File created successfully at: /opt/xetup/web/spec/index.html

<!DOCTYPE html>

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Xetup - Specifikace nasazeni</title>

  xetup
  /
  Specifikace nasazeni

  + Nova diskuse
  Git

Sekce

      1Priprava
      2Bloatware
      3Software
      4System (HKLM)
      5Default profil
      6Personalizace
      7Taskbar + Start
      8Scheduled tasks
      9Sit a identita
      *Budoucnost

Specifikace nasazeni

Ziva dokumentace toho, co xetup dela. Klikni na krok pro detaily, pouzij "Diskuse" pro komentar.

        Verze: 0.3 (draft)
        Aktualizovano: 2026-04-16
        Cil: Windows 10 + 11 x64

  0Hotovo

 0Opravit

0Chybi

0Planovano

1

Priprava prostredi

          Chybi
          Adresar C:\X9 + ikona slozky
          Staging slozka pro assets, vlastni ikona pres desktop.ini
          ▶

Struktura

C:\X9\
+-- install\        (staging pro Atera MSI a dalsi stazene soubory)
+-- X9-ikona.ico    (ikona slozky - z assets/Logo/)
+-- X9-logo.jpg     (avatar uctu)

Ikona slozky

[.ShellClassInfo]
IconResource=C:\X9\X9-ikona.ico,0

attrib +s +h "C:\X9\desktop.ini"
attrib +s "C:\X9"

PoznamkaPripnuti slozky na taskbar Win11 nepodporuje. Shortcut na plose nebo Quick Access.

            Diskuse →

          Opravit
          Admin ucet (adminx9)
          Bez hesla, FullName = "X9.cz s.r.o.", skryty z login screen
          00-admin-account.ps1
          ▶

Vytvoreni adminx9

Bez hesla (aktualne skript pouziva heslo z config.json - odstranit)

FullName = X9.cz s.r.o. pres ADSI

Pridani do Administrators

Heslo nevyprsi, uzivatel nesmi menit

Skryti z login screen: SpecialAccounts\UserList = 0

Nastaveni FullName

$user = [ADSI]"WinNT://$env:COMPUTERNAME/adminx9,user"
$user.FullName = "X9.cz s.r.o."
$user.SetInfo()

Co opravitOdstranit heslo z konfigu. Pridat ADSI volani pro FullName.

            Diskuse →

          Hotovo
          Aktivace Windows
          Klic z config.json nebo GVLK fallback, volitelne KMS server
          08-activation.ps1
          ▶

Kontrola stavu aktivace (pokud uz aktivovano, preskoci)

Klic z config.json → GVLK fallback podle edice

slmgr.vbs /ipk + /ato

Volitelny KMS server pres activation.kmsServer

            Diskuse →

          Planovano
          Prejmenovani PC
          Rename-Computer jako posledni krok pred restartem, jmeno zadano v TUI
          ▶

Prejmenovani pocitace jako posledni krok nasazeni. Jmeno bude zadano technikemi v TUI (nebo v config.json).

Rename-Computer -NewName $pcName -Force

ZavislostVyzaduje restart. Bude poslednim krokem pred restartem.

            Diskuse →

2

Odstranovani bloatware

          Hotovo
          AppX balicky (UWP aplikace)
          ~35 preinstalovanych aplikaci pro vsechny uzivatele. Kalkulacka zustava.
          01-bloatware.ps1
          ▶

BingSearch, Camera, Clipchamp, Alarms, Copilot, Cortana,
DevHome, FamilySafety, FeedbackHub, GetHelp, Tips, Mail,
Maps, News, OfficeHub, OneNote, Outlook, Paint, People,
Photos, PowerAutomate, QuickAssist, Skype, SnippingTool,
Solitaire, StickyNotes, Teams, ToDo, VoiceRecorder, Wallet,
Weather, Terminal, Xbox (6x), GamingApp, YourPhone,
ZuneMusic, ZuneVideo, LinkedIn

Zachovavame

Microsoft.WindowsCalculator

TechnikaRemove-AppxPackage -AllUsers + Remove-AppxProvisionedPackage (aby se nevratilo novym uzivatelum).

