `host` (doporučeno) – kvůli HW transkódování + +## 🚀 Instalace + +```bash +cp .env.example .env +docker compose up -d +``` + +Pak `http://:32400/web` – setup wizard. + +## 🎯 Funkce + +- **Hardware transkódování** – Intel/AMD/NVIDIA GPU akcelerace +- **Plex Pass** – Live TV, DVR, HW encoding (placené) +- **Mobile app** – iOS/Android/Apple TV +- **Plex.tv** – vzdálený přístup +- **Share** – s přáteli + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/config` | Plex konfigurace, DB | +| `./media:/media` | Tvoje knihovna (filmy, seriály, hudba) | + +## 🔧 HW transkódování + +V `.env` nastavit: +- `NVIDIA_VISIBLE_DEVICES=all` – pro NVIDIA +- `INTEL_VISIBLE_DEVICES=true` – pro Intel QuickSync + +## 🔐 Bezpečnost + +- **HTTPS** – terminuj v NPM +- **Plex.tv účet** – nepoužívej guest účet +- **Network discovery** – vypni pokud nepotřebuješ + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Dokumentace + +- [Plex Support](https://support.plex.tv/) +- [Plex Media Server](https://www.plex.tv/media-server-downloads/) diff --git a/docker-services/plex/docker-compose.yml b/docker-services/plex/docker-compose.yml new file mode 100644 index 0000000..f317533 --- /dev/null +++ b/docker-services/plex/docker-compose.yml @@ -0,0 +1,22 @@ +# Plex Media Server + +services: + plex: + image: lscr.io/linuxserver/plex:latest + container_name: plex + restart: unless-stopped + network_mode: host # Pro HW transkódování a DLNA + volumes: + - ./data:/config + - ./media:/media + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - VERSION=docker + - NVIDIA_VISIBLE_DEVICES=all + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" diff --git a/docker-services/portainer/.env.example b/docker-services/portainer/.env.example new file mode 100644 index 0000000..fe9adec --- /dev/null +++ b/docker-services/portainer/.env.example @@ -0,0 +1,9 @@ +# Portainer CE – proměnné prostředí +# Zkopíruj tento soubor na .env a doplň skutečné hodnoty + +# Timezone +TZ=Europe/Prague + +# UID/GID pro file ownership +PUID=1000 +PGID=1000 diff --git a/docker-services/portainer/README.md b/docker-services/portainer/README.md new file mode 100644 index 0000000..6fa7363 --- /dev/null +++ b/docker-services/portainer/README.md @@ -0,0 +1,67 @@ +# Portainer – Docker UI management + +> Webové UI pro správu Dockeru (kontejnery, image, sítě, volumes, swarm, kubernetes). + +## 📋 Přehled + +- **Image:** `portainer/portainer-ce:latest` +- **Porty:** `9000` (HTTP), `9443` (HTTPS) +- **User:** `1000:1000` +- **Network:** `bridge` (default) + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env # nastavit SECRET, PUID, PGID + +docker compose up -d +``` + +## 🌐 Přístup + +- **HTTP:** `http://:9000` +- **HTTPS:** `https://:9443` (self-signed, akceptuj varování) + +**První přihlášení:** +1. Vytvoř admin účet (zobrazí se při prvním přístupu) +2. Připoj se k lokálnímu Docker endpointu +3. Spravuj kontejnery přes web UI + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/data` | Portainer data (DB, certifikáty, zálohy) | +| `/var/run/docker.sock:/var/run/docker.sock` | Přístup k Docker daemonu | + +## 🔐 Bezpečnost + +- **Heslo pro admin:** silné, 12+ znaků +- **HTTPS:** nastavit v Settings → SSL (nebo terminovat v NPM) +- **2FA:** aktivovat pro admin účet v Settings → Users +- **Dostupnost:** portainer nemá remote auth → zařadit za reverse proxy + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Další informace + +- [Oficiální dokumentace](https://docs.portainer.io/) +- [Portainer CE vs Business](https://www.portainer.io/pricing) + +## 🛠 Troubleshooting + +**Portainer se nemůže připojit k