feat: initial infra repo

- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower)
- install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore
- ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton
- hermes-install: Hermes CLI setup on macOS
- macos-setup: Brewfile + osx-defaults + fish-config
- home-nas-tools: metadata index for NAS projects (no binaries)
- docs: architecture, security, contributing
- README, LICENSE (MIT), .gitignore

ansible/playbooks/deploy-services.yml

@@ -0,0 +1,42 @@
+---
+# Nasaď Docker služby z docker-services/ adresáře
+#
+# Použití:
+#   ansible-playbook -i inventory.yml playbooks/deploy-services.yml
+#   ansible-playbook -i inventory.yml playbooks/deploy-services.yml --extra-vars "services=[portainer,vaultwarden]"
+#
+- name: Deploy Docker services
+  hosts: homeservers
+  become: true
+  gather_facts: true
+
+  vars:
+    services_repo: https://github.com/<user>/mates-infra.git
+    services_path: "/home/{{ docker_user }}/docker-services"
+    services: "{{ services_to_deploy | default(['portainer', 'vaultwarden', 'gitea']) }}"
+
+  tasks:
+    - name: Clone services repo
+      ansible.builtin.git:
+        repo: "{{ services_repo }}"
+        dest: "{{ services_path }}"
+        force: false
+        update: true
+      become_user: "{{ docker_user }}"
+
+    - name: Create .env from example
+      ansible.builtin.copy:
+        src: "{{ services_path }}/{{ item }}/.env.example"
+        dest: "{{ services_path }}/{{ item }}/.env"
+        remote_src: true
+        force: false
+      loop: "{{ services }}"
+      become_user: "{{ docker_user }}"
+
+    - name: Deploy services
+      community.docker.docker_compose_v2:
+        project_src: "{{ services_path }}/{{ item }}"
+        state: present
+        pull: missing
+      loop: "{{ services }}"
+      become_user: "{{ docker_user }}"