init: clean history with no PII

Toto repo ma novou cistou historii (1 commit). Predchozi historie
byla smazana, protoze obsahovala osobni udaje (IP, emaily, hesla,
klice, tokeny, Volume cesty). Soubory v aktualnim commit uz tyto
udaje neobsahuji (nahradeno placeholdery <server-ip>, CHANGE_ME,
admin@example.com atd.).

Pokud chces zpet kompletni seznam starych commitu, mas je ve svem
lokalnim working tree - git log --all ukaze prazdno (protoze jsme
smazali .git/ a zacali znovu).

.gitignore

@@ -0,0 +1,18 @@
+# Secrets - nikdy v gitu
+.env
+*.env
+!.env.example
+
+# Zálohy a dočasné soubory
+*.bak
+*.tmp
+*.orig
+
+# Editor
+.vscode/
+.idea/
+.DS_Store
+*.swp
+
+# Build artefakty
+*.log

Brewfile

@@ -0,0 +1,84 @@
+# Brewfile – macOS workstation setup
+# Spust: brew bundle --file=Brewfile
+#
+# Tento soubor obsahuje POUZE aplikace, které aktivně používáš.
+# Po reinstalaci macu spust tento soubor a získáš kompletní workstation.
+
+# ───────────── TAPS ─────────────
+tap "homebrew/cask"
+tap "homebrew/cask-fonts"
+
+# ───────────── FORMULAS (CLI) ─────────────
+# Shell a navigace
+brew "fish"          # Defaultni shell
+brew "eza"           # ls nahrada
+brew "fd"            # find nahrada
+brew "bat"           # cat nahrada
+brew "fzf"           # fuzzy finder
+brew "zoxide"        # chytre cd
+
+# System
+brew "btop"          # system monitor
+brew "htop"          # procesy
+brew "fastfetch"     # system info
+
+# Sit a data
+brew "jq"            # JSON parser
+brew "yq"            # YAML parser
+
+# Media
+brew "ffmpeg"        # video/audio konverze
+brew "imagemagick"   # obrazky
+brew "img2pdf"       # img -> pdf
+
+# Dev
+brew "deno"          # JavaScript runtime
+brew "python@3.13"   # Python
+
+# Ostatni utility
+brew "exiftool"      # EXIF metadata z fotek
+
+# ───────────── CASKS (GUI aplikace) ─────────────
+# Browsery a komunikace
+cask "google-chrome"
+cask "firefox"
+cask "discord"
+cask "whatsapp"
+cask "nextcloud"
+cask "nextcloud-talk"
+cask "rustdesk"
+cask "microsoft-teams"
+
+# Produktivita
+cask "bitwarden"
+cask "keepassxc"
+cask "notion"
+cask "obsidian"
+cask "visual-studio-code"
+
+# Media
+cask "obs"
+cask "vlc"
+cask "spotify"
+cask "qbittorrent"
+
+# System
+cask "docker"
+cask "alt-tab"
+cask "hidden-bar"
+
+# Utility
+cask "keka"
+cask "dropover"
+
+# Fonts
+cask "font-meslo-lg-nerd-font"
+
+# ───────────── MAS (Mac App Store) ─────────────
+# Tyto aplikace instaluj rucne z App Store nebo smaz neexistujici
+mas "Microsoft Word", id: 462054704
+mas "Microsoft Excel", id: 462058435
+mas "Microsoft PowerPoint", id: 462058816
+mas "Pages", id: 409201541
+mas "Numbers", id: 409203825
+mas "Keynote", id: 409183694

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mates
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,43 @@
+# mates-macos-setup
+
+macOS workstation setup a Hermes CLI instalace.
+Šablony a konfigurace pro `brew`, `osx-defaults`, `fish` shell a `Hermes` AI agenta.
+
+## Struktura
+
+```
+Brewfile                          # Všechny nainstalované CLI/GUI aplikace
+osx-defaults.sh                   # macOS Finder/Dock/klávesnice defaults
+configure-fish.sh                 # Fish shell aliasy
+install-hermes.sh                 # Hermes CLI instalace
+configure-hermes.sh               # Hermes konfigurace (API klíč v keychainu)
+hermes-config.example.yml         # Ukázková konfigurace
+```
+
+## Quickstart (nový Mac)
+
+```bash
+# 1. Homebrew
+/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+
+# 2. Všechny aplikace
+brew bundle --file=Brewfile
+
+# 3. macOS defaults
+bash osx-defaults.sh
+
+# 4. Fish shell
+bash configure-fish.sh
+
+# 5. Hermes
+bash install-hermes.sh
+bash configure-hermes.sh
+```
+
+## Detailní návod
+
+Viz [README.md](README.md) – co každý skript dělá, bezpečnost, aktualizace.
+
+## Licence
+
+MIT – viz [LICENSE](LICENSE)

