Ahoj. spadla session. Pojďme pokjračovat, tohle je dnešní kontext ❯ shrň aktuálnní stav a pojďme plánovat dnešek

  Recalled 3 memories (ctrl+o to expand)

● Dobře, mám kompletní přehled. Shrnu:

  ---
  Aktuální stav

  Co existuje a funguje:
  - Deploy-Windows.ps1 + 8 subscriptů (00–08)
  - BackInfo v assets, review.html jako jednorázový review nástroj
  - Forgejo běží na localhost:3100
  - Dokumentace v docs/ (review v1+v2, spec od kolegy)

  Co je rozbité / musí se opravit (Must fix):
  - OneDrive uninstall – pořád tam je v 03 a 04
  - Admin účet adminx9 – musí mít no password + FullName "X9.cz s.r.o."
  - 07-desktop-info.ps1 – ke smazání, nahradit BackInfo deploym. krokem
  - Atera Agent – install krok chybí
  - Edge policies – jen 2 klíče místo ~15
  - powercfg settings – chybí
  - Proxy auto-detect disable – chybí

  Co je navíc plánováno (New features):
  - Taskbar pinned apps (admin vs user varianta, -ProfileType)
  - Explorer: ShowRecent=0, ShowFrequent=0, FullPath=1
  - Network discovery + private profile
  - Rename PC jako finální krok
  - C:\X9 adresář s ikonkou

  Architektura (dlouhodobě):
  - Go TUI launcher (xetup.exe)
  - spec.yaml jako single source of truth
  - Živá doc stránka na xetup.x9.cz

  ---
  Plán na dnešek

  Co chceš řešit? Navrhuji 3 možné směry:

  A) Must-fix vlna – opravit kritické věci (OneDrive, admin účet, BackInfo nasazení, Atera, Edge policies, powercfg, proxy)

  B) Nové features – implementovat taskbar, explorer tweaks, rename PC, C:\X9

  C) Architektura – rozjet Go TUI launcher nebo spec.yaml

  Nebo kombinace – co ti dnes dává největší smysl?

❯ pojďme od konce - udělejme tu architekturu.

● Dobře, architektura. Než začneme navrhovat, podívám se co v repo aktuálně existuje.

  Searched for 2 patterns, read 2 files (ctrl+o to expand)

● Dobře, mám plný přehled. Go žádný kód, Forgejo běží. Pojďme si ujasnit scope dnešku, než začneme psát kód.

  Architektura má tři vzájemně provázané části:

  spec.yaml  ──┬──▶  xetup.exe (Go TUI)   ──▶  spustí PS scripty
               └──▶  docs na xetup.x9.cz  ──▶  auto-generovaná dokumentace

  spec.yaml je základ pro oboje – popisuje kroky, konfigurovatelné hodnoty, metadata.

  Go TUI (xetup.exe) – co by dělalo v praxi:
  1. Spustíš .exe na klientském PC jako admin
  2. Ukáže formulář (huh): název klienta, jméno PC, profil admin/user
  3. Spustí kroky s progress barem (bubbletea), live log output
  4. Na konci summary OK/ERROR

  Web – landing page + download + auto-docs z spec.yaml, CI přes Forgejo Actions

  ---
  Než začneme: pár otázek abychom nemuseli přepisovat:

  1. spec.yaml vs config.json – nahrazuje spec.yaml úplně config.json, nebo config.json zůstane jako per-klient runtime config a spec.yaml je schéma/workflow definice?
  2. TUI formulář – jaké hodnoty by technik vyplňoval? Minimálně: jméno PC + profil type (admin/user). Co dalšího? Timezone? Software list?
  3. Kde to dnes chceš dotáhnout? Navrhuji toto pořadí:
    - A) spec.yaml návrh + Go modul inicializace + TUI skeleton (form → spustit scripty)
    - B) Nebo nejdřív web (landing page + download) a Go potom
    - C) Nebo čistě spec.yaml jako základ a zbytek příště

  Co říkáš?

✻ Cooked for 45s

❯ ad 1) xetup by po stažení měl umět fungovat i offline (asi). Tedy - asi obojí?

● Dává smysl. Takhle by to fungovalo:

  xetup.exe (single binary)
  ├── go:embed  scripts/*.ps1       ← všechny PS scripty
  ├── go:embed  assets/             ← BackInfo.exe, loga
  ├── go:embed  spec.yaml           ← workflow definice + defaults
  └── čte       config.json (opt.)  ← per-klient overrides, vedle .exe na USB

  spec.yaml = baked in, popisuje co xetup umí dělat + výchozí hodnoty
  config.json = volitelný runtime soubor pro konkrétního klienta (produktový klíč, software list, ...)
  TUI formulář = interaktivně doplní co config.json neobsahuje

  Technik v praxi:
  - Varanta A (genericky): stáhne xetup.exe, spustí, vyplní formulář
  - Varianta B (per-klient): stáhne xetup.exe + config.json připravený pro toho klienta, formulář je předvyplněný

  Offline funguje v obou případech, winget a Atera samozřejmě potřebují net.

  ---
  Zbývají tvoje otázky 2 a 3. Ad 2) co by technik vyplňoval v TUI:

  Navrhuji minimum:
  - Jméno PC (Rename-Computer)
  - Profil (admin / user → jiný taskbar layout)
  - Produktový klíč (pokud není v config.json)

  Má smysl mít víc polí přímo v TUI, nebo zbytek řeší config.json pro daného klienta?

❯ jméno PC + popis | tvou otázku na profil nechápu | klíč ano | do budoucna asi ovpn soubor + login + pass & uživatel pro přidání do domény & doménový uživatel pro vytvoření profilu

● Jasně, dobře. K "profilu" – byl to odkaz na kolegův spec v2: různé sady pinnutých appek na taskbaru pro "admin" (power user) vs "běžný uživatel". Zatím to přeskočíme, vrátíme se až to budeme
  implementovat.

  Takže TUI formulář pro dnešek:

  [1/3] Identifikace
    PC name        [ KLIENT-PC-01       ]
    PC description [ HP EliteBook 840   ]

  [2/3] Aktivace
    Product key    [ XXXXX-XXXXX-...    ]  (enter = přeskočit)

  [3/3] Potvrdit a spustit
    ✓ Spustit deployment

  Future fields (zatím jen placeholders v kódu): OpenVPN, doménový join, doménový uživatel.

  ---
  Navrhuju takový plán na dnešek – řekneme jestli to je reálné nebo to ořežeme:

  1. spec.yaml schema – co embednout, jaká jsou defaults, jaká pole TUI vyžaduje
  2. Go modul init – cmd/xetup/, internal/, go.mod, závislosti (bubbletea, huh, lipgloss)
  3. TUI form – ta 3-krokový huh form výše
  4. go:embed – scripts/ + assets/ do binárky
  5. Execute – extrahovat do temp, spustit Deploy-Windows.ps1 s parametry, live log output

  Začneme od (1) nebo rovnou (2)?

❯ při spuštění by měla být možnost jednotlivé sekcea scripty on/off a uložit to do configu pro spuštění

● Perfektní, to dává smysl. To mění TUI flow na:

  [1] Identifikace       PC name + description + key
  [2] Kroky              checklist – on/off pro každý script
  [3] Uložit config?     ano → config.json vedle .exe
  [4] Spouštění          live log + progress
  [5] Shrnutí            OK: 8 / ERROR: 1

  A config.json pak vypadá takhle – kombinace runtime hodnot + stav kroků:

  {
    "pc":        { "name": "KLIENT-PC-01", "description": "HP EliteBook 840" },
    "activation":{ "productKey": "XXXXX-..." },
    "steps": {
      "admin-account": true,
      "bloatware":     true,
      "software":      true,
      "activation":    false
    }
  }

  Příště technik přijde k dalšímu PC stejného klienta – spustí exe + config.json, vše předvyplněné.

  spec.yaml (embedded) definuje kroky + defaults:

  steps:
    - id: admin-account
      label: "Admin account (adminx9)"
      script: 00-admin-account.ps1
      default: true
    - id: bloatware
      label: "Bloatware removal"
      script: 01-bloatware.ps1
      default: true
    - id: activation
      label: "Windows activation"
      script: 08-activation.ps1
      default: true
      requires: [productKey]   # ← TUI upozorní pokud chybí
    ...

  ---
  Jsme aligned. Začínám od spec.yaml a Go modulu – navrhuji tuhle adresářovou strukturu:

  xetup/
  ├── cmd/xetup/
  │   └── main.go
  ├── internal/
  │   ├── config/     config.json read/write
  │   ├── spec/       spec.yaml parsing
  │   ├── tui/        bubbletea + huh forms
  │   └── runner/     embed + execute PS
  ├── spec.yaml
  ├── go.mod
  └── go.sum

  Jdeme na to?

※ recap: Navrhujeme architekturu Go TUI launcheru (xetup.exe) pro Windows deployment. Máme odsouhlasený spec.yaml + adresářovou strukturu a čekáme na Filipův souhlas, abychom začali psát kód.
  (disable recaps in /config)

❯ pojďme z jiné strany: |Udělejme web xetup.x9.cz a na něm zatím pouze tu dokumentační a anotační stránku. Pomocí té si schválíme popř. okomentujeme to, co má xetup dělat a nastavovat - a pak
  to zrealizujeme. Co myslíš?

● Chytré – nejdřív si odsouhlasit co xetup dělá, pak implementovat. Nestavět slepe.

