feat: initial infra repo

- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower)
- install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore
- ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton
- hermes-install: Hermes CLI setup on macOS
- macos-setup: Brewfile + osx-defaults + fish-config
- home-nas-tools: metadata index for NAS projects (no binaries)
- docs: architecture, security, contributing
- README, LICENSE (MIT), .gitignore

hermes-install/hermes-config.example.yml

@@ -0,0 +1,69 @@
+# Hermes Agent – ukázková konfigurace
+# Zkopíruj na ~/.config/hermes/config.yml a doplň
+
+# AI provider a model
+provider: anthropic
+model: claude-sonnet-4.5
+api_key: ${HERMES_API_KEY}
+
+# Pracovní adresáře
+workspace: ~/Skripty
+memory_dir: ~/.hermes/memory
+projects_dir: ~/git-repos
+
+# Sandbox – bezpečnostní omezení
+sandbox:
+  enabled: true
+  allow:
+    - "ls"
+    - "cat"
+    - "grep"
+    - "find"
+    - "git"
+    - "docker"
+    - "docker compose"
+    - "kubectl"
+    - "ssh"
+    - "scp"
+    - "rsync"
+    - "curl"
+    - "jq"
+  deny:
+    - "rm -rf /"
+    - "rm -rf /*"
+    - "dd if="
+    - "mkfs"
+
+# Integrace s existujícími službami
+integrations:
+  gitea:
+    url: http://CHANGE_ME:3000
+    token_name: "gitea:api:CHANGE_ME"
+  docker:
+    socket: /var/run/docker.sock
+  ssh:
+    default_user: deploy
+    default_key: ~/.ssh/id_ed25519
+
+# Výstup
+output:
+  format: markdown
+  streaming: true
+  language: cs
+  color: true
+
+# UI
+ui:
+  theme: dark
+  icons: emoji
+  spinner: dots
+
+# Bezpečnost
+security:
+  audit_log: true
+  require_approval_for:
+    - "rm"
+    - "docker system prune"
+    - "kubectl delete"
+    - "git push --force"
+  api_key_storage: keychain  # macOS keychain