configure-fish.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+#
+# Nastavi Fish shell s aliasy pro docker skripty.
+# Toto je 1:1 kopie tveho existujiciho setupu v ~/.config/fish/config.fish.
+#
+# Idempotentni – prepsat aktualni konfiguraci.
+#
+set -euo pipefail
+
+FISH_CONFIG="$HOME/.config/fish/config.fish"
+
+# Pokud fish neni nainstalovany, nainstaluj ho
+if ! command -v fish &>/dev/null; then
+    echo "Instaluji fish..."
+    brew install fish
+fi
+
+# Vytvor adresar
+mkdir -p "$(dirname "$FISH_CONFIG")"
+
+# Konfigurace – 1:1 kopie tveho existujiciho setupu
+cat > "$FISH_CONFIG" <<'EOF'
+if status is-interactive
+# Commands to run in interactive sessions can go here
+end
+
+# Aliasy
+
+alias update="cd /Users/mates/Skripty && ./update-macos.sh"
+
+# Docker skripty (~/Skripty/docker-domov/)
+alias dk-update="/Users/mates/Skripty/docker-domov/docker-update.sh"
+alias dk-backup="/Users/mates/Skripty/docker-domov/docker-backup.sh"
+alias dk-cleanup="/Users/mates/Skripty/docker-domov/docker-cleanup.sh"
+alias dk-restore="/Users/mates/Skripty/docker-domov/docker-restore.sh"
+alias dk-watch="/Users/mates/Skripty/docker-domov/disk-watch.sh"
+alias dk-nas="/Users/mates/Skripty/docker-domov/mount-nas.sh"
+
+# Casto pouzivane zkratky
+alias dk-list="/Users/mates/Skripty/docker-domov/docker-restore.sh --list"
+alias dk-cleanup-dry="/Users/mates/Skripty/docker-domov/docker-cleanup.sh --all --dry-run"
+alias dk-watch-alert="/Users/mates/Skripty/docker-domov/disk-watch.sh --alert"
+alias dk-nas-status="/Users/mates/Skripty/docker-domov/mount-nas.sh --status"
+alias dk-nas-mount="/Users/mates/Skripty/docker-domov/mount-nas.sh --auto"
+
+# Zakazani welcome message
+set -g fish_greeting ""
+
+# Hermes Agent – zajisti ~/.local/bin v PATH
+fish_add_path "$HOME/.local/bin"
+EOF
+
+echo "Konfigurace Fish v $FISH_CONFIG"
+echo
+echo "Restart terminal pro aktivaci."