  Než navrhnu řešení, potřebuju vědět co je na xetup.x9.cz aktuálně za infrastruktura.

  Read 2 files (ctrl+o to expand)

● Bash(curl -s http://localhost:3100 -o /dev/null -w "%{http_code}" 2>/dev/null && echo " - Forgejo up" || echo "Forgejo nedostupny")
  ⎿  200 - Forgejo up

● Bash(curl -s http://localhost:3100/api/v1/settings/api 2>/dev/null | python3 -m json.tool 2>/dev/null | head -20)
  ⎿  {
         "max_response_items": 50,
         "default_paging_num": 30,
     … +3 lines (ctrl+o to expand)

● Bash(curl -s "http://localhost:3100/api/v1/repos/search?limit=10&token=" 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); [print(r['full_name']) fo…)
  ⎿  x9/xetup

● Repo x9/xetup v Forgejo existuje, Forgejo běží. Teď potřebuju vědět o infrastruktuře víc, jinak budu navrhovat naslepo.

  Pár otázek:

  1. Co je teď na xetup.x9.cz? Zobrazuje se tam přímo Forgejo, nebo je tam zatím nic / placeholder?
  2. Reverse proxy – Forgejo v docker-compose je na portu 3100 "behind reverse proxy". Co dělá tu proxy? nginx / caddy / Traefik na hostu? Nebo je to na jiném serveru?
  3. Kde chceš mít Forgejo – na xetup.x9.cz root, nebo spíš git.xetup.x9.cz a vlastní landing page na rootu?
  4. Kolega – má účet v Forgejo, nebo komentuje přes něco jiného?

  Na základě toho navrhnu buď:
  - A) Forgejo Pages (zero nové infrastruktury, stránka z repa)
  - B) Přidat nginx container do docker-compose (plná kontrola nad designem)
  - C) Přesunout Forgejo na git.xetup.x9.cz, vlastní stránka na rootu

✻ Baked for 1m 23s

❯ 1) jasně, není tam nic .. budujeme na zelé louce 2) proxy je na 192.168.233.129 .. teoreticky bys mohl mít ssh key, pokud ne, dej mi interaktivní login asi nebo to vymysli :-) 3) vlasní
  landing, jasně 4) kašleme na kolegu, budu to komentovat já i on neboi i někdo jiný. Zapomeňme na workflow "já navrhuji, kolega komentuje". Prostě je tým pro vývoj účty na forgeji nemám ani
  já ani nikdo jiný z firmy ABC) nevím, diskutujme

● Dobře, pojďme to diskutovat.

  Infrastruktura:
  Forgejo + nginx container přidám přímo do docker-compose, nemusíme sahat na proxy 192.168.233.129 jinak než přidat jeden virtual host. SSH mi zatím nechybí – nginx container bude servovat
  statický web, proxy jen přeposílá na něj. Ukážu ti co přesně napsat do nginx configu na proxi.

  Komentáře – možnosti:

  ┌───────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────┬────────────────────────────────────────────┐
  │                 Varianta                  │                                Jak to funguje                                │               Co to vyžaduje               │
  ├───────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
  │ A) Forgejo Issues                         │ Každá sekce má tlačítko → otevře issue v Forgejo                             │ Účty v Forgejo (admin je vytvoří za 2 min) │
  ├───────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
  │ B) Inline form → Forgejo API              │ Kdokoliv s URL může napsat komentář bez loginu, vytvoří issue přes bot token │ Žádné účty, ale anonymous abuse risk       │
  ├───────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
  │ C) Veřejný Forgejo + web UI               │ Kdo chce komentovat, zaregistruje se sám – ale máš DISABLE_REGISTRATION=true │ Buď zapnout registraci, nebo pozvánky      │
  ├───────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────┼────────────────────────────────────────────┤
  │ D) Zapomenout na comments, stránka = spec │ Stránka je read-only, diskuse probíhá mimo (slack, email, osobně)            │ Nic                                        │
  └───────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────────┴────────────────────────────────────────────┘

  Moje doporučení: varianta A – Forgejo Issues. Proč:
  - Threaded diskuse, email notifikace, searchable history
  - Pro 2-3 lidi z X9 stačí admin vytvořit účty za 5 minut
  - Stránka pak má u každé sekce tlačítko "Diskuse →" které otevře příslušný issue

  Co bychom dnes postavili:

  xetup.x9.cz          → nginx → landing page (static HTML)
  git.xetup.x9.cz       → nginx → Forgejo (3100)
  xetup.x9.cz/spec      → static HTML: doc/annotation page

  docker-compose dostane nginx service, Forgejo změní ROOT_URL na git.xetup.x9.cz.

  Plán:
  1. Aktualizovat docker-compose (nginx + ROOT_URL)
  2. Vytvořit Forgejo účty
  3. Postavit landing page + spec stránku (HTML, vychází z review.html designu)
  4. Na proxy (192.168.233.129) přidat 2 virtual hosty

  Jsi s tím OK? A co proxy – co tam běží, nginx nebo caddy? Pokud nechceš řešit SSH přístup, dej mi vědět a napíšu config + ty ho tam nakopíruješ.

✻ Brewed for 45s

❯ jo, jsem s tím OK. Na proxy běží nginx a směrování na xetup.x9.cz je už udělaný i s LE certifikátama

● Perfektní – to je ideální výchozí bod. Proxy config měnit nebudeš muset moc, jenom přidat jeden virtual host pro git.xetup.x9.cz a přesměrovat xetup.x9.cz z portu 3100 na 3200.

  Pustím se do toho:
  - docker-compose: přidat nginx web container (port 3200)
  - Forgejo: ROOT_URL → git.xetup.x9.cz
  - landing page + spec/anotační stránka
  - na konci ti dám přesný nginx snippet pro proxy

  Read 1 file (ctrl+o to expand)

● Výborně. Pustím se do toho – píšu docker-compose, nginx config, landing page a spec stránku souběžně.

● Bash(mkdir -p /opt/xetup/web/spec)
  ⎿  Error: Exit code 1
     mkdir: cannot create directory ‘/opt/xetup/web’: Permission denied

  Listed 1 directory (ctrl+o to expand)

● Bash(sudo mkdir -p /opt/xetup/web/spec && sudo chown -R dev:dev /opt/xetup/web)
  ⎿  (No output)

● Teď píšu všechno najednou:

● Write(web/nginx.conf)
  ⎿  Wrote 17 lines to web/nginx.conf
       1 server {
       2     listen 80;
       3     server_name _;
       4     root /usr/share/nginx/html;
       5     index index.html;
       6     charset utf-8;
       7
       8     location / {
       9         try_files $uri $uri/ $uri.html =404;
      10     }
     … +7 lines (ctrl+o to expand)

● Write(web/index.html)
  ⎿  Wrote 235 lines to web/index.html
       1 <!DOCTYPE html>
       2 <html lang="cs">
       3 <head>
       4 <meta charset="UTF-8">
       5 <meta name="viewport" content="width=device-width, initial-scale=1.0">
       6 <title>Xetup - Windows deployment pro X9.cz</title>
       7 <style>
       8   :root {
       9     --bg: #0f1117;
      10     --card: #1a1d27;
     … +225 lines (ctrl+o to expand)

● Teď hlavní stránka – specifikace s anotacemi:

✻ Moonwalking… (3m 13s · ↓ 1.8k tokens · thought for 47s)
  ⎿  Tip: Use /btw to ask a quick side question without interrupting Claude's current work


AskUserQuestion CronCreate CronDelete CronList EnterPlanMode EnterWorktree ExitPlanMode ExitWorktree Monitor NotebookEdit RemoteTrigger TaskCreate TaskGet TaskList TaskOutput TaskStop TaskUpdate WebFetch WebSearch


- update-config: Use this skill to configure the Claude Code harness via settings.json. Automated behaviors ("from now on when X", "each time X", "whenever X", "before/after X") require hooks configured in settings.json - the harness executes these, not Claude, so memory/preferences cannot fulfill them. Also use for: permissions ("allow X", "add permission", "move permission to"), env vars ("set X=Y"), hook troubleshooting, or any changes to settings.json/settings.local.json files. Examples: "allow npm commands", "add bq permission to global settings", "move permission to user settings", "set DEBUG=true", "when claude stops show X". For simple settings like theme/model, use Config tool.
- keybindings-help: Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify ~/.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
- simplify: Review changed code for reuse, quality, and efficiency, then fix any issues found.
- loop: Run a prompt or slash command on a recurring interval (e.g. /loop 5m /foo). Omit the interval to let the model self-pace. - When the user wants to set up a recurring task, poll for status, or run something repeatedly on an interval (e.g. "check the deploy every 5 minutes", "keep running /babysit-prs"). Do NOT invoke for one-off tasks.
- schedule: Create, update, list, or run scheduled remote agents (triggers) that execute on a cron schedule. - When the user wants to schedule a recurring remote agent, set up automated tasks, create a cron job for Claude Code, or manage their scheduled agents/triggers.
- claude-api: Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching.
TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project.
SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.
- init: Initialize a new CLAUDE.md file with codebase documentation
- statusline: Set up Claude Code's status line UI
- review: Review a pull request
- security-review: Complete a security review of the pending changes on the current branch
- insights: Generate a report analyzing your Claude Code sessions
- team-onboarding: Help teammates ramp on Claude Code with a guide from your usage


Pokračuji – píšu spec stránku a docker-compose update.