            Diskuse →

          Hotovo
          Windows Capabilities
          Fax, IE, WordPad, PowerShell ISE, Steps Recorder, WMP, Handwriting...
          01-bloatware.ps1
          ▶

Print.Fax.Scan, Language.Handwriting, Browser.InternetExplorer,
MathRecognizer, OneCoreUAP.OneSync, OpenSSH.Client,
Microsoft.Windows.MSPaint, Microsoft.Windows.PowerShell.ISE,
App.Support.QuickAssist, Microsoft.Windows.SnippingTool,
App.StepsRecorder, Hello.Face.*, Media.WindowsMediaPlayer,
Microsoft.Windows.WordPad

            Diskuse →

          Hotovo
          Optional Features
          MediaPlayback, PS 2.0, Recall (AI). RDP se NEODEBIRA.
          01-bloatware.ps1
          ▶

MediaPlayback, MicrosoftWindowsPowerShellV2Root,
Recall (Windows AI), Microsoft-SnippingTool

VyresenoRDP klient (Microsoft-RemoteDesktopConnection) se NEODEBIRA. Musi zustat funkcni.

            Diskuse →

          Opravit
          OneDrive - agresivni odstranovani
          Aktualni kod maze OneDrive. Nutno opravit - musi zustat instalovatelny pro M365.
          03-system-registry.ps1, 04-default-profile.ps1
          ▶

Problem03-system-registry.ps1 (radky 244-273) a 04-default-profile.ps1 (radky 240-261) agresivne mazou OneDriveSetup.exe, RunOnce klice a Explorer namespace. OneDrive musi zustat instalovatelny pro M365 klienty.

Co odstranit

OneDriveSetup.exe /uninstall + mazani exe

Mazani Start menu shortcutu OneDrive

Mazani RunOnce\OneDriveSetup z Default Profile

Mazani Explorer\Desktop\NameSpace OneDrive klic

            Diskuse →

3

Instalace softwaru

          Hotovo
          Winget balicky
          7-Zip, Adobe Acrobat Reader, OpenVPN Connect. Seznam neuplny.
          02-software.ps1
          ▶

7zip.7zip	7-Zip

Adobe.Acrobat.Reader.64-bit	Adobe Acrobat Reader

OpenVPNTechnologies.OpenVPNConnect	OpenVPN Connect

TODOSeznam softwaru je neuplny. Co dalsiho instalovat? Doplnit po domluve s tymem.

Adobe jako vychozi PDF

Po instalaci: .pdf → AcroRd32 pres HKCR

Scheduled task PDF-DefaultApp obnovi asociaci pri kazdem prihlaseni

UCPD.sys (od Feb 2024)Kernel driver blokuje prime zapisy do UserChoice pro .pdf. Zvazit: vypnout UCPD bhem nasazeni, nastavit asociaci, znovu zapnout. Nebo SetUserFTA nastroj.

            Diskuse →

          Chybi
          Atera Agent
          Stazeni MSI z Atera API a silent install. MFA bypass pres aeid parametr?
          ▶

$ateraUrl = "https://x9.servicedesk.atera.com/api/utils/agent-install/windows/?cid=31&aeid=50b72e7113e54a63ac76b96c54c7e337"
$ateraMsi = "C:\X9\install\atera-setup.msi"
Invoke-WebRequest -Uri $ateraUrl -OutFile $ateraMsi
Start-Process msiexec -ArgumentList "/i $ateraMsi /qn" -Wait

Otevrena otazkaOverit jestli URL s parametrem aeid=... obchazi MFA pozadavek. Pokud ne, najit jiny zpusob silent instalace.