Dockeru:** +- Zkontroluj `/var/run/docker.sock` oprávnění +- Portainer musí mít stejný UID jako docker socket (typicky root, ale v CE to funguje) + +**Zapomenuté heslo:** +```bash +docker exec -u root portainer /bin/sh +# Pak resetuj v DB (složitější, doporučuji reinstalaci) +``` diff --git a/docker-services/portainer/docker-compose.yml b/docker-services/portainer/docker-compose.yml new file mode 100644 index 0000000..21c3993 --- /dev/null +++ b/docker-services/portainer/docker-compose.yml @@ -0,0 +1,35 @@ +# Portainer Community Edition + +services: + portainer: + image: portainer/portainer-ce:latest + container_name: portainer + restart: unless-stopped + ports: + - "9000:9000" + - "9443:9443" + volumes: + - ./data:/data + - /var/run/docker.sock:/var/run/docker.sock + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + networks: + - portainer_net + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:9000/api/status"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + portainer_net: + name: portainer_default + driver: bridge diff --git a/docker-services/rustdesk/.env.example b/docker-services/rustdesk/.env.example new file mode 100644 index 0000000..e8bfe6e --- /dev/null +++ b/docker-services/rustdesk/.env.example @@ -0,0 +1,7 @@ +# RustDesk – proměnné prostředí +TZ=Europe/Prague +PUID=1000 +PGID=1000 + +# Poznámka: Po prvním spuštění si ulož veřejný klíč z logu hbbs +# Použije se v RustDesk klientovi (Preferences → Network → Key Server) diff --git a/docker-services/rustdesk/README.md b/docker-services/rustdesk/README.md new file mode 100644 index 0000000..5d867eb --- /dev/null +++ b/docker-services/rustdesk/README.md @@ -0,0 +1,53 @@ +# RustDesk Server – remote desktop + +> Vlastní relay server pro RustDesk. Bez závislosti na veřejném RustDesk serveru. + +## 📋 Přehled + +- **Image:** `rustdesk/rustdesk-server:latest` +- **Porty:** `21115-21119` (TCP+UDP), `21116` (WebSocket) +- **User:** `1000:1000` +- **Network:** `host` (lepší pro P2P) + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env + +docker compose up -d +``` + +## 🌐 Konfigurace klienta + +V RustDesk klientovi (Preferences → Network): + +- **ID Server:** `:21116` +- **Key Server:** `:21116` +- **Relay Server:** `:21117` + +**Veřejný klíč** získáš z logu kontejneru `hbbs` (první spuštění). + +## 🔐 Bezpečnost + +- **Firewall:** otevři jen potřebné porty +- **HTTPS** – na relay lze nastavit terminaci +- **WebSocket** – `ws://` nebo `wss://` (doporučeno za HTTPS) + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/root` | Databáze, klíče, data | + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Dokumentace + +- [RustDesk Server](https://rustdesk.com/docs/en/self-host/) +- [Docker compose](https://rustdesk.com/docs/en/self-host/rustdesk-server-oss/docker/) diff --git a/docker-services/rustdesk/docker-compose.yml b/docker-services/rustdesk/docker-compose.yml new file mode 100644 index 0000000..0957225 --- /dev/null +++ b/docker-services/rustdesk/docker-compose.yml @@ -0,0 +1,53 @@ +# RustDesk Server – vlastní relay + +services: + hbbs: + image: rustdesk/rustdesk-server:latest + container_name: hbbs + command: hbbs + restart: unless-stopped + volumes: + - ./data:/root + ports: + - "21115:21115" + - "21116:21116" + - "21116:21116/udp" + - "21118:21118" + networks: + - rustdesk_net + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + + hbbr: + image: rustdesk/rustdesk-server:latest + container_name: hbbr + command: hbbr + restart: unless-stopped + volumes: + - ./data:/root + ports: + - "21117:21117" + - "21119:21119" + networks: + - rustdesk_net + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + rustdesk_net: + name: rustdesk_default + driver: bridge diff --git a/docker-services/speedtest/.env.example b/docker-services/speedtest/.env.example new file mode 100644 index 0000000..3248209 --- /dev/null +++ b/docker-services/speedtest/.env.example @@ -0,0 +1,10 @@ +# Speedtest Tracker – proměnné +TZ=Europe/Prague +PUID=1000 +PGID=1000 + +# APP_KEY: 32+ znaků – vygeneruj: openssl rand -base64 32 +APP_KEY=change-me-32-char-base64-key + +# URL kde běží Speedtest Tracker +APP_URL=http://CHANGE_ME:8765 diff --git a/docker-services/speedtest/README.md b/docker-services/speedtest/README.md new file mode 100644 index 0000000..7a951c7 --- /dev/null +++ b/docker-services/speedtest/README.md @@ -0,0 +1,51 @@ +# Speedtest Tracker – rychlost internetu + +> Sledování rychlosti internetu v čase. Grafy, alerty, statistiky. + +## 📋 Přehled + +- **Image:** `linuxserver/speedtest-tracker:latest` +- **Porty:** `8765` (web), `8443` (HTTPS) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +docker compose up -d +``` + +## 🌐 Přístup + +- **Web:** `http://:8765` + +## 🎯 Funkce + +- **Automatický speedtest** – každých X minut +- **Grafy** – rychlost stahování, odesílání, ping +- **Alert** – notifikace když rychlost klesne +- **Multi-server** – sleduj víc linek + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/config` | Speedtest Tracker data | + +## 🔧 Pokročilé + +- **Ookla CLI** – integrovaný +- **Cloudflare** – speedtest.cloudflare.com +- **Notifikace** – email, Telegram, Discord, Slack + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +``` + +## 📚 Dokumentace + +- [Speedtest Tracker](https://docs.speedtest-tracker.dev/) diff --git a/docker-services/speedtest/docker-compose.yml b/docker-services/speedtest/docker-compose.yml new file mode 100644 index 0000000..854e1c5 --- /dev/null +++ b/docker-services/speedtest/docker-compose.yml @@ -0,0 +1,30 @@ +# Speedtest Tracker + +services: + speedtest: + image: lscr.io/linuxserver/speedtest-tracker:latest + container_name: speedtest + restart: unless-stopped + ports: + - "8765:80" + - "8443:443" + volumes: + - ./data:/config + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - APP_KEY=CHANGE_ME_32_CHAR_KEY + - APP_URL=http://CHANGE_ME:8765 + networks: + - speedtest_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + speedtest_net: + name: speedtest_default + driver: bridge diff --git a/docker-services/vaultwarden/.env.example b/docker-services/vaultwarden/.env.example new file mode 100644 index 0000000..4b9cb6f --- /dev/null +++ b/docker-services/vaultwarden/.env.example @@ -0,0 +1,15 @@ +# Vaultwarden – proměnné prostředí +TZ=Europe/Prague +PUID=1000 +PGID=1000 + +# URL přes kterou bude Vaultwarden dostupný (musí být https://) +DOMAIN=https://vault.example.com + +# Po prvním přihlášení admin účtu nastavte na false +SIGNUPS_ALLOWED=true +INVITATIONS_ALLOWED=false + +# Bezpečnost +SHOW_PASSWORD_HINT=false +LOG_LEVEL=warn diff --git a/docker-services/vaultwarden/README.md b/docker-services/vaultwarden/README.md new file mode 100644 index 0000000..3bd3693 --- /dev/null +++ b/docker-services/vaultwarden/README.md @@ -0,0 +1,79 @@ +# Vaultwarden – self-hosted správce hesel + +> Kompatibilní s Bitwarden klienty. Open-source, lehký (Rust). + +## 📋 Přehled + +- **Image:** `vaultwarden/server:latest` +- **Porty:** `2999` (HTTP), `3012` (WebSocket, interní) +- **User:** `1000:1000` +- **Network:** `bridge` + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env # nastavit DOMAIN, ROCKET_PORT, hesla + +docker compose up -d +``` + +## 🌐 Přístup + +- **Web