1	<!DOCTYPE html>
2
3
4	<meta charset="UTF-8">
5	<meta name="viewport" content="width=device-width, initial-scale=1.0">
6	<title>Xetup - Windows deployment pro X9.cz</title>
7
173
174
175
176
177

178	    xetupby X9.cz
179

180
181	    Specifikace
182	    Git
183	    Issues
184
185
186
187
188
MSP deployment tool — X9.cz

189
190
Automaticky nastavene Windows za 20 minut

191
192

193	    Nahrazuje 3 hodiny rucniho nastavovani jednim skriptem.
194	    Win10 + Win11, OEM i cisty install, funguje offline.
195

196
197

198	    Zobrazit specifikaci
199	    Git repozitar
200

201
202

203

204	      ⚙
205
~20 stroju / mesic

206
Ruzni klienti, Win10 i Win11, vcetne nepodporovaneho HW.

207

208

209	      🔒
210
Offline provoz

211
Scripty + assets jsou soucasti balicku. Site jen pro winget a Atera.

212

213

214	      📄
215
Per-client config

216
config.json vedle .exe pro opakovatelne nasazeni u stejneho klienta.

217

218

219	      🚀
220
Go TUI launcher

221
xetup.exe — jednotny binarni spoustec. Zatim ve vyvoji.

222

223

224
225
226
227	  © 2026 X9.cz s.r.o.
228	   ·
229	  Forgejo
230	   ·
231	  Specifikace
232
233
234
235
236

<!DOCTYPE html>

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Xetup - Windows deployment pro X9.cz</title>

    xetupby X9.cz

    Specifikace
    Git
    Issues

MSP deployment tool — X9.cz

Automaticky nastavene Windows za 20 minut

    Nahrazuje 3 hodiny rucniho nastavovani jednim skriptem.
    Win10 + Win11, OEM i cisty install, funguje offline.

    Zobrazit specifikaci
    Git repozitar

      ⚙

~20 stroju / mesic

Ruzni klienti, Win10 i Win11, vcetne nepodporovaneho HW.

      🔒

Offline provoz

Scripty + assets jsou soucasti balicku. Site jen pro winget a Atera.

      📄

Per-client config

config.json vedle .exe pro opakovatelne nasazeni u stejneho klienta.

      🚀

Go TUI launcher

xetup.exe — jednotny binarni spoustec. Zatim ve vyvoji.

  © 2026 X9.cz s.r.o.
   ·
  Forgejo
   ·
  Specifikace


docker-compose.yml


1	services:
2	  forgejo:
3	    image: codeberg.org/forgejo/forgejo:9
4	    container_name: xetup-forgejo
5	    restart: unless-stopped
6	    environment:
7	      - USER_UID=1000
8	      - USER_GID=1000
9	      # Forgejo config via env
10	      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
11	      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
12	      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz
13	      - FORGEJO__server__SSH_PORT=2222
14	      - FORGEJO__server__LFS_START_SERVER=true
15	      - FORGEJO__database__DB_TYPE=sqlite3
16	      - FORGEJO__service__DISABLE_REGISTRATION=true
17	      - FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
18	      - FORGEJO__ui__DEFAULT_THEME=forgejo-dark
19	      - FORGEJO__repository__DEFAULT_BRANCH=main
20	      - FORGEJO__actions__ENABLED=true
21	      - FORGEJO__indexer__REPO_INDEXER_ENABLED=true
22	    volumes:
23	      - forgejo-data:/data
24	      - /etc/timezone:/etc/timezone:ro
25	      - /etc/localtime:/etc/localtime:ro
26	    ports:
27	      - "3100:3000"     # Web UI (behind reverse proxy)
28	      - "2222:22"       # Git SSH
29	    networks:
30	      - xetup
31
32	  runner:
33	    image: code.forgejo.org/forgejo/runner:6.3.1
34	    container_name: xetup-runner
35	    restart: unless-stopped
36	    depends_on:
37	      - forgejo
38	    environment:
39	      - DOCKER_HOST=unix:///var/run/docker.sock
40	    volumes:
41	      - runner-data:/data
42	      - /var/run/docker.sock:/var/run/docker.sock
43	    networks:
44	      - xetup
45
46	  web:
47	    image: nginx:alpine
48	    container_name: xetup-web
49	    restart: unless-stopped
50	    volumes:
51	      - ./web:/usr/share/nginx/html:ro
52	      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
53	    ports:
54	      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)
55	    networks:
56	      - xetup
57
58	volumes:
59	  forgejo-data:
60	  runner-data:
61
62	networks:
63	  xetup:
64	    name: xetup
65

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    container_name: xetup-forgejo
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      # Forgejo config via env
      - FORGEJO__server__ROOT_URL=https://git.xetup.x9.cz
      - FORGEJO__server__DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_DOMAIN=git.xetup.x9.cz
      - FORGEJO__server__SSH_PORT=2222
      - FORGEJO__server__LFS_START_SERVER=true
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__service__DISABLE_REGISTRATION=true
      - FORGEJO__service__REQUIRE_SIGNIN_VIEW=false
      - FORGEJO__ui__DEFAULT_THEME=forgejo-dark
      - FORGEJO__repository__DEFAULT_BRANCH=main
      - FORGEJO__actions__ENABLED=true
      - FORGEJO__indexer__REPO_INDEXER_ENABLED=true
    volumes:
      - forgejo-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3100:3000"     # Web UI (behind reverse proxy)
      - "2222:22"       # Git SSH
    networks:
      - xetup

  runner:
    image: code.forgejo.org/forgejo/runner:6.3.1
    container_name: xetup-runner
    restart: unless-stopped
    depends_on:
      - forgejo
    environment:
      - DOCKER_HOST=unix:///var/run/docker.sock
    volumes:
      - runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - xetup

  web:
    image: nginx:alpine
    container_name: xetup-web
    restart: unless-stopped
    volumes:
      - ./web:/usr/share/nginx/html:ro
      - ./web/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "3200:80"     # Web (xetup.x9.cz via reverse proxy)
    networks:
      - xetup

volumes:
  forgejo-data:
  runner-data:

