feat: initial infra repo

- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower)
- install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore
- ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton
- hermes-install: Hermes CLI setup on macOS
- macos-setup: Brewfile + osx-defaults + fish-config
- home-nas-tools: metadata index for NAS projects (no binaries)
- docs: architecture, security, contributing
- README, LICENSE (MIT), .gitignore

install-scripts/install-portainer.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# Instalace Portainer CE
+# - nejdřív vyžaduje Docker (spusť install-docker.sh)
+# - běží jako docker compose v /opt/portainer
+#
+set -euo pipefail
+
+[[ $EUID -eq 0 ]] || { echo "Spusť jako root: sudo bash $0" >&2; exit 1; }
+
+DEPLOY_USER="${DEPLOY_USER:-deploy}"
+INSTALL_DIR="/opt/portainer"
+
+if [[ -d "$INSTALL_DIR" ]]; then
+    echo "✓ Portainer už v $INSTALL_DIR nainstalován"
+else
+    mkdir -p "$INSTALL_DIR/data"
+    chown -R "$DEPLOY_USER:$DEPLOY_USER" "$INSTALL_DIR"
+
+    cat > "$INSTALL_DIR/docker-compose.yml" <<'EOF'
+services:
+  portainer:
+    image: portainer/portainer-ce:latest
+    container_name: portainer
+    restart: unless-stopped
+    ports:
+      - "9000:9000"
+      - "9443:9443"
+    volumes:
+      - ./data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - TZ=Europe/Prague
+EOF
+
+    cd "$INSTALL_DIR"
+    docker compose up -d
+    echo "✓ Portainer nasazen"
+fi
+
+echo
+echo "🌐 Portainer: http://$(hostname -I | awk '{print $1}'):9000"
+echo "   První přihlášení: vytvoř admin účet"