feat: initial infra repo

- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower)
- install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore
- ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton
- hermes-install: Hermes CLI setup on macOS
- macos-setup: Brewfile + osx-defaults + fish-config
- home-nas-tools: metadata index for NAS projects (no binaries)
- docs: architecture, security, contributing
- README, LICENSE (MIT), .gitignore

docker-services/watchtower/.env.example

@@ -0,0 +1,22 @@
+# Watchtower – proměnné
+TZ=Europe/Prague
+
+# Mód: true = jen upozorni, false = auto-aktualizuje
+WATCHTOWER_MONITOR_ONLY=true
+
+# Mazat stare image po update
+WATCHTOWER_CLEANUP=true
+
+# Cron schedule (default: kazdou nedeli ve 4:00)
+WATCHTOWER_SCHEDULE=0 0 4 ? * SUN
+
+# Email notifikace
+WATCHTOWER_NOTIFICATIONS=email
+WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=change-me
+
+# Poznámka: V praxi nastav SMTP podle sveho providera

docker-services/watchtower/README.md

@@ -0,0 +1,61 @@
+# Watchtower – automatické aktualizace
+
+> Sleduje nové verze Docker image a automaticky restartuje kontejnery.
+
+## 📋 Přehled
+
+- **Image:** `containrrr/watchtower:latest`
+- **Network:** `bridge` (musí mít přístup k Docker socketu)
+- **Mód:** monitor-only (default) – jen upozorňuje, NEaktualizuje
+
+## 🚀 Instalace
+
+```bash
+cp .env.example .env
+nano .env   # nastavit WATCHTOWER_MONITOR_ONLY podle potřeby
+
+docker compose up -d
+```
+
+## 🎯 Módy
+
+- **Monitor only** (default) – posílá email/notifikaci, NEaktualizuje
+- **Auto update** – stáhne nový image, restartuje kontejner
+
+## 📧 Notifikace (email)
+
+```env
+WATCHTOWER_NOTIFICATIONS=email
+WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com
+WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME
+```
+
+## 🔧 Pokročilé
+
+- **Schedule** – cron-like: `0 0 4 ? * SUN` (každou neděli v 4:00)
+- **Cleanup** – smaže staré image (`WATCHTOWER_CLEANUP=true`)
+- **Notifications** – shoutrrr (Telegram, Discord, Slack, …)
+
+## 📁 Volumes
+
+| Mount | Účel |
+|---|---|
+| `/var/run/docker.sock:/var/run/docker.sock` | Přístup k Docker daemonu |
+
+## 🔐 Bezpečnost
+
+- **Doporučeno:** monitor-only s email notifikací
+- **Auto-update** riskantní – může rozbít službu
+- **Manuální update:** `docker compose pull && docker compose up -d`
+
+## 🔄 Restart
+
+Watchtower se automaticky restartuje. **Nemusíte na něj sahat.**
+
+## 📚 Dokumentace
+
+- [Watchtower GitHub](https://github.com/containrrr/watchtower)

docker-services/watchtower/docker-compose.yml

@@ -0,0 +1,34 @@
+# Watchtower – monitor + auto-update
+
+services:
+  watchtower:
+    image: containrrr/watchtower:latest
+    container_name: watchtower
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - TZ=Europe/Prague
+      - WATCHTOWER_MONITOR_ONLY=true
+      - WATCHTOWER_CLEANUP=true
+      - WATCHTOWER_SCHEDULE=0 0 4 ? * SUN
+      - WATCHTOWER_NOTIFICATIONS=email
+      - WATCHTOWER_NOTIFICATION_EMAIL_FROM=watchtower@example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_TO=admin@example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=watchtower@example.com
+      - WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=CHANGE_ME
+      - WATCHTOWER_NOTIFICATION_EMAIL_SUBJECTTAG=Watchtower
+    networks:
+      - watchtower_net
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  watchtower_net:
+    name: watchtower_default
+    driver: bridge