networks:
  xetup:
    name: xetup


1	# MSP Windows Deployment - Specification (SPEC.md)
2
3	> Version: 0.2 (draft)
4	> Author: X9.cz
5	> Purpose: Automated preparation of new Windows 10/11 computers for clients
6
7	---
8
9	## Overview
10
11	Script replaces ~3 hours of manual computer setup. Run once as Administrator on
12	already-installed Windows, performs everything automatically, saves result to Default
13	Profile so settings apply to every subsequent user.
14
15	---
16
17	## Prerequisites
18
19	- Windows 10 or Windows 11 (x64)
20	- Run as Administrator
21	- Internet connection (for winget installs)
22	- Computer received either as clean OEM install or with manufacturer pre-installed Windows
23
24	---
25
26	## What the script does NOT do
27
28	- Does not install Windows (not an autounattend.xml for clean install)
29	- Does not create images
30	- Does not manage the computer ongoing (one-time deployment)
31
32	---
33
34	## Script structure
35
36	Script is divided into steps. Each step logs its result. Steps can be skipped with switches.
37
38	---
39
40	## STEP 0a - Admin account
41
42	Creates local admin account `adminx9`:
43	- Password from `config.json` (`adminAccount.password`)
44	- Added to Administrators group
45	- Password never expires, user cannot change password
46	- Hidden from Windows login screen (SpecialAccounts\UserList = 0)
47
48	---
49
50	## STEP 0b - Windows activation
51
52	Activates Windows using product key from config:
53	- Key from `config.json` (`activation.productKey`) - set to real MAK/retail key for production
54	- Falls back to GVLK (KMS client key) matched by detected OS edition
55	- Optional KMS server via `activation.kmsServer`
56	- If already activated, skips silently
57
58	---
59
60	## STEP 1 - Bloatware removal
61
62	### 1a - AppX packages (UWP apps)
63
64	Removed for all users (-AllUsers) and from provisioned packages (so they do not return for new users).
65
66	| Package | Description |
67	|---|---|
68	| Microsoft.Microsoft3DViewer | 3D Viewer |
69	| Microsoft.BingSearch | Bing Search |
70	| Microsoft.WindowsCamera | Camera |
71	| Clipchamp.Clipchamp | Clipchamp video editor |
72	| Microsoft.WindowsAlarms | Clock / Alarm |
73	| Microsoft.Copilot | Copilot AI |
74	| Microsoft.549981C3F5F10 | Cortana |
75	| Microsoft.Windows.DevHome | Dev Home |
76	| MicrosoftCorporationII.MicrosoftFamily | Family Safety |
77	| Microsoft.WindowsFeedbackHub | Feedback Hub |
78	| Microsoft.Edge.GameAssist | Game Assist |
79	| Microsoft.GetHelp | Help |
80	| Microsoft.Getstarted | Tips / Get Started |
81	| microsoft.windowscommunicationsapps | Mail and Calendar |
82	| Microsoft.WindowsMaps | Maps |
83	| Microsoft.MixedReality.Portal | Mixed Reality |
84	| Microsoft.BingNews | News |
85	| Microsoft.MicrosoftOfficeHub | Office Hub |
86	| Microsoft.Office.OneNote | OneNote |
87	| Microsoft.OutlookForWindows | Outlook (new) |
88	| Microsoft.Paint | Paint (new UWP) |
89	| Microsoft.MSPaint | Paint (legacy) |
90	| Microsoft.People | People |
91	| Microsoft.Windows.Photos | Photos |
92	| Microsoft.PowerAutomateDesktop | Power Automate |
93	| MicrosoftCorporationII.QuickAssist | Quick Assist |
94	| Microsoft.SkypeApp | Skype |
95	| Microsoft.ScreenSketch | Snipping Tool |
96	| Microsoft.MicrosoftSolitaireCollection | Solitaire |
97	| Microsoft.MicrosoftStickyNotes | Sticky Notes |
98	| MicrosoftTeams / MSTeams | Teams (personal) |
99	| Microsoft.Todos | To Do |
100	| Microsoft.WindowsSoundRecorder | Voice Recorder |
101	| Microsoft.Wallet | Wallet |
102	| Microsoft.BingWeather | Weather |
103	| Microsoft.WindowsTerminal | Windows Terminal |
104	| Microsoft.Xbox.TCUI | Xbox UI |
105	| Microsoft.XboxApp | Xbox |
106	| Microsoft.XboxGameOverlay | Xbox Game Overlay |
107	| Microsoft.XboxGamingOverlay | Xbox Gaming Overlay |
108	| Microsoft.XboxIdentityProvider | Xbox Identity |
109	| Microsoft.XboxSpeechToTextOverlay | Xbox Speech |
110	| Microsoft.GamingApp | Gaming App |
111	| Microsoft.YourPhone | Phone Link |
112	| Microsoft.ZuneMusic | Music |
113	| Microsoft.ZuneVideo | Movies and TV |
114
115	NOTE: Microsoft.WindowsCalculator is intentionally KEPT.
116
117	### 1b - Windows Capabilities
118
119	| Capability | Description |
120	|---|---|
121	| Print.Fax.Scan | Fax and Scan |
122	| Language.Handwriting | Handwriting |
123	| Browser.InternetExplorer | Internet Explorer |
124	| MathRecognizer | Math Input |
125	| OneCoreUAP.OneSync | OneSync |
126	| OpenSSH.Client | OpenSSH client |
127	| Microsoft.Windows.MSPaint | Paint (Win32) |
128	| Microsoft.Windows.PowerShell.ISE | PowerShell ISE |
129	| App.Support.QuickAssist | Quick Assist |
130	| Microsoft.Windows.SnippingTool | Snipping Tool |
131	| App.StepsRecorder | Steps Recorder |
132	| Hello.Face.* | Windows Hello face |
133	| Media.WindowsMediaPlayer | Windows Media Player |
134	| Microsoft.Windows.WordPad | WordPad |
135
136	### 1c - Windows Optional Features
137
138	| Feature | Description |
139	|---|---|
140	| MediaPlayback | Media playback |
141	| MicrosoftWindowsPowerShellV2Root | PowerShell 2.0 |
142	| Microsoft-RemoteDesktopConnection | RDP client |
143	| Recall | Windows Recall (AI) |
144	| Microsoft-SnippingTool | Snipping Tool (feature) |
145
146	---
147
148	## STEP 2 - Software installation (winget)
149
150	| Software | Winget ID | Notes |
151	|---|---|---|
152	| 7-Zip | `7zip.7zip` | OK |
153	| Adobe Acrobat Reader | `Adobe.Acrobat.Reader.64-bit` | OK, see note |
154	| OpenVPN Connect | `OpenVPNTechnologies.OpenVPNConnect` | OK |
155	| ... | ... | TODO: complete list |
156
157	> Adobe Acrobat Reader: After install, script sets .pdf -> AcroRd32 as default.
158	> Scheduled task PDF-DefaultApp restores this association on every logon as a guard
159	> against Edge overwriting it.
160
161	> BackInfo: NOT used. Replaced by custom PowerShell scheduled task DesktopInfo.
162	> See STEP 7.
163
164	---
165
166	## STEP 3 - System settings (HKLM - applies to whole system)
167
168	| Setting | Value | Notes |
169	|---|---|---|
170	| Disable NRO (bypass network check) | HKLM\...\OOBE\BypassNRO = 1 | |
171	| Disable auto-install of Teams | ConfigureChatAutoInstall = 0 | |
172	| Disable Cloud Optimized Content | DisableCloudOptimizedContent = 1 | |
173	| Disable Widgets (News and Interests) | HKLM\...\Dsh\AllowNewsAndInterests = 0 | |
174	| Edge - hide First Run Experience | HKLM\Policies\Edge\HideFirstRunExperience = 1 | |
175	| Passwords - no expiration | net accounts /maxpwage:UNLIMITED | |
176	| Time zone | Central Europe Standard Time | |
177	| OneDrive - remove | Delete OneDriveSetup.exe + Start Menu lnk | |
178	| Outlook (new) - disable auto-install | Delete UScheduler registry key | |
179	| Disable GameDVR | AppCaptureEnabled = 0 | |
180
181	---
182
183	## STEP 4 - Default Profile (NTUSER.DAT)
184
185	Settings applied to C:\Users\Default\NTUSER.DAT - inherited by every new user on first logon.
186
187	Method: script loads Default hive (reg load), makes changes, unloads (reg unload).
188
189	| Setting | Key / Value | Description |
190	|---|---|---|
191	| Taskbar - align left | TaskbarAl = 0 | Win11 default is center |
192	| Taskbar - hide Search box | SearchboxTaskbarMode = 0 | |
193	| Taskbar - hide Copilot button | ShowCopilotButton = 0 | |
194	| Taskbar - hide Task View button | ShowTaskViewButton = 0 | |
195	| Taskbar - hide Widgets | TaskbarDa = 0 | |
196	| Taskbar - hide Chat/Teams button | TaskbarMn = 0 | |
197	| Taskbar - show all tray icons | Scheduled task ShowAllTrayIcons | Runs on every logon |
198	| Taskbar - empty pinlist | TaskbarLayoutModification.xml | Removes default pinned apps |
199	| Explorer - show file extensions | HideFileExt = 0 | |
200	| Explorer - open to This PC | LaunchTo = 1 | Instead of Quick Access |
201	| Start menu - empty pins | ConfigureStartPins = {"pinnedList":[]} | Win11 |
202	| Start menu - disable Bing results | DisableSearchBoxSuggestions = 1 | |
203	| Copilot - disable | TurnOffWindowsCopilot = 1 | |
204	| GameDVR - disable | AppCaptureEnabled = 0 | |
205	| OneDrive - remove RunOnce key | Delete OneDriveSetup from Run | |
206	| Num Lock on startup - enable | InitialKeyboardIndicators = 2 | |
207	| Accent color on title bars | ColorPrevalence = 1 | |
208
209	---
210
211	## STEP 5 - Personalization (colors, wallpaper)
212
213	Applied to both Default Profile and currently logged-in user.
214
215	| Setting | Value |
216	|---|---|
217	| System theme (taskbar, Start) | Dark |
218	| App theme | Light |
219	| Accent color | #223B47 (dark blue-gray) |
220	| Accent color on Start and taskbar | Yes |
221	| Accent color on title bars | Yes |
222	| Transparency | Disabled |
223	| Wallpaper | Solid color #223B47 (no image) |
224
225	NOTE: DesktopInfo scheduled task (STEP 7) will overwrite the wallpaper with a system
226	info BMP. The solid color here is only a fallback if DesktopInfo is not running.
227
228	---
229
230	## STEP 6 - Scheduled Tasks
231
232	| Task | Trigger | Purpose |
233	|---|---|---|
234	| ShowAllTrayIcons | Every logon, every 1 min | Show all icons in system tray (Win11) |
235	| UnlockStartLayout | Once after layout is applied | Unlock Start menu layout |
236	| PDF-DefaultApp | Every logon | Restore .pdf -> Adobe Reader if Edge overwrote it |
237	| DesktopInfo | Every logon | Render system info onto desktop wallpaper |
238
239	---
240
241	## STEP 7 - DesktopInfo (BackInfo replacement)
242
243	Custom PowerShell scheduled task. No external dependencies.
244
245	**What it displays:**
246	- Computer name (hostname)
247	- IP address
248	- Windows version and build
249	- Logged-in username
250	- Deployment date
251
252	**How it works:**
253	1. PS script collects system info
254	2. Renders text onto bitmap via WPF / System.Drawing
255	3. Saves BMP to C:\Windows\Setup\Scripts\desktopinfo.bmp
256	4. Sets BMP as desktop wallpaper via SystemParametersInfo
257	5. Runs on every user logon via Scheduled Task
258
259	**Why not BackInfo:**
260	- BackInfo has Win11 rendering issues requiring registry hacks
261	- External EXE dependency is hard to distribute
262	- Custom PS solution = full control, no dependencies, works on Win10 and Win11
263
264	---
265
266	## STEP 8 - Logging and output
267
268	- Every step writes to C:\Windows\Setup\Scripts\Deploy.log
269	- Format: [HH:mm:ss] Step description - OK / ERROR: ...
270	- At end: summary report (how many steps OK, how many failed)
271	- Log stays on disk for diagnostics
272
273	---
274
275	## Script switches
276
277	| Switch | Behavior |
278	|---|---|
279	| `-SkipBloatware` | Skip step 1 |
280	| `-SkipSoftware` | Skip step 2 |
281	| `-SkipDefaultProfile` | Skip step 4 |
282	| `-DryRun` | Run through steps without changes, log only |
283
284	---
285
286	## Open questions
287
288	| # | Question | Status |
289	|---|---|---|
290	| 1 | BackInfo replacement | DONE - custom PS scheduled task DesktopInfo |
291	| 2 | Complete SW list for winget | TODO |
292	| 3 | Per-client variability via config.json | FUTURE |
293	| 4 | Admin account adminx9 - script or manual? | DONE - script (00-admin-account.ps1) |
294

# MSP Windows Deployment - Specification (SPEC.md)

> Version: 0.2 (draft)
> Author: X9.cz
> Purpose: Automated preparation of new Windows 10/11 computers for clients

---

## Overview

Script replaces ~3 hours of manual computer setup. Run once as Administrator on
already-installed Windows, performs everything automatically, saves result to Default
Profile so settings apply to every subsequent user.