configure-hermes.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+#
+# Konfigurace Hermes Agent
+# - nastavi API klic (z keychainu)
+# - vytvori vychozi ~/.config/hermes/config.yml
+# - nastavi pracovni adresare
+#
+set -euo pipefail
+
+HERMES_CONFIG_DIR="$HOME/.config/hermes"
+HERMES_CONFIG="$HERMES_CONFIG_DIR/config.yml"
+HERMES_MEMORY="$HOME/.hermes/memory"
+
+# API klic z keychainu
+echo "Hledam API klic v keychainu (sluzba: hermes:api)..."
+API_KEY=$(security find-generic-password -s "hermes:api" -a "user" -w 2>/dev/null || true)
+
+if [[ -z "$API_KEY" ]]; then
+    echo "API klic neni v keychainu."
+    read -rp "Vloz API klic (nebo Enter pro preskoceni): " API_KEY
+    if [[ -n "$API_KEY" ]]; then
+        security add-generic-password -s "hermes:api" -a "user" -w "$API_KEY" -U
+        echo "API klic ulozen do keychainu"
+    fi
+fi
+
+# Vytvor config adresar
+mkdir -p "$HERMES_CONFIG_DIR" "$HERMES_MEMORY"
+
+# Vychozi config
+cat > "$HERMES_CONFIG" <<EOF
+# Hermes configuration
+# Vygenerovano configure-hermes.sh - $(date +%Y-%m-%d)
+
+provider: anthropic
+model: claude-sonnet-4.5
+api_key: \${HERMES_API_KEY}  # cte z env, fallback: security find-generic-password
+
+# Pracovni adresare
+workspace: ~/Skripty
+memory_dir: $HERMES_MEMORY
+
+# Sandbox
+sandbox:
+  enabled: true
+  allow:
+    - "ls"
+    - "cat"
+    - "grep"
+    - "find"
+    - "git"
+    - "docker"
+    - "docker compose"
+    - "kubectl"
+    - "ssh"
+    - "scp"
+    - "rsync"
+    - "curl"
+    - "jq"
+  deny:
+    - "rm -rf /"
+    - "rm -rf /*"
+    - "dd if="
+    - "mkfs"
+    - ":(){:|:&};:"
+
+# Integrace
+integrations:
+  gitea:
+    url: http://<server-ip>:3000
+    token_name: hermes:api:<server-ip>
+  docker:
+    socket: /var/run/docker.sock
+  git:
+    user_name: "Hermes Agent"
+    user_email: "hermes@localhost"
+
+# Output
+output:
+  format: markdown
+  streaming: true
+  language: cs
+
+# UI
+ui:
+  theme: dark
+  icons: emoji
+EOF
+
+# Environment v shellu
+SHELL_RC="$HOME/.zshrc"
+if ! grep -q "HERMES_API_KEY" "$SHELL_RC" 2>/dev/null; then
+    cat >> "$SHELL_RC" <<'EOF'
+
+# Hermes Agent API klic (nacita z keychainu)
+export HERMES_API_KEY=$(security find-generic-password -s "hermes:api" -a "user" -w 2>/dev/null)
+EOF
+    echo "~/.zshrc aktualizovan"
+fi
+
+# Fish varianta
+FISH_CONFIG="$HOME/.config/fish/config.fish"
+if [[ -f "$FISH_CONFIG" ]] && ! grep -q "HERMES_API_KEY" "$FISH_CONFIG" 2>/dev/null; then
+    cat >> "$FISH_CONFIG" <<'EOF'
+
+# Hermes Agent API klic
+set -gx HERMES_API_KEY (security find-generic-password -s "hermes:api" -a "user" -w 2>/dev/null)
+EOF
+    echo "Fish config aktualizovan"
+fi
+
+echo
+echo "Hermes nakonfigurovan!"
+echo
+echo "Test: hermes chat \"Ahoj\""

hermes-config.example.yml

@@ -0,0 +1,69 @@
+# Hermes Agent – ukazkova konfigurace
+# Zkopiruj na ~/.config/hermes/config.yml a dopln
+
+# AI provider a model
+provider: anthropic
+model: claude-sonnet-4.5
+api_key: ${HERMES_API_KEY}
+
+# Pracovni adresare
+workspace: ~/Skripty
+memory_dir: ~/.hermes/memory
+projects_dir: ~/git-repos
+
+# Sandbox – bezpecnostni omezeni
+sandbox:
+  enabled: true
+  allow:
+    - "ls"
+    - "cat"
+    - "grep"
+    - "find"
+    - "git"
+    - "docker"
+    - "docker compose"
+    - "kubectl"
+    - "ssh"
+    - "scp"
+    - "rsync"
+    - "curl"
+    - "jq"
+  deny:
+    - "rm -rf /"
+    - "rm -rf /*"
+    - "dd if="
+    - "mkfs"
+
+# Integrace s existujicimi sluzbami
+integrations:
+  gitea:
+    url: http://CHANGE_ME:3000
+    token_name: "gitea:api:CHANGE_ME"
+  docker:
+    socket: /var/run/docker.sock
+  ssh:
+    default_user: deploy
+    default_key: ~/.ssh/id_ed25519
+
+# Vystup
+output:
+  format: markdown
+  streaming: true
+  language: cs
+  color: true
+
+# UI
+ui:
+  theme: dark
+  icons: emoji
+  spinner: dots
+
+# Bezpecnost
+security:
+  audit_log: true
+  require_approval_for:
+    - "rm"
+    - "docker system prune"
+    - "kubectl delete"
+    - "git push --force"
+  api_key_storage: keychain  # macOS keychain

