feat: initial infra repo

- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower)
- install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore
- ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton
- hermes-install: Hermes CLI setup on macOS
- macos-setup: Brewfile + osx-defaults + fish-config
- home-nas-tools: metadata index for NAS projects (no binaries)
- docs: architecture, security, contributing
- README, LICENSE (MIT), .gitignore

install-scripts/restore-all.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+#
+# Obnova Docker dat z NAS zálohy
+# - najde nejnovější zálohu pro danou službu
+# - zastaví službu, rozbalí data, nastartuje
+#
+# Použití:
+#   sudo bash restore-all.sh                       # obnov vše
+#   sudo bash restore-all.sh --only portainer      # jen portainer
+#   sudo bash restore-all.sh --from 20240801-120000  # konkrétní záloha
+#   sudo bash restore-all.sh --dry-run
+#
+set -euo pipefail
+
+DEPLOY_USER="${DEPLOY_USER:-deploy}"
+DOCKER_HOME="/home/$DEPLOY_USER/docker"
+NAS_MOUNT="${NAS_MOUNT:-/Volumes/Backups}"
+BACKUP_ROOT="$NAS_MOUNT/Prace/server-backups/$(hostname)"
+
+DRY_RUN=false
+ONLY=""
+FROM=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --only) ONLY="$2"; shift 2 ;;
+        --from) FROM="$2"; shift 2 ;;
+        --dry-run) DRY_RUN=true; shift ;;
+        *) echo "Neznámý parametr: $1" >&2; exit 1 ;;
+    esac
+done
+
+[[ $EUID -eq 0 ]] || { echo "Spusť jako root: sudo bash $0" >&2; exit 1; }
+
+run() {
+    if $DRY_RUN; then
+        echo "[DRY-RUN] $*"
+    else
+        echo "▶ $*"
+        "$@"
+    fi
+}
+
+[[ -d "$BACKUP_ROOT" ]] || { echo "$BACKUP_ROOT neexistuje" >&2; exit 1; }
+
+for SERVICE_DIR in "$DOCKER_HOME"/*/; do
+    SERVICE=$(basename "$SERVICE_DIR")
+    [[ -n "$ONLY" && "$SERVICE" != "$ONLY" ]] && continue
+    [[ -f "$SERVICE_DIR/docker-compose.yml" ]] || continue
+
+    if [[ -n "$FROM" ]]; then
+        BACKUP_FILE="$BACKUP_ROOT/$SERVICE/${SERVICE}-$FROM.tar.zst"
+    else
+        # Nejnovější záloha
+        BACKUP_FILE=$(ls -t "$BACKUP_ROOT/$SERVICE"/${SERVICE}-*.tar.zst 2>/dev/null | head -1 || true)
+    fi
+
+    [[ -z "$BACKUP_FILE" || ! -f "$BACKUP_FILE" ]] && { echo "⚠ $SERVICE: žádná záloha, přeskakuji"; continue; }
+
+    echo "▶ $SERVICE: obnovuji z $BACKUP_FILE"
+    if ! $DRY_RUN; then
+        run docker compose -f "$SERVICE_DIR/docker-compose.yml" stop
+        run rm -rf "$SERVICE_DIR/data"
+        run mkdir -p "$SERVICE_DIR/data"
+        run tar --zstd -xf "$BACKUP_FILE" -C "$SERVICE_DIR"
+        run chown -R "$DEPLOY_USER:$DEPLOY_USER" "$SERVICE_DIR/data"
+        run docker compose -f "$SERVICE_DIR/docker-compose.yml" up -d
+        echo "✓ $SERVICE obnoven"
+    fi
+done
+
+echo
+echo "🎯 Obnova dokončena"