            Diskuse →

          Chybi
          BackInfo (info na ploše)
          BackInfo.exe - hostname, user, OS, HW, sit ve stredu plochy. Mame v assets/.
          ▶

Postup instalace

Zkopirovat assets/Backinfo/ → C:\Program Files\Backinfo\

Spustit backinfo_W11.ps1 (detekuje OS, zapise registry, vytvori Startup shortcut)

BackInfo.exe se pak spousti automaticky po kazdem prihlaseni

Co zobrazuje (INI)

AutoBackground=1, ForceDesktopCenter=1
Line1: Hostname (42pt, bold, white, center)
Line2: Username (20pt, gray, center)
Line3: OS z registru (20pt, bold, gray)
Line4: HW SysInfo (20pt, gray)
Line5: Network NetInfo (20pt, gray)

RozhodnutoNahrazuje nas custom 07-desktop-info.ps1. Skript 07 smazat.

            Diskuse →

4

Systemova nastaveni (HKLM)

          Hotovo
          Zakladni HKLM tweaky
          OOBE bypass, Teams, Widgets, GameDVR, Copilot, casova zona, hesla
          03-system-registry.ps1
          ▶

OOBE bypass (BypassNRO)	1

Teams auto-install	zakaz

Cloud Optimized Content	zakaz

Widgets / News and Interests	zakaz

GameDVR (AppCaptureEnabled)	0

Copilot	zakaz

Hesla - neexpirovat	net accounts /maxpwage:UNLIMITED

Casova zona	Central Europe Standard Time

            Diskuse →

          Opravit
          Edge policies
          Aktualne jen 2 klice. Potreba ~15 dalsich pro potlaceni AI/reklam/prvniho spusteni.
          03-system-registry.ps1
          ▶

Aktualne nastaveno

HideFirstRunExperience = 1
CreateDesktopShortcutDefault = 0

Doplnit

BrowserSignin = 0                        (zakaz sign-in)
CopilotPageContext = 0                   (Copilot bez kontextu)
NewTabPageContentEnabled = 0             (prazdna nova karta)
StandaloneHubsSidebarEnabled = 0         (vypnout sidebar)
ShowRecommendationsEnabled = 0           (zadne doporuceni)
DefaultBrowserSettingsCampaignEnabled = 0
HubsSidebarEnabled = 0
PersonalizationReportingEnabled = 0
SpotlightExperiencesAndRecommendations = 0
...a dalsi (~15 celkem)

            Diskuse →

          Chybi
          Powercfg - napajeni
          Casovace pro standby a monitor. Dosud neni implementovano.
          ▶

powercfg /change standby-timeout-ac 0      (nikdy do stanby pri napajeni)
powercfg /change monitor-timeout-ac 60     (monitor zhasne po 60 min)
powercfg /change standby-timeout-dc 30     (standby na baterku po 30 min)
powercfg /change monitor-timeout-dc 10     (monitor zhasne po 10 min)

PoznamkaKonkretni hodnoty k doladeni. Toto jsou navrhy - odsouhlasit s tymem.

            Diskuse →

          Chybi
          Proxy auto-detect vypnout
          AutoDetect = 0 v WinHTTP a IE nastaveni. Zabraci zbytecnym WPAD dotazum.
          ▶

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  AutoDetect = 0

netsh winhttp reset proxy

            Diskuse →

5

Default profil (NTUSER.DAT)

          Hotovo
          Taskbar a Start menu tweaky
          Zarovnani vlevo, skryti Search/TaskView/Widgets/Chat/Copilot, prazdny pin list
          04-default-profile.ps1
          ▶

TaskbarAl = 0	Zarovnani vlevo (Win11 default je center)

SearchboxTaskbarMode = 0	Skryti search boxu

ShowCopilotButton = 0	Skryti tlacitka Copilot

ShowTaskViewButton = 0	Skryti Task View

TaskbarDa = 0	Skryti Widgets

TaskbarMn = 0	Skryti Chat/Teams

ConfigureStartPins	Prazdny pin list (Win11)

DisableSearchBoxSuggestions = 1	Vypnuti Bing ve Start menu

Win11 24H2Nove applyOnce: true v ConfigureStartPins - layout se aplikuje jednou, uzivatel ho muze dale menit. Lepsi nez XML lock.