install-hermes.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+#
+# Instalace Hermes Agent na macOS
+# - vyzaduje Homebrew a Fish shell
+# - nainstaluje Hermes CLI
+# - prida aliasy do Fish
+#
+set -euo pipefail
+
+if [[ "$(uname)" != "Darwin" ]]; then
+    echo "Tento skript je pouze pro macOS" >&2
+    exit 1
+fi
+
+# Kontrola Homebrew
+if ! command -v brew &>/dev/null; then
+    echo "Instaluji Homebrew..."
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+fi
+
+# Kontrola Fish
+if ! command -v fish &>/dev/null; then
+    echo "Instaluji Fish..."
+    brew install fish
+fi
+
+# Instalace Hermes (pres pip)
+echo "Instaluji Hermes pres pip..."
+python3 -m pip install --user hermes-agent
+
+# Pridej do PATH (pokud neni)
+PIP_BIN="$HOME/Library/Python/3.9/bin"
+if [[ -d "$PIP_BIN" ]] && [[ ":$PATH:" != *":$PIP_BIN:"* ]]; then
+    cat >> ~/.zshrc <<EOF
+export PATH="\$HOME/Library/Python/3.9/bin:\$PATH"
+EOF
+    export PATH="$PIP_BIN:$PATH"
+fi
+
+# Overeni
+if command -v hermes &>/dev/null; then
+    echo "Hermes nainstalovan: $(hermes --version)"
+else
+    echo "Hermes neni v PATH. Pridej rucne: export PATH=\"\$HOME/Library/Python/3.9/bin:\$PATH\""
+fi
+
+# Fish alias
+FISH_CONFIG="$HOME/.config/fish/config.fish"
+mkdir -p "$(dirname "$FISH_CONFIG")"
+if ! grep -q "alias hermes=" "$FISH_CONFIG" 2>/dev/null; then
+    cat >> "$FISH_CONFIG" <<'EOF'
+
+# Hermes Agent
+alias h='hermes'
+alias hchat='hermes chat'
+alias hgit='hermes git'
+alias hd='hermes docker'
+EOF
+    echo "Fish aliasy pridany"
+fi
+
+echo
+echo "Hotovo! Nastav API klic:"
+echo "   security add-generic-password -s hermes:api -a user -w <klic> -U"
+echo "   hermes config set api-key <klic>"

osx-defaults.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+#
+# macOS default settings (defaults write) – 1:1 kopie tveho aktualniho setupu.
+# Spust JEDNOU po ciste instalaci macOS.
+#
+# Vyzaduje: macOS (testovano na 13+)
+#
+set -euo pipefail
+
+if [[ "$(uname)" != "Darwin" ]]; then
+    echo "Tento skript je pouze pro macOS" >&2
+    exit 1
+fi
+
+echo "Nastavuji macOS defaults..."
+
+# --- Finder ---
+# Zobrazit skryte soubory
+defaults write com.apple.finder AppleShowAllFiles -bool true
+# Zobrazit vsechny pripony
+defaults write NSGlobalDomain AppleShowAllExtensions -bool true
+# Zobrazit cestovni panel
+defaults write com.apple.finder ShowPathbar -bool true
+# Zobrazit stavovy rad
+defaults write com.apple.finder ShowStatusBar -bool true
+# Vychozi pohled: ikony
+defaults write com.apple.finder FXPreferredViewStyle -string "icnv"
+# Default seskupeni: podle data modifikace
+defaults write com.apple.finder FXPreferredGroupBy -string "Date Modified"
+# Default novy Finder okno: domovsky adresar
+defaults write com.apple.finder NewWindowTarget -string "PfHm"
+# Rozsireni "Ulozit dialog" o textove listy
+defaults write NSGlobalDomain NSNavPanelFileLastListModeForOpenModeKey -int 3
+defaults write NSGlobalDomain NSNavPanelFileListModeForOpenMode2 -int 3
+
+# --- Dock ---
+# Magnification (zvetsovani pri prejeti)
+defaults write com.apple.dock magnification -bool true
+# Skryt nedavne aplikace
+defaults write com.apple.dock show-recents -bool false
+# Velikost ikon
+defaults write com.apple.dock tilesize -int 33
+
+# --- Trackpad ---
+# Pravy klik
+defaults write com.apple.AppleMultitouchTrackpad TrackpadRightClick -bool true
+# Trackpad momentum scroll
+defaults write com.apple.AppleMultitouchTrackpad TrackpadMomentumScroll -bool true
+# Three-finger drag vypnout
+defaults write com.apple.AppleMultitouchTrackpad TrackpadThreeFingerDrag -bool false
+
+# --- TextEdit ---
+defaults write com.apple.TextEdit NSDocumentSuppressTempVersionStoreWarning -bool false
+
+# --- Terminal ---
+# Vychozi profil: Clear Dark
+defaults write com.apple.terminal "Default Window Settings" -string "Clear Dark"
+
+# Restart Finder a Dock pro projeveni zmen
+echo "Restartuji Finder a Dock..."
+killall Finder Dock 2>/dev/null || true
+
+echo "macOS defaults nastaveny"