vault:** `http://:2999` (za HTTPS terminuj v NPM) +- **Bitwarden app:** stejná URL jako vault +- **Doporučení:** terminuj HTTPS přes NPM a nepoužívej HTTP přímo + +## 🔐 Bezpečnost + +- **DOMAIN** musí být `https://vault.example.com` (ne `http`) +- **SIGNUPS_ALLOWED=false** po registraci admin účtu +- **INVITATIONS_ALLOWED=false** pokud nechceš zvát další +- **SHOW_PASSWORD_HINT=false** (odhalování hesel) +- **DATABASE_URL** – zálohuj SQLite pravidelně + +## 🔑 Záloha + +```bash +# Zastavit kontejner +docker compose stop + +# Zazálohovat SQLite DB +cp ./data/db.sqlite3 /backup/vaultwarden-$(date +%Y%m%d).sqlite3 + +# Restart +docker compose start +``` + +## 👥 Organizace + +- **1 user** (ty) – self-hosted +- **2FA** – povinně aktivuj po registraci +- **FIDO2/WebAuthn** – podpora hardwarových klíčů (YubiKey) +- **Organizace** – pro sdílení hesel s rodinou + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `./data:/data` | SQLite DB, attachmenty, ikony, config | + +## 📚 Klienti + +- **Mobil:** Bitwarden (iOS/Android) +- **Desktop:** Bitwarden (Win/Mac/Linux) +- **Browser:** Bitwarden extension (Chrome/Firefox/Edge) +- **CLI:** `rbw` (Rust) nebo `bitwarden-cli` + +## 🔄 Aktualizace + +```bash +docker compose pull +docker compose up -d +# DB migrace probíhá automaticky +``` + +## 📚 Dokumentace + +- [Vaultwarden Wiki](https://github.com/dani-garcia/vaultwarden/wiki) +- [Bitwarden klienti](https://bitwarden.com/download/) diff --git a/docker-services/vaultwarden/docker-compose.yml b/docker-services/vaultwarden/docker-compose.yml new file mode 100644 index 0000000..17e8fcb --- /dev/null +++ b/docker-services/vaultwarden/docker-compose.yml @@ -0,0 +1,41 @@ +# Vaultwarden – kompatibilní Bitwarden server + +services: + vaultwarden: + image: vaultwarden/server:latest + container_name: vaultwarden + restart: unless-stopped + ports: + - "2999:80" + volumes: + - ./data:/data + environment: + - PUID=1000 + - PGID=1000 + - TZ=Europe/Prague + - DOMAIN=https://CHANGE_ME + - ROCKET_PORT=80 + - SIGNUPS_ALLOWED=true + - INVITATIONS_ALLOWED=false + - SHOW_PASSWORD_HINT=false + - LOG_LEVEL=warn + - EXTENDED_LOGGING=true + - RUST_BACKTRACE=1 + networks: + - vaultwarden_net + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:80/alive"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + vaultwarden_net: + name: vaultwarden_default + driver: bridge diff --git a/docker-services/watchtower/.env.example b/docker-services/watchtower/.env.example new file mode 100644 index 0000000..0e394ef --- /dev/null +++ b/docker-services/watchtower/.env.example @@ -0,0 +1,22 @@ +# Watchtower – proměnné +TZ=Europe/Prague + +# Mód: true = jen upozorni, false = auto-aktualizuje +WATCHTOWER_MONITOR_ONLY=true + +# Mazat stare image po update +WATCHTOWER_CLEANUP=true + +# Cron schedule (default: kazdou nedeli ve 4:00) +WATCHTOWER_SCHEDULE=0 0 4 ? * SUN + +# Email notifikace +WATCHTOWER_NOTIFICATIONS=email +WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com +WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com +WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com +WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 +WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com +WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=change-me + +# Poznámka: V praxi nastav SMTP podle sveho providera diff --git a/docker-services/watchtower/README.md b/docker-services/watchtower/README.md new file mode 100644 index 0000000..2de6e1f --- /dev/null +++ b/docker-services/watchtower/README.md @@ -0,0 +1,61 @@ +# Watchtower – automatické aktualizace + +> Sleduje nové