---

## Prerequisites

- Windows 10 or Windows 11 (x64)
- Run as Administrator
- Internet connection (for winget installs)
- Computer received either as clean OEM install or with manufacturer pre-installed Windows

---

## What the script does NOT do

- Does not install Windows (not an autounattend.xml for clean install)
- Does not create images
- Does not manage the computer ongoing (one-time deployment)

---

## Script structure

Script is divided into steps. Each step logs its result. Steps can be skipped with switches.

---

## STEP 0a - Admin account

Creates local admin account `adminx9`:
- Password from `config.json` (`adminAccount.password`)
- Added to Administrators group
- Password never expires, user cannot change password
- Hidden from Windows login screen (SpecialAccounts\UserList = 0)

---

## STEP 0b - Windows activation

Activates Windows using product key from config:
- Key from `config.json` (`activation.productKey`) - set to real MAK/retail key for production
- Falls back to GVLK (KMS client key) matched by detected OS edition
- Optional KMS server via `activation.kmsServer`
- If already activated, skips silently

---

## STEP 1 - Bloatware removal

### 1a - AppX packages (UWP apps)

Removed for all users (-AllUsers) and from provisioned packages (so they do not return for new users).

| Package | Description |
|---|---|
| Microsoft.Microsoft3DViewer | 3D Viewer |
| Microsoft.BingSearch | Bing Search |
| Microsoft.WindowsCamera | Camera |
| Clipchamp.Clipchamp | Clipchamp video editor |
| Microsoft.WindowsAlarms | Clock / Alarm |
| Microsoft.Copilot | Copilot AI |
| Microsoft.549981C3F5F10 | Cortana |
| Microsoft.Windows.DevHome | Dev Home |
| MicrosoftCorporationII.MicrosoftFamily | Family Safety |
| Microsoft.WindowsFeedbackHub | Feedback Hub |
| Microsoft.Edge.GameAssist | Game Assist |
| Microsoft.GetHelp | Help |
| Microsoft.Getstarted | Tips / Get Started |
| microsoft.windowscommunicationsapps | Mail and Calendar |
| Microsoft.WindowsMaps | Maps |
| Microsoft.MixedReality.Portal | Mixed Reality |
| Microsoft.BingNews | News |
| Microsoft.MicrosoftOfficeHub | Office Hub |
| Microsoft.Office.OneNote | OneNote |
| Microsoft.OutlookForWindows | Outlook (new) |
| Microsoft.Paint | Paint (new UWP) |
| Microsoft.MSPaint | Paint (legacy) |
| Microsoft.People | People |
| Microsoft.Windows.Photos | Photos |
| Microsoft.PowerAutomateDesktop | Power Automate |
| MicrosoftCorporationII.QuickAssist | Quick Assist |
| Microsoft.SkypeApp | Skype |
| Microsoft.ScreenSketch | Snipping Tool |
| Microsoft.MicrosoftSolitaireCollection | Solitaire |
| Microsoft.MicrosoftStickyNotes | Sticky Notes |
| MicrosoftTeams / MSTeams | Teams (personal) |
| Microsoft.Todos | To Do |
| Microsoft.WindowsSoundRecorder | Voice Recorder |
| Microsoft.Wallet | Wallet |
| Microsoft.BingWeather | Weather |
| Microsoft.WindowsTerminal | Windows Terminal |
| Microsoft.Xbox.TCUI | Xbox UI |
| Microsoft.XboxApp | Xbox |
| Microsoft.XboxGameOverlay | Xbox Game Overlay |
| Microsoft.XboxGamingOverlay | Xbox Gaming Overlay |
| Microsoft.XboxIdentityProvider | Xbox Identity |
| Microsoft.XboxSpeechToTextOverlay | Xbox Speech |
| Microsoft.GamingApp | Gaming App |
| Microsoft.YourPhone | Phone Link |
| Microsoft.ZuneMusic | Music |
| Microsoft.ZuneVideo | Movies and TV |

NOTE: Microsoft.WindowsCalculator is intentionally KEPT.

### 1b - Windows Capabilities

| Capability | Description |
|---|---|
| Print.Fax.Scan | Fax and Scan |
| Language.Handwriting | Handwriting |
| Browser.InternetExplorer | Internet Explorer |
| MathRecognizer | Math Input |
| OneCoreUAP.OneSync | OneSync |
| OpenSSH.Client | OpenSSH client |
| Microsoft.Windows.MSPaint | Paint (Win32) |
| Microsoft.Windows.PowerShell.ISE | PowerShell ISE |
| App.Support.QuickAssist | Quick Assist |
| Microsoft.Windows.SnippingTool | Snipping Tool |
| App.StepsRecorder | Steps Recorder |
| Hello.Face.* | Windows Hello face |
| Media.WindowsMediaPlayer | Windows Media Player |
| Microsoft.Windows.WordPad | WordPad |

### 1c - Windows Optional Features

| Feature | Description |
|---|---|
| MediaPlayback | Media playback |
| MicrosoftWindowsPowerShellV2Root | PowerShell 2.0 |
| Microsoft-RemoteDesktopConnection | RDP client |
| Recall | Windows Recall (AI) |
| Microsoft-SnippingTool | Snipping Tool (feature) |

---

## STEP 2 - Software installation (winget)

| Software | Winget ID | Notes |
|---|---|---|
| 7-Zip | `7zip.7zip` | OK |
| Adobe Acrobat Reader | `Adobe.Acrobat.Reader.64-bit` | OK, see note |
| OpenVPN Connect | `OpenVPNTechnologies.OpenVPNConnect` | OK |
| ... | ... | TODO: complete list |

> Adobe Acrobat Reader: After install, script sets .pdf -> AcroRd32 as default.
> Scheduled task PDF-DefaultApp restores this association on every logon as a guard
> against Edge overwriting it.

> BackInfo: NOT used. Replaced by custom PowerShell scheduled task DesktopInfo.
> See STEP 7.

---

## STEP 3 - System settings (HKLM - applies to whole system)

| Setting | Value | Notes |
|---|---|---|
| Disable NRO (bypass network check) | HKLM\...\OOBE\BypassNRO = 1 | |
| Disable auto-install of Teams | ConfigureChatAutoInstall = 0 | |
| Disable Cloud Optimized Content | DisableCloudOptimizedContent = 1 | |
| Disable Widgets (News and Interests) | HKLM\...\Dsh\AllowNewsAndInterests = 0 | |
| Edge - hide First Run Experience | HKLM\Policies\Edge\HideFirstRunExperience = 1 | |
| Passwords - no expiration | net accounts /maxpwage:UNLIMITED | |
| Time zone | Central Europe Standard Time | |
| OneDrive - remove | Delete OneDriveSetup.exe + Start Menu lnk | |
| Outlook (new) - disable auto-install | Delete UScheduler registry key | |
| Disable GameDVR | AppCaptureEnabled = 0 | |

---

## STEP 4 - Default Profile (NTUSER.DAT)

Settings applied to C:\Users\Default\NTUSER.DAT - inherited by every new user on first logon.

Method: script loads Default hive (reg load), makes changes, unloads (reg unload).

| Setting | Key / Value | Description |
|---|---|---|
| Taskbar - align left | TaskbarAl = 0 | Win11 default is center |
| Taskbar - hide Search box | SearchboxTaskbarMode = 0 | |
| Taskbar - hide Copilot button | ShowCopilotButton = 0 | |
| Taskbar - hide Task View button | ShowTaskViewButton = 0 | |
| Taskbar - hide Widgets | TaskbarDa = 0 | |
| Taskbar - hide Chat/Teams button | TaskbarMn = 0 | |
| Taskbar - show all tray icons | Scheduled task ShowAllTrayIcons | Runs on every logon |
| Taskbar - empty pinlist | TaskbarLayoutModification.xml | Removes default pinned apps |
| Explorer - show file extensions | HideFileExt = 0 | |
| Explorer - open to This PC | LaunchTo = 1 | Instead of Quick Access |
| Start menu - empty pins | ConfigureStartPins = {"pinnedList":[]} | Win11 |
| Start menu - disable Bing results | DisableSearchBoxSuggestions = 1 | |
| Copilot - disable | TurnOffWindowsCopilot = 1 | |
| GameDVR - disable | AppCaptureEnabled = 0 | |
| OneDrive - remove RunOnce key | Delete OneDriveSetup from Run | |
| Num Lock on startup - enable | InitialKeyboardIndicators = 2 | |
| Accent color on title bars | ColorPrevalence = 1 | |

---

## STEP 5 - Personalization (colors, wallpaper)

Applied to both Default Profile and currently logged-in user.

| Setting | Value |
|---|---|
| System theme (taskbar, Start) | Dark |
| App theme | Light |
| Accent color | #223B47 (dark blue-gray) |
| Accent color on Start and taskbar | Yes |
| Accent color on title bars | Yes |
| Transparency | Disabled |
| Wallpaper | Solid color #223B47 (no image) |

NOTE: DesktopInfo scheduled task (STEP 7) will overwrite the wallpaper with a system
info BMP. The solid color here is only a fallback if DesktopInfo is not running.