            Diskuse →

          Hotovo
          Explorer nastaveni
          Zobrazit pripony, otevrit na Tento pocitac, NumLock zapnout
          04-default-profile.ps1
          ▶

HideFileExt = 0	Zobrazit pripony souboru

LaunchTo = 1	Otevrit Explorer na "Tento pocitac" misto Quick Access

InitialKeyboardIndicators = 2	NumLock zapnuty pri startu

ColorPrevalence = 1	Accent barva na zahlavi oken

            Diskuse →

          Chybi
          Explorer - dalsi tweaky
          ShowRecent=0, ShowFrequent=0, FullPath=1 v adresnem radku
          04-default-profile.ps1
          ▶

ShowRecent = 0	Nezobrazovat nedavne soubory v Quick Access

ShowFrequent = 0	Nezobrazovat caste slozky v Quick Access

FullPath (CabinetState)	Zobrazit plnou cestu v adresnem radku

            Diskuse →

6

Personalizace

          Hotovo
          Barvy, motiv, pozadi
          Tmavy system, svetle aplikace, accent #223B47, plna barva pozadi
          05-personalization.ps1
          ▶

Rezim Windows	Tmavy

Rezim aplikaci	Svetly

Accent barva	#223B47

Accent v Start + taskbar	Ano

Accent v zahlavi oken	Ano

Pruhlednost	Vypnuta

Pozadi	Plna barva #223B47 (BackInfo prepise BMP)

            Diskuse →

          Hotovo
          Ikona "Tento pocitac" na ploše
          Zobrazit ikonu This PC na ploše (Default Profile + HKCU)
          05-personalization.ps1
          ▶

HKCU\...\HideDesktopIcons\NewStartPanel
  {20D04FE0-3AEA-1069-A2D8-08002B30309D} = 0

            Diskuse →

          Chybi
          Avatar uctu (X9 logo)
          X9-logo.jpg jako profilovy obrazek admin uctu. Logo je v assets/Logo/.
          ▶

$accountPicPath = "$env:APPDATA\Microsoft\Windows\AccountPictures"
New-Item -Path $accountPicPath -ItemType Directory -Force
Copy-Item "C:\X9\X9-logo.jpg" "$accountPicPath\X9-logo.jpg"

PoznamkaPlati jen pro admin ucet (adminx9). Bezny uzivatel ma vychozi avatar.

            Diskuse →

7

Hlavni panel a Start menu (pinnute aplikace)

          Hotovo
          Start menu - prazdny pin list
          Odstraní vychozi pinnute aplikace z Start menu
          04-default-profile.ps1
          ▶

ConfigureStartPins = {"pinnedList": [], "applyOnce": true}

applyOnce (Win11 24H2)Uzivatel muze Start menu po prvnim prihlaseni upravit. Lepsi UX nez tvrdy lock.

            Diskuse →

          Planovano
          Taskbar - pinnute aplikace (admin / user varianta)
          XML layout s ruznou sadou appek dle profilu (-ProfileType parametr)
          ▶

Technik vybere pri spusteni profil:

admin - aplikace pro power usery / technicke pracovniky

user - standardni kancelarska sada

Konkretni sadu appek pro kazdy profil je potreba dohodnut.

ZavislostZavisi na implementaci -ProfileType parametru v xetup.exe / Deploy-Windows.ps1.

            Diskuse →

8

Naplanovane ulohy

          Hotovo
          ShowAllTrayIcons
          Zobrazit vsechny ikony v system tray. Spousti se pri kazdem prihlaseni.
          06-scheduled-tasks.ps1
          ▶

Win11 24H2 problemEnableAutoTray=0 je ignorovan. Icon stream cache clearing je workaround, ale ne 100% spolehlivy. Zadne cistsi reseni zatim neexistuje.