verze Docker image a automaticky restartuje kontejnery. + +## 📋 Přehled + +- **Image:** `containrrr/watchtower:latest` +- **Network:** `bridge` (musí mít přístup k Docker socketu) +- **Mód:** monitor-only (default) – jen upozorňuje, NEaktualizuje + +## 🚀 Instalace + +```bash +cp .env.example .env +nano .env # nastavit WATCHTOWER_MONITOR_ONLY podle potřeby + +docker compose up -d +``` + +## 🎯 Módy + +- **Monitor only** (default) – posílá email/notifikaci, NEaktualizuje +- **Auto update** – stáhne nový image, restartuje kontejner + +## 📧 Notifikace (email) + +```env +WATCHTOWER_NOTIFICATIONS=email +WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com +WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com +WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com +WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 +WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com +WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME +``` + +## 🔧 Pokročilé + +- **Schedule** – cron-like: `0 0 4 ? * SUN` (každou neděli v 4:00) +- **Cleanup** – smaže staré image (`WATCHTOWER_CLEANUP=true`) +- **Notifications** – shoutrrr (Telegram, Discord, Slack, …) + +## 📁 Volumes + +| Mount | Účel | +|---|---| +| `/var/run/docker.sock:/var/run/docker.sock` | Přístup k Docker daemonu | + +## 🔐 Bezpečnost + +- **Doporučeno:** monitor-only s email notifikací +- **Auto-update** riskantní – může rozbít službu +- **Manuální update:** `docker compose pull && docker compose up -d` + +## 🔄 Restart + +Watchtower se automaticky restartuje. **Nemusíte na něj sahat.** + +## 📚 Dokumentace + +- [Watchtower GitHub](https://github.com/containrrr/watchtower) diff --git a/docker-services/watchtower/docker-compose.yml b/docker-services/watchtower/docker-compose.yml new file mode 100644 index 0000000..5659cb2 --- /dev/null +++ b/docker-services/watchtower/docker-compose.yml @@ -0,0 +1,34 @@ +# Watchtower – monitor + auto-update + +services: + watchtower: + image: containrrr/watchtower:latest + container_name: watchtower + restart: unless-stopped + volumes: + - /var/run/docker.sock:/var/run/docker.sock + environment: + - TZ=Europe/Prague + - WATCHTOWER_MONITOR_ONLY=true + - WATCHTOWER_CLEANUP=true + - WATCHTOWER_SCHEDULE=0 0 4 ? * SUN + - WATCHTOWER_NOTIFICATIONS=email + - WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com + - WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com + - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com + - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587 + - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com + - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME + - WATCHTOWER_NOTIFICATION_EMAIL_SUBJECTTAG=Watchtower + networks: + - watchtower_net + logging: + driver: json-file + options: + max-size: "10m" + max-file: "3" + +networks: + watchtower_net: + name: watchtower_default + driver: bridge diff --git a/docs/architecture.md b/docs/architecture.md new file mode 100644 index 0000000..c105531 --- /dev/null +++ b/docs/architecture.md @@ -0,0 +1,162 @@ +# 🏛 Architecture + +> Jak je celá home infrastruktura poskládaná. + +## 🎯 Přehled + +Home lab běží na jednom fyzickém serveru (Ubuntu 22.04/24.04 LTS) s Docker. +Všechny služby jsou **containerizované**, za **Nginx Proxy Manager** (reverse proxy + HTTPS). + +## 🌐 Vrstvy + +``` +┌─────────────────────────────────────────────────────────────┐ +│ Layer 7: Aplikační služby │ +│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ +│ │Nextcloud │ │Vaultwarden│ │ Gitea │ │ Jotty │ │ +│ │ :11000 │ │ :2999 │ │ :3000/222│ │ :1122 │ │ +│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │ +│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ +│ │ Portainer│ │ Plex │ │Audiobook-│ │ Calibre │ │ +│ │ :9000 │ │ :32400 │ │shelf:13378│ │-Web:8083 │ │ +│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │ +│ ... dalších 7 služeb (rustdesk, wikijs, speedtest, ...) │ +└─────────────────────────────────────────────────────────────┘ + ▲ + │ HTTPS +┌─────────────────────────────────────────────────────────────┐ +│ Layer 4-7: Reverzní proxy + Let's Encrypt │ +│ ┌──────────────────────────────────────────────────┐ │ +│ │ Nginx Proxy Manager (:80, :443) │ │ +│ │ - SSL terminace (Let's Encrypt) │ │ +│ │ - HTTP → HTTPS redirect │ │ +│ │ - Access Lists │ │ +│ │ - Load balancing (volitelně) │ │ +│ └──────────────────────────────────────────────────┘ │ +└─────────────────────────────────────────────────────────────┘ + ▲ + │ HTTP +┌─────────────────────────────────────────────────────────────┐ +│ Layer 2-3: Docker bridge networks │ +│ Každá služba má vlastní bridge: │ +│ portainer_default, vaultwarden_default, gitea_default, ... │ +│ Izolace: služby mezi sebou nekomunikují (default) │ +│ Komunikace: přes reverzní proxy (NPM) │ +└─────────────────────────────────────────────────────────────┘ + ▲ + │ Docker API +┌─────────────────────────────────────────────────────────────┐ +│ Layer 1: Fyzický server │ +│ ┌──────────────────────────────────────────────────┐ │ +│ │ Ubuntu 22.04/24.04 LTS │ │ +│ │ - Docker CE 29.x │ │ +│ │ - Portainer CE (UI pro Docker) │ │ +│ │ - Watchtower (auto-update monitoring) │ │ +│ │ - deploy user (UID 1000) │ │ +│ │ - UFW firewall + fail2ban │ │ +│ │ - SSH hardening │ │ +│ └──────────────────────────────────────────────────┘ │ +└─────────────────────────────────────────────────────────────┘ +``` + +## 🔌 Služby (detail) + +| Služba | Port | Databáze | Volume | Backup | +|---|---|---|---|---| +| Portainer | 9000, 9443 | SQLite (interní) | `./data` | rsync | +| Nginx Proxy Manager | 80, 443, 81 | MariaDB | `./data`, `./letsencrypt` | rsync | +| Vaultwarden | 2999 | SQLite | `./data` | rsync (kritické!) | +| Nextcloud AIO | 11000 | MariaDB | `./data` | AIO Borg | +| Gitea | 3000, 222 | SQLite | `./gitea` | rsync | +| Jotty | 1122 | SQLite | `./data` | rsync | +| RustDesk | 21115-21119 | SQLite | `./data` | rsync | +| Audiobookshelf | 13378 | SQLite | `./data` + `./audiobooks` | rsync | +| Calibre-Web | 8083 | SQLite | `./data` + `./books` | rsync | +| Plex | 32400 | SQLite | `./data` + `./media` | rsync | +| Erugo | 61080 | SQLite | `./data` | rsync | +| Wiki.js | 9180 | MariaDB | `./data` | rsync | +| Speedtest | 8765 | SQLite | `./data` | rsync | +| Watchtower | – | – | – | – | + +## 💾 Zálohovací schéma + +``` +┌────────────┐ +│ Server │ rsync (denně, 03:00) → NAS /Volumes/Backups +│ /home/.../│ +└────────────┘ + │ + ▼ +┌────────────┐ +│ NAS │ Off-site sync (Backblaze B2, týdně) +│ /Backups/ │ +└────────────┘ +``` + +Viz `install-scripts/backup-all.sh` a `install-scripts/restore-all.sh`. + +## 🔐 Bezpečnost + +### Perimetrie +- **UFW** – default deny, povoleno: SSH, HTTP, HTTPS +- **fail2ban** – ban po 3 neúspěšných SSH pokusech +- **Cloudflare Tunnel** (volitelně) – přístup zvenčí bez veřejné IP + +### Auth +- **SSH klíče** – hesla zakázána (`PasswordAuthentication no`) +- **2FA** – na všech web službách (Gitea, Vaultwarden, Nextcloud, …) +- **Vaultwarden** – single source of truth pro hesla + +### Network +- **Bridge isolation** – služby spolu nekomunikují (default) +- **No host network** – kromě Plex (HW transkódování) +- **DNS-over-HTTPS** (volitelně) + +## 🔄 Deployment workflow + +``` +Developer + │ + ├─→ git push (do Gitea) + │ + ├─→ Ansible (na server) + │ │ + │ └─→ docker compose pull && up -d + │ + └─→ Watchtower (auto, týdně) + └─→ image: pull, container: restart +``` + +Viz `ansible/playbooks/`. + +## 📊 Monitoring + +- **Watchtower** – Docker image notifikace (email/Telegram) +- **Speedtest Tracker** – internet speed +- **Nextcloud Talk** – interní chat +- **Portainer** – Docker container status + +## 🛠 Maintenance + +| Úkol | Jak často | Skript/Ansible | +|---|---|---| +| Backup | Denně 03:00 | `backup-all.sh` (cron) | +| Update OS | Týdně | `apt update && apt upgrade` | +| Update Docker image | Týdně (auto) | Watchtower | +| Cert renewal | Auto (Let's Encrypt 30d) | NPM interní | +| Health check | Denně | `docker ps` + alerting | + +## 🔮 Roadmap + +- **Kubernetes** – přechod z docker compose na k3s (1 server node, multi-workload) +- **GitOps** – ArgoCD pro plnou automatizaci +- **CI/CD** – Gitea Actions pro testování Ansible playbooks +- **Off-site backup** – Backblaze B2 s encryption +- **Monitoring stack** – Prometheus + Grafana + Loki + +## 📚 Reference + +- [Docker docs](https://docs.docker.com/) +- [Nginx Proxy Manager](https://nginxproxymanager.com/) +- [Ansible best practices](https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html) +- [12-factor app](https://12factor.net/) diff --git a/docs/contributing.md b/docs/contributing.md new file mode 100644 index 0000000..c3ddf71 --- /dev/null +++ b/docs/contributing.md @@ -0,0 +1,116 @@ +# 🤝 Contributing + +> Jak přispívat do tohoto repozitáře. + +## 📝 Pravidla + +### Commit messages + +Používej **Conventional Commits**: + +- `feat:` – nová služba nebo funkce +- `fix:` – oprava chyby +- `docs:` – pouze dokumentace +- `chore:` – údržba, refactoring +- `style:` – formatting, bez funkční změny +- `refactor:` – přestavba kódu +- `test:` – přidání testů + +Příklad: `feat(vaultwarden): přidat 2FA podporu` + +### Branch naming + +- `feature/` – nová feature +- `fix/` – bugfix +- `docs/` – dokumentace + +Příklad: `feature/audiobookshelf-metadata` + +### Pull Request + +1. Fork → branch → commit → push → PR +2. **Titulek PR** – krátký, výstižný +3. **Popis** – co, proč, jak +4. **Screenshoty** – pokud měníš UI/dokumentaci +5. **Testy** – pokud měníš Ansible playbooks + +## 🏗 Struktura + +``` +repo/ +├── docker-services/ # Každá služba v samostatném adresáři +├── install-scripts/ # Bash skripty pro nové servery +├── ansible/ # Playbooky + role +├── hermes-install/ # Hermes CLI setup +├── macos-setup/ # Homebrew + macOS defaults +├── home-nas-tools/ # Metadata (žádné binárky!) +└── docs/ # Architektura, bezpečnost +``` + +## ✅ Checklist pro novou službu + +- [ ] `docker-services//docker-compose.yml` – generický, placeholders +- [ ] `docker-services//.env.example` – šablona env vars +- [ ] `docker-services//README.md` – dokumentace +- [ ] Aktualizován `docker-services/README.md` (tabulka) +- [ ] Aktualizován hlavní `README.md` (pokud je service klíčová) +- [ ] **Žádné citlivé údaje** v commitu + +## 🔐 Bezpečnost + +- ❌ **NEcommituj** hesla, API klíče, IP adresy serveru +- ❌ **NEcommituj** `~/.env` (je v `.gitignore`) +- ❌ **NEcommituj** SSH klíče +- ✅ **Vždy** používej `.env.example` jako šablonu +- ✅ **Vždy** testuj nové compose lokálně před commitem + +## 🧪 Testování + +Před commitem: + +```bash +# Validace YAML +python3 -c "import yaml; yaml.safe_load(open('docker-services//docker-compose.yml'))" + +# Validace compose (na serveru) +docker compose -f docker-services//docker-compose.yml config + +# Syntax check bash +shellcheck install-scripts/