---

## STEP 6 - Scheduled Tasks

| Task | Trigger | Purpose |
|---|---|---|
| ShowAllTrayIcons | Every logon, every 1 min | Show all icons in system tray (Win11) |
| UnlockStartLayout | Once after layout is applied | Unlock Start menu layout |
| PDF-DefaultApp | Every logon | Restore .pdf -> Adobe Reader if Edge overwrote it |
| DesktopInfo | Every logon | Render system info onto desktop wallpaper |

---

## STEP 7 - DesktopInfo (BackInfo replacement)

Custom PowerShell scheduled task. No external dependencies.

**What it displays:**
- Computer name (hostname)
- IP address
- Windows version and build
- Logged-in username
- Deployment date

**How it works:**
1. PS script collects system info
2. Renders text onto bitmap via WPF / System.Drawing
3. Saves BMP to C:\Windows\Setup\Scripts\desktopinfo.bmp
4. Sets BMP as desktop wallpaper via SystemParametersInfo
5. Runs on every user logon via Scheduled Task

**Why not BackInfo:**
- BackInfo has Win11 rendering issues requiring registry hacks
- External EXE dependency is hard to distribute
- Custom PS solution = full control, no dependencies, works on Win10 and Win11

---

## STEP 8 - Logging and output

- Every step writes to C:\Windows\Setup\Scripts\Deploy.log
- Format: [HH:mm:ss] Step description - OK / ERROR: ...
- At end: summary report (how many steps OK, how many failed)
- Log stays on disk for diagnostics

---

## Script switches

| Switch | Behavior |
|---|---|
| `-SkipBloatware` | Skip step 1 |
| `-SkipSoftware` | Skip step 2 |
| `-SkipDefaultProfile` | Skip step 4 |
| `-DryRun` | Run through steps without changes, log only |

---

## Open questions

| # | Question | Status |
|---|---|---|
| 1 | BackInfo replacement | DONE - custom PS scheduled task DesktopInfo |
| 2 | Complete SW list for winget | TODO |
| 3 | Per-client variability via config.json | FUTURE |
| 4 | Admin account adminx9 - script or manual? | DONE - script (00-admin-account.ps1) |


Docker-compose je hotový z předchozí session, nginx web service na 3200 je tam. Teď píšu spec/annotation stránku – bude vycházet z CLAUDE.md (aktuální stav), ne ze zastaralého SPEC.md.


Write

<!DOCTYPE html>

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Specifikace & anotace – xetup</title>

      xetupby X9.cz

    Specifikace
    Git
    Issues

Kroky

    00 – Admin ucet
    01 – Bloatware
    02 – Software (winget)
    03 – Registry (HKLM)
    04 – Default Profile
    05 – Personalizace
    06 – Scheduled Tasks
    07 – BackInfo
    08 – Aktivace Windows

Planovane

    PC – Prejmenovat + C:\X9
    Network discovery
    Taskbar layout

Architektura

    xetup.exe (Go TUI)
    spec.yaml

Specifikace & anotace

      Verze: 0.3-draft
      Datum: 2026-04-16
      x9/xetup
      Status: aktivni vyvoj

      OK hotovo, v provozu
      Must fix zname chyby, nutno opravit
      TODO naplanovano, nerealizovano
      Open otevrena otazka
      Warn potencialni problem
      New nova feature
      Future dlouhodoby plan

Stavajici kroky (scripty)

        00
        Admin ucet (adminx9)
        Must fix

Vytvorit lokalni ucet adminx9	Hotovo

Pridat do skupiny Administrators	Hotovo

Skryt z login obrazovky (SpecialAccounts\UserList = 0)	Hotovo

Heslo nevypirsi, uzivatel nesmeni heslo	Hotovo

Zadne heslo (aktualne heslo z config.json)	Zmenit: ucet bez hesla

FullName = "X9.cz s.r.o." (via ADSI)	Chybi, doplnit

          Poznamka: Bezpecnostni rozhodnuti – ucet bez hesla je zamerny. Ucet je skryty pred uzivateli
          a slouzi pouze pro MSP administraci. Heslo by se muselo uchovavat v config.json citelne.

        Script: 00-admin-account.ps1
        + Pridej komentar

        01
        Bloatware removal
        OK

AppX balicky – odstraneni pro vsechny uzivatele	Remove-AppxPackage -AllUsers + Remove-AppxProvisionedPackage

Zachovano: Microsoft.WindowsCalculator	Zamerny vyjimek

Windows Capabilities (Fax, IE, WMP, WordPad, …)	Remove-WindowsCapability

Windows Optional Features (PS 2.0, Media, Recall, …)	Disable-WindowsOptionalFeature

Microsoft-RemoteDesktopConnection nesmi byt odstranen	Kontrolovat – RDP klient musi zustat

OneDrive nesmi byt odstranovano tady	Odstraneni OneDrive patri jen do STEP 3

        Script: 01-bloatware.ps1
        + Pridej komentar

        02
        Software (winget)
        TODO
        Must fix

7-Zip (7zip.7zip)	OK

Adobe Acrobat Reader 64-bit (Adobe.Acrobat.Reader.64-bit)	OK

OpenVPN Connect (OpenVPNTechnologies.OpenVPNConnect)	OK

Seznam SW je neuplny – co dalsiho patri dovnitr?	TODO: doplnit

Atera Agent install chybi	Stahnout MSI + msiexec /i /qn, viz poznamka

Adobe PDF default: .pdf -> AcroRd32	Po instalaci nastavit asociaci

UCPD.sys (kernel driver, od Feb 2024) blokuje UserChoice	Zvalit deaktivaci UCPD pri deploymentu – viz otevrena otazka #5

          Atera Agent URL:

          https://x9.servicedesk.atera.com/api/utils/agent-install/windows/?cid=31&aeid=50b72e7113e54a63ac76b96c54c7e337

          Stazeni: Invoke-WebRequest -Uri <url> -OutFile setup.msi

          Instalace: msiexec /i setup.msi /qn

          UCPD.sys: Kernel driver od Microsoftu (2024) blokuje primy zapis do UserChoice registry klice,
          ktery urcuje vychozi aplikaci. Radeni: deaktivovat sluzbu behem deploymentu, nastavit asociaci, reaktivovat.
          Nebo pouzit alternativni metodu (DISM, scheduled task s .reg importem).

        Script: 02-software.ps1
        + Pridej komentar

        03
        System Registry (HKLM)
        Must fix
        TODO

Bypass NRO (OOBE\BypassNRO = 1)	OK

Zakaz auto-instalace Teams (ConfigureChatAutoInstall = 0)	OK

Zakaz Cloud Optimized Content	OK

Zakaz Widgets / News and Interests	OK

Hesla – bez expirace (net accounts /maxpwage:UNLIMITED)	OK

Casova zona: Central Europe Standard Time	OK

Zakaz GameDVR	OK

OneDrive odstraneni je tady – MUST REMOVE	OneDrive musi zustat instalovatelny pro M365. Smazat z tohoto scriptu.

Edge – skryt First Run Experience	HKLM\Policies\Edge\HideFirstRunExperience = 1

Edge policies – doplnit ~15 dalsich klicu	TODO – viz extended Edge policy list

Powercfg: standby-timeout-ac 0, monitor-timeout-ac 60	TODO – pridat do tohoto scriptu

Proxy auto-detect zakaz (AutoDetect = 0)	TODO – HKLM Internet Settings

          Edge policies k doplneni (vybrane):
          DefaultBrowserSettingEnabled = 0, NewTabPageContentEnabled = 0,
          HideFirstRunExperience = 1, ImportOnEachLaunch = 0, ShowRecommendationsEnabled = 0,
          PersonalizationReportingEnabled = 0, SpotlightExperiencesAndRecommendationsEnabled = 0 a dalsi.
          Uplny seznam: CLAUDE.md / kolegova specifikace v2.

          Powercfg pridat:

          powercfg /change standby-timeout-ac 0 (neusne pri nabijeni)

          powercfg /change monitor-timeout-ac 60 (monitor zhasne po 60 min)

          powercfg /change standby-timeout-dc 30 (na baterku usne po 30 min)

          powercfg /change monitor-timeout-dc 15

        Script: 03-system-registry.ps1
        + Pridej komentar

        04
        Default Profile (NTUSER.DAT)
        Must fix

Taskbar: zarovnat vlevo (TaskbarAl = 0)	Win11 default je center

Taskbar: skryt Search, Copilot, Task View, Widgets, Chat	OK

Taskbar: zobrazit vsechny ikonky v tray	Scheduled task ShowAllTrayIcons

Taskbar: vyprazdnit pinlist (TaskbarLayoutModification.xml)	OK

Explorer: zobrazovat pripony souboru (HideFileExt = 0)	OK

Explorer: otevrit na This PC (LaunchTo = 1)	OK

Start menu: vyprazdnit piny (Win11)	ConfigureStartPins

Start menu: zakaz Bing vyhledavani	DisableSearchBoxSuggestions = 1

Copilot: zakaz	TurnOffWindowsCopilot = 1

NumLock zapnout pri startu	InitialKeyboardIndicators = 2

Accent barva na titulnich listech	ColorPrevalence = 1

OneDrive RunOnce klic je tady – MUST REMOVE	OneDrive musi zustat. Smazat tento radek.