            Diskuse →

          Hotovo
          PDF-DefaultApp
          Obnovi asociaci .pdf -> Adobe Reader pri kazdem prihlaseni (guard proti Edge)
          06-scheduled-tasks.ps1
          ▶

UCPD.sysKernel driver blokuje UserChoice zapisy od Feb 2024. Scheduled task pomaha, ale neni to idealni reseni. Viz krok "Winget balicky" pro diskusi o UCPD.

            Diskuse →

          Opravit
          07-desktop-info.ps1 - smazat
          Skript a jeho scheduled task jsou nahrazeny BackInfo. Odebrat z deploye.
          07-desktop-info.ps1
          ▶

RozhodnutoBackInfo.exe z assets/Backinfo/ nahrazuje nas custom skript. 07-desktop-info.ps1 smazat, scheduled task DesktopInfo odebrat z 06-scheduled-tasks.ps1.

            Diskuse →

9

Sit a identita

          Chybi
          Network discovery + ping
          Zapnout ping (ICMP), nastavit soukromy sitetovy profil
          ▶

# Povolit ICMP ping
netsh advfirewall firewall add rule name="ICMP Allow" `
  protocol=icmpv4:8,any dir=in action=allow

# Nastavit profil site na Private
$adapters = Get-NetConnectionProfile
$adapters | Set-NetConnectionProfile -NetworkCategory Private

PoznamkaProbehne az po zapojenI do site - vhodne jako posledni krok pred restartem.

            Diskuse →

          Planovano
          Domain join + doménový profil
          Pridat pocitac do domeny + prihlasit domainskeho uzivatele pro vytvoreni profilu
          ▶

Zadavano v TUI:

Domena (FQDN nebo NetBIOS)

Uzivatel s pravem pridavat do domeny

Domensky uzivatel pro prvotni prihlaseni (vytvoreni profilu)

StavNeni ve spec. Planovano pro budoucnost. Vyzaduje sitove pripojeni.

            Diskuse →

*

Architektura a budoucnost

          Planovano
          Go TUI launcher (xetup.exe)
          Jeden binarni soubor: embeds PS scripty, assets, TUI formulár, live log
          ▶

TUI flow

Formulár: jmeno PC, popis, produktovy klic

Checklist kroku: technik zapne/vypne jednotlive kroky

Uložit do config.json? (pro opakovatelne nasazeni)

Spusteni: live log output + progress

Shrnutí: OK / ERROR

Stack

Go + bubbletea + huh + lipgloss
go:embed scripts/ assets/ spec.yaml

Offline provoz

PS scripty + assets embedovany v binarce. Site vyzaduje jen winget a Atera.

            Diskuse →

          Planovano
          spec.yaml jako single source of truth
          Definice kroku, defaults, metadat - embedovano v xetup.exe, generuje tuto dokumentaci
          ▶

steps:
  - id: admin-account
    label: "Admin account (adminx9)"
    script: 00-admin-account.ps1
    default: true
    requires: []
  - id: activation
    label: "Windows activation"
    script: 08-activation.ps1
    default: true
    requires: [productKey]
...

            Diskuse →


Teď docker-compose:


File unchanged since last read. The content from the earlier Read tool_result in this conversation is still current — refer to that instead of re-reading.


Edit

      - FORGEJO__server__ROOT_URL=https://xetup.x9.cz
      - FORGEJO__server__DOMAIN=xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=xetup.x9.cz

      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz


Error: EACCES: permission denied, open '/opt/xetup/docker-compose.yml'


Bash

sudo chown dev:dev /opt/xetup/docker-compose.yml

Fix docker-compose.yml ownership


(Bash completed with no output)


Edit

      - FORGEJO__server__ROOT_URL=https://xetup.x9.cz
      - FORGEJO__server__DOMAIN=xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=xetup.x9.cz

      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz


The file /opt/xetup/docker-compose.yml has been updated successfully.

      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    container_name: xetup-forgejo
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      # Forgejo config via env
      - FORGEJO__server__ROOT_URL=https://xetup.x9.cz
      - FORGEJO__server__DOMAIN=xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=xetup.x9.cz
      - FORGEJO__server__SSH_PORT=2222
      - FORGEJO__server__LFS_START_SERVER=true
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__service__DISABLE_REGISTRATION=true
      - FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
      - FORGEJO__ui__DEFAULT_THEME=forgejo-dark
      - FORGEJO__repository__DEFAULT_BRANCH=main
      - FORGEJO__actions__ENABLED=true
      - FORGEJO__indexer__REPO_INDEXER_ENABLED=true
    volumes:
      - forgejo-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3100:3000"     # Web UI (behind reverse proxy)
      - "2222:22"       # Git SSH
    networks:
      - xetup

  runner:
    image: code.forgejo.org/forgejo/runner:6.3.1
    container_name: xetup-runner
    restart: unless-stopped
    depends_on:
      - forgejo
    environment:
      - DOCKER_HOST=unix:///var/run/docker.sock
    volumes:
      - runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - xetup

volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup

-      - FORGEJO__server__ROOT_URL=https://xetup.x9.cz

-      - FORGEJO__server__DOMAIN=xetup.x9.cz

-      - FORGEJO__server__SSH_DOMAIN=xetup.x9.cz

+      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz

+      - FORGEJO__server__DOMAIN=git.xetup.x9.cz

+      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz


volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup

  web:
    image: nginx:alpine
    container_name: xetup-web
    restart: unless-stopped
    volumes:
      - ./web:/usr/share/nginx/html:ro
      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)
    networks:
      - xetup

volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup


  web:
    image: nginx:alpine
    container_name: xetup-web
    restart: unless-stopped
    volumes:
      - ./web:/usr/share/nginx/html:ro
      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)
    networks:
      - xetup

volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    container_name: xetup-forgejo
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      # Forgejo config via env
      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_PORT=2222
      - FORGEJO__server__LFS_START_SERVER=true
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__service__DISABLE_REGISTRATION=true
      - FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
      - FORGEJO__ui__DEFAULT_THEME=forgejo-dark
      - FORGEJO__repository__DEFAULT_BRANCH=main
      - FORGEJO__actions__ENABLED=true
      - FORGEJO__indexer__REPO_INDEXER_ENABLED=true
    volumes:
      - forgejo-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3100:3000"     # Web UI (behind reverse proxy)
      - "2222:22"       # Git SSH
    networks:
      - xetup

  runner:
    image: code.forgejo.org/forgejo/runner:6.3.1
    container_name: xetup-runner
    restart: unless-stopped
    depends_on:
      - forgejo
    environment:
      - DOCKER_HOST=unix:///var/run/docker.sock
    volumes:
      - runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - xetup

volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup

+      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro

+      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)


Ověřím výsledek:


1	services:
2	  forgejo:
3	    image: codeberg.org/forgejo/forgejo:9
4	    container_name: xetup-forgejo
5	    restart: unless-stopped
6	    environment:
7	      - USER_UID=1000
8	      - USER_GID=1000
9	      # Forgejo config via env
10	      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
11	      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
12	      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz
13	      - FORGEJO__server__SSH_PORT=2222
14	      - FORGEJO__server__LFS_START_SERVER=true
15	      - FORGEJO__database__DB_TYPE=sqlite3
16	      - FORGEJO__service__DISABLE_REGISTRATION=true
17	      - FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
18	      - FORGEJO__ui__DEFAULT_THEME=forgejo-dark
19	      - FORGEJO__repository__DEFAULT_BRANCH=main
20	      - FORGEJO__actions__ENABLED=true
21	      - FORGEJO__indexer__REPO_INDEXER_ENABLED=true
22	    volumes:
23	      - forgejo-data:/data
24	      - /etc/timezone:/etc/timezone:ro
25	      - /etc/localtime:/etc/localtime:ro
26	    ports:
27	      - "3100:3000"     # Web UI (behind reverse proxy)
28	      - "2222:22"       # Git SSH
29	    networks:
30	      - xetup
31
32	  runner:
33	    image: code.forgejo.org/forgejo/runner:6.3.1
34	    container_name: xetup-runner
35	    restart: unless-stopped
36	    depends_on:
37	      - forgejo
38	    environment:
39	      - DOCKER_HOST=unix:///var/run/docker.sock
40	    volumes:
41	      - runner-data:/data
42	      - /var/run/docker.sock:/var/run/docker.sock
43	    networks:
44	      - xetup
45
46	  web:
47	    image: nginx:alpine
48	    container_name: xetup-web
49	    restart: unless-stopped
50	    volumes:
51	      - ./web:/usr/share/nginx/html:ro
52	      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
53	    ports:
54	      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)
55	    networks:
56	      - xetup
57
58	volumes:
59	  forgejo-data:
60	  runner-data:
61
62	networks:
63	  xetup:
64	    name: xetup
65