Explorer: ShowRecent = 0, ShowFrequent = 0	TODO – doplnit

Explorer: FullPath = 1 v CabinetState	TODO – zobrazovat plnou cestu v titulku okna

          Metoda: reg load HKU\DefaultProfile C:\Users\Default\NTUSER.DAT
          → zapsat zmeny → reg unload HKU\DefaultProfile.
          Tato metoda se MUSI delat pred prvnim prihlasenim uzivatele.
          Loggedý uzivatel dostava zmeny pres HKCU primy zapis.

        Script: 04-default-profile.ps1
        + Pridej komentar

        05
        Personalizace (barvy, tapeta)
        OK

System tema (taskbar, Start): Dark	OK

Aplikacni tema: Light	OK

Accent barva: #223B47 (tmave modroseda)	OK

Accent barva na Start a taskbaru: ano	OK

Pruhlednost: vypnuta	OK

Tapeta: jednobarevna #223B47 (bez obrazku)	BackInfo ji prepise svym BMP

          BackInfo.exe (STEP 07) prepise tapetu vlastnim BMP se systemovymi informacemi.
          Jednobarevna tapeta je fallback pro pripad, ze BackInfo nedobehne.

        Script: 05-personalization.ps1
        + Pridej komentar

        06
        Scheduled Tasks
        OK

ShowAllTrayIcons – pri logonu + kazdou 1 min	Win11 automaticky skryva tray ikony

UnlockStartLayout – jednou po aplikaci layoutu	Odemkne Start menu pro uzivatelske zmeny

PDF-DefaultApp – pri kazdem logonu	Obnovi .pdf -> Adobe Reader (Edge ho prepsuje)

ShowAllTrayIcons – pridat i logiku pro Win11 24H2	Overit ze task funguje i na novych buildech

        Script: 06-scheduled-tasks.ps1
        + Pridej komentar

        07
        BackInfo (systemovy info na tapete)
        Must fix

07-desktop-info.ps1 SMAZAT (stary pristup)	Nahradit deploym. krokem pro BackInfo.exe

Zkopirovat assets/Backinfo/ do C:\Program Files\Backinfo\	Doplnit do scriptu

Spustit backinfo_W11.ps1 (detekce OS, registry, Startup)	Doplnit do scriptu

BackInfo.exe v assets/Backinfo/ k dispozici	Hotovo – jen deploy chybi

BackInfo auto-start pri kazdem logonu via Startup shortcut	backinfo_W11.ps1 to zaridi

          Co BackInfo zobrazuje (konfigurovatelne pres BackInfo.ini):
          hostname (velky, centrovan), uzivatelske jmeno, OS, HW info, sitove info.

          Proc BackInfo (ne vlastni PS skript):
          BackInfo.exe podporuje Win10 i Win11 bez specialnich hacku a je uz v assets.
          Vlastni PS reseni by vyzadovalo udrzbu WPF/System.Drawing kodu.

        Script: 07-desktop-info.ps1 (ke smazani) → novy inline krok v master scriptu
        + Pridej komentar

        08
        Windows aktivace
        OK
        Open

Klic z config.json (activation.productKey)	OK

Fallback na GVLK (KMS client key) dle edice OS	OK

Volitelny KMS server (activation.kmsServer)	OK

Preskocit pokud jiz aktivovano	OK

Aktivacni klic: MAK vs KMS vs retail?	Otevrenya otazka – zavisi na klientovi

        Script: 08-activation.ps1
        + Pridej komentar

Nove kroky (planovane)

        09
        Rename PC + C:\X9 adresar
        New

Rename-Computer dle parametru z TUI nebo config.json	Finalni krok pred restartem – vyzaduje restart

Nastavit popis pocitace (Computer Description)	Via WMI nebo registry

Vytvorit C:\X9\ adresarovou strukturu	Pro logy, skripty, assets

Vlastni ikonka pro C:\X9\ slozku	Desktop.ini + X9-ikona.ico

          Rename-Computer vyzaduje restart. Musi byt posledni krok pred finalnim shrnutim.
          Technik vi, ze se PC po deployi restartuje.

        Script: novy (09-pc-identity.ps1)
        + Pridej komentar

        10
        Network discovery + firewall
        New

Nastavit sitovy profil jako Private (ne Public)	Set-NetConnectionProfile -NetworkCategory Private

Povolit ping (ICMP) pro diagnostiku	Firewall rule: Enable ICMPv4/ICMPv6

Zapnout Network Discovery pro Private profil	netsh advfirewall nebo Set-NetFirewallRule

          Pozor: Nastaveni sitoveho profilu (Private/Public) se muze zmenit po kazdem prihlaseni k jine siti.
          Moznost: scheduled task pri logonu pro opakovanou korekci.

        Script: novy (10-network.ps1)
        + Pridej komentar

        ---
        Taskbar pinned apps (profily)
        New
        Future

-ProfileType parametr: admin vs user varianta	Ruzna sada pinnutych appek

XML layout pro "admin": File Explorer, PS, Edge, Notepad++, …	TaskbarLayoutModification.xml

XML layout pro "user": Edge, Outlook, Teams, File Explorer, …	Odlisna sada pro bezneho zamestnance

          Win11 24H2 zmenil zpusob aplikace Taskbar layoutu. Overit kompatibilitu s novymi buildy.
          ProvisionedLayoutModification.xml vs. TaskbarLayoutModification.xml – zavisi na verzi.

        Zacleneno do STEP 04 nebo vlastni script
        + Pridej komentar

Architektura (budoucnost)

        Arc
        xetup.exe – Go TUI launcher
        Future

Single binary (go:embed scripty + assets)	Funguje offline, jedna stazitelna .exe

TUI form (huh / bubbletea): PC name, description, product key	Interaktivni zadani dat technikem

Checklist kroku (on/off per-script)	Ulozit vyber do config.json

Live log output behem spousteni PS scriptu	Pipes z powershell.exe

Finalni summary OK/ERROR	Na konci nasazeni

Self-update: stahnout novou verzi z xetup.x9.cz	Overit hash pred spustenim

config.json: per-klient preset (PC name prefix, SW, klic)	Lezi vedle .exe na USB klici klienta

OpenVPN soubor + login + heslo (future)	Zacleneni do TUI formulare

Domain join (future)	Domenove informace v TUI

          Go zavislosti:
          bubbletea (TUI framework),
          huh (forms),
          lipgloss (styling).
          Struktura: cmd/xetup/, internal/config/, internal/spec/,
          internal/tui/, internal/runner/.

        Status: navrh – zatim zadny kod
        + Pridej komentar

        Arc
        spec.yaml – single source of truth
        Future

Popis vsech kroku: id, label, script, default	xetup.exe cte spec.yaml pro TUI checklist

Pole "requires" (napr. activation vyzaduje productKey)	TUI upozorni pokud chybi

Auto-generovana dokumentace z spec.yaml	CI akce: spec.yaml → tato stranka

spec.yaml jako SSOT pro tuto stranku i deploy skripty	Idealni stav: stranka vzdy odpovida kodu

          Navrh struktury spec.yaml:

            steps:

              - id: admin-account

                label: "Admin account (adminx9)"

                script: 00-admin-account.ps1

                default: true

              - id: activation

                label: "Windows activation"

                script: 08-activation.ps1

                default: true

                requires: [productKey]

        Status: navrh – zatim zadny soubor
        + Pridej komentar

  © 2026 X9.cz s.r.o.
   ·
  Forgejo
   ·
  xetup.x9.cz


<tool_use_error>File has not been read yet. Read it first before writing to it.</tool_use_error>

Error: File has not been read yet. Read it first before writing to it.


Bash

Check if spec directory is empty


index.html


1	<!DOCTYPE html>
2	<html lang="cs">
3	<head>
4	<meta charset="UTF-8">
5	<meta name="viewport" content="width=device-width, initial-scale=1.0">

<!DOCTYPE html>
<html lang="cs">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">


Write

<!DOCTYPE html>

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Specifikace & anotace – xetup</title>

      xetupby X9.cz

    Specifikace
    Git
    Issues

Kroky (scripty)

    00 – Admin ucet
    01 – Bloatware
    02 – Software (winget)
    03 – Registry (HKLM)
    04 – Default Profile
    05 – Personalizace
    06 – Scheduled Tasks
    07 – BackInfo
    08 – Aktivace Windows

Planovane kroky

    09 – PC identita + C:\X9
    10 – Network discovery
    Taskbar profily

Architektura

    xetup.exe (Go TUI)
    spec.yaml

Specifikace & anotace

      Verze: 0.3-draft
      Datum: 2026-04-16
      x9/xetup
      Status: aktivni vyvoj

      OK hotovo, v provozu
      Must fix zname chyby, nutno opravit
      TODO naplanovano, nerealizovano
      Open otevrena otazka
      Warn potencialni problem
      New nova feature
      Future dlouhodoby plan

Stavajici kroky (scripty)

        00
        Admin ucet (adminx9)
        Must fix

Vytvorit lokalni ucet adminx9	Hotovo

Pridat do skupiny Administrators	Hotovo

Skryt z login obrazovky (SpecialAccounts\UserList = 0)	Hotovo

Heslo nevypirsi, uzivatel nesmeni heslo	Hotovo

Zadne heslo (aktualne nastavovano z config.json)	Zmenit: ucet BEZ hesla (rozhodnuti)

FullName = "X9.cz s.r.o." (via ADSI)	Chybi, doplnit

          Proc bez hesla: Ucet je skryty pred uzivateli, slouzi pouze MSP adminstraci.
          Heslo v config.json by bylo ulozene citelne.

        Script: 00-admin-account.ps1
        + Komentar v Issues

        01
        Bloatware removal
        OK

AppX balicky – odstraneni pro vsechny uzivatele a provisioned	Remove-AppxPackage -AllUsers + Remove-AppxProvisionedPackage

Zachovano: Microsoft.WindowsCalculator	Zamerny vyjimek

Windows Capabilities (Fax, IE, OpenSSH, WMP, WordPad, …)	Remove-WindowsCapability

Windows Optional Features (PS 2.0, MediaPlayback, Recall, …)	Disable-WindowsOptionalFeature

Microsoft-RemoteDesktopConnection NESMI byt odstranen	RDP klient musi zustat funkci. Overit ze neni v seznamu.

OneDrive nesmi byt odstranovano tady	OneDrive musi zustat instalovatelny pro M365.

        Script: 01-bloatware.ps1
        + Komentar v Issues

        02
        Software (winget)
        TODO
        Must fix

7-Zip (7zip.7zip)	OK

Adobe Acrobat Reader 64-bit (Adobe.Acrobat.Reader.64-bit)	OK

OpenVPN Connect (OpenVPNTechnologies.OpenVPNConnect)	OK

Seznam SW je neuplny – co dalsiho patri dovnitr?	TODO: doplnit uplny seznam

Atera Agent install chybi	Stahnout MSI + msiexec /i /qn

Adobe PDF default: .pdf -> AcroRd32 po instalaci	OK – scheduled task PDF-DefaultApp chrání asociaci

UCPD.sys (kernel driver, od Feb 2024) blokuje UserChoice	Otevren: deaktivovat UCPD behem deploymentu?

          Atera Agent URL:

          https://x9.servicedesk.atera.com/api/utils/agent-install/windows/?cid=31&aeid=50b72e7113e54a63ac76b96c54c7e337

          Stazeni: Invoke-WebRequest -Uri <url> -OutFile setup.msi  |
          Instalace: msiexec /i setup.msi /qn

          UCPD.sys: Kernel driver (2024) blokuje primy zapis do UserChoice (vychozi app).
          Reseni: deaktivovat sluzbu behem deploymentu → nastavit asociaci → reaktivovat.
          Nebo alternativni metoda pres DISM / .reg scheduled task.

        Script: 02-software.ps1
        + Komentar v Issues

        03
        System Registry (HKLM)
        Must fix
        TODO

Bypass NRO (OOBE\BypassNRO = 1)	OK

Zakaz auto-instalace Teams	ConfigureChatAutoInstall = 0

Zakaz Cloud Optimized Content	OK

Zakaz Widgets / News and Interests	OK

Hesla bez expirace (net accounts /maxpwage:UNLIMITED)	OK

Casova zona: Central Europe Standard Time	OK

Zakaz GameDVR	OK

Edge – skryt First Run Experience	HKLM\Policies\Edge\HideFirstRunExperience = 1

OneDrive odstraneni je tady – SMAZAT	OneDrive musi zustat (M365). Odstranit DeleteOneDriveSetup ze scriptu.

Edge policies – doplnit ~15 dalsich klicu	Viz seznam nize

Powercfg nastaveni (spotreba energie)	Pridat: standby-ac 0, monitor-ac 60, standby-dc 30, monitor-dc 15

Proxy auto-detect zakaz (AutoDetect = 0)	HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

          Edge policies k doplneni:
          DefaultBrowserSettingEnabled = 0, NewTabPageContentEnabled = 0,
          ImportOnEachLaunch = 0, ShowRecommendationsEnabled = 0,
          PersonalizationReportingEnabled = 0, SpotlightExperiencesAndRecommendationsEnabled = 0,
          DiagnosticData = 0, EdgeShoppingAssistantEnabled = 0, EdgeCollectionsEnabled = 0,
          HubsSidebarEnabled = 0, ShowMicrosoftRewards = 0, SearchSuggestEnabled = 0 a dalsi.

          Powercfg prikazy:

          powercfg /change standby-timeout-ac 0 (neusne na nabijeni)

          powercfg /change monitor-timeout-ac 60 (monitor zhasne po 60 min)

          powercfg /change standby-timeout-dc 30

          powercfg /change monitor-timeout-dc 15

        Script: 03-system-registry.ps1
        + Komentar v Issues

        04
        Default Profile (NTUSER.DAT)
        Must fix
        TODO

Taskbar: zarovnat vlevo (TaskbarAl = 0)	Win11 default je center

Taskbar: skryt Search, Copilot, Task View, Widgets, Chat	OK

Taskbar: zobrazit vsechny ikonky v tray (Scheduled task)	ShowAllTrayIcons

Taskbar: vyprazdnit pinlist (TaskbarLayoutModification.xml)	OK

Explorer: zobrazovat pripony souboru (HideFileExt = 0)	OK

Explorer: otevrit na This PC (LaunchTo = 1)	OK

Start menu: vyprazdnit piny (Win11)	ConfigureStartPins = {"pinnedList":[]}

Start menu: zakaz Bing vyhledavani	DisableSearchBoxSuggestions = 1

Copilot: zakaz (TurnOffWindowsCopilot = 1)	OK

NumLock zapnout pri startu (InitialKeyboardIndicators = 2)	OK

Accent barva na titulnich listech (ColorPrevalence = 1)	OK

OneDrive RunOnce klic je tady – SMAZAT	Odstranit Delete OneDriveSetup from Run ze scriptu.

Explorer: ShowRecent = 0, ShowFrequent = 0	Skryt nedavne a caste soubory v Quick Access

Explorer: FullPath = 1 (CabinetState)	Zobrazovat plnou cestu v titulku okna Explorera

          Metoda: reg load HKU\DefaultProfile C:\Users\Default\NTUSER.DAT
          → zapsat zmeny → reg unload HKU\DefaultProfile.

          Tato operace musi probihat PRED prvnim prihlasenim uzivatele.
          Aktualne prihlaseny uzivatel dostava zmeny pres primy zapis do HKCU.

        Script: 04-default-profile.ps1
        + Komentar v Issues

        05
        Personalizace (barvy, tapeta)
        OK

System tema (taskbar, Start): Dark	OK

Aplikacni tema: Light	OK

Accent barva: #223B47 (tmave modroseda)	OK

Accent barva na Start a taskbaru: ano	OK

Pruhlednost: vypnuta	OK

Tapeta: jednobarevna #223B47 (bez obrazku)	BackInfo prepise tapetu svym BMP

          BackInfo.exe (STEP 07) prepise tapetu BMP se systemovymi informacemi.
          Jednobarevna tapeta je fallback pro pripad, ze BackInfo nedobehne nebo se nespusti.

        Script: 05-personalization.ps1
        + Komentar v Issues

        06
        Scheduled Tasks
        OK

ShowAllTrayIcons – pri logonu + kazdou 1 min	Win11 automaticky skryva tray ikony

UnlockStartLayout – jednou po aplikaci layoutu	Odemkne Start menu pro uzivatelske zmeny

PDF-DefaultApp – pri kazdem logonu	Obnovi .pdf -> Adobe Reader (Edge ho prepsuje)

        Script: 06-scheduled-tasks.ps1
        + Komentar v Issues

        07
        BackInfo (systemovy info na tapete)
        Must fix

07-desktop-info.ps1 SMAZAT – stary pristup	Nahradit deploym. krokem pro BackInfo.exe

Zkopirovat assets/Backinfo/ do C:\Program Files\Backinfo\	Pridat do master scriptu

Spustit backinfo_W11.ps1 (detekce OS, registry, Startup)	Pridat do master scriptu

BackInfo.exe v assets/Backinfo/ k dispozici	Hotovo – jen deploy krok chybi

BackInfo auto-start pri kazdem logonu via Startup shortcut	Zaridi backinfo_W11.ps1

          BackInfo.ini konfiguruje: hostname (velky, centrovan), uzivatelske jmeno,
          OS verze, HW info (CPU, RAM, disk), sitove informace (IP, hostname).

          Proc BackInfo misto vlastniho PS:
          BackInfo.exe podporuje Win10 i Win11 bez specialnich hacku, je stabilni a uz je v assets.

        Script: 07-desktop-info.ps1 (ke smazani) → novy inline krok v Deploy-Windows.ps1
        + Komentar v Issues

        08
        Windows aktivace
        OK
        Open

Klic z config.json (activation.productKey)	OK

Fallback na GVLK (KMS client key) dle edice OS	OK

Volitelny KMS server (activation.kmsServer)	OK

Preskocit pokud jiz aktivovano	OK

Typ klice: MAK vs KMS vs retail?	Zavisi na klientovi – otevrena otazka

        Script: 08-activation.ps1
        + Komentar v Issues

Nove kroky (planovane)

        09
        PC identita – Rename + C:\X9
        New

Rename-Computer dle parametru z TUI nebo config.json	Finalni krok pred restartem – PC name + popis

Nastavit popis pocitace (Computer Description)	Via WMI nebo registry HKLM\SYSTEM\...\ComputerName

Vytvorit C:\X9