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    container_name: xetup-forgejo
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      # Forgejo config via env
      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_PORT=2222
      - FORGEJO__server__LFS_START_SERVER=true
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__service__DISABLE_REGISTRATION=true
      - FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
      - FORGEJO__ui__DEFAULT_THEME=forgejo-dark
      - FORGEJO__repository__DEFAULT_BRANCH=main
      - FORGEJO__actions__ENABLED=true
      - FORGEJO__indexer__REPO_INDEXER_ENABLED=true
    volumes:
      - forgejo-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3100:3000"     # Web UI (behind reverse proxy)
      - "2222:22"       # Git SSH
    networks:
      - xetup

  runner:
    image: code.forgejo.org/forgejo/runner:6.3.1
    container_name: xetup-runner
    restart: unless-stopped
    depends_on:
      - forgejo
    environment:
      - DOCKER_HOST=unix:///var/run/docker.sock
    volumes:
      - runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - xetup

  web:
    image: nginx:alpine
    container_name: xetup-web
    restart: unless-stopped
    volumes:
      - ./web:/usr/share/nginx/html:ro
      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)
    networks:
      - xetup

volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup


Čisté. Hotovo – shrnutí toho, co vzniklo, a co musíš udělat ty:

---

## Co je hotové

**`docker-compose.yml`** – přidán `xetup-web` nginx container na portu 3200, Forgejo přesměrován na `git.xetup.x9.cz`

**`web/`** – tři soubory:
- `nginx.conf` – jednoduchý static file server
- `index.html` – landing page (logo, tagline, 4 karty, linky)
- `spec/index.html` – kompletní specifikace/anotační stránka (25 kroků, statusy, expandovatelné detaily, "Diskuse →" linky do Forgejo)

---

## Co musíš udělat ty

**1. Spustit web container** (na serveru kde běží docker-compose):
```bash
docker compose up -d web
```

**2. Na proxy (192.168.233.129) přidat virtual host pro `git.xetup.x9.cz`:**
```nginx
server {
    listen 443 ssl;
    server_name git.xetup.x9.cz;

    # LE cert – certbot --expand nebo nový cert
    ssl_certificate     /etc/letsencrypt/live/git.xetup.x9.cz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/git.xetup.x9.cz/privkey.pem;

    location / {
        proxy_pass http://<SERVER_IP>:3100;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

**3. Upravit stávající `xetup.x9.cz` virtual host** – změnit proxy_pass z `:3100` na `:3200`

**4. LE cert pro `git.xetup.x9.cz`:**
```bash
certbot --nginx -d git.xetup.x9.cz
```

**5. Forgejo restart** (pro aplikaci nové ROOT_URL):
```bash
docker compose restart forgejo
```

---

Potom bude `xetup.x9.cz/spec/` živá – projdi si to a uvidíš kde "Diskuse →" tlačítka vedou. Issues v Forgejo vytvoříme až budeme mít účty.


Stavíme web xetup.x9.cz – landing page a spec/anotační stránka jsou hotové, docker-compose aktualizován. Další krok: spustit `docker compose up -d web` na serveru a upravit nginx proxy. (disable recaps in /config)


jo, jsem s tím OK. Na proxy běží nginx a směrování na xetup.x9.cz je už udělaný i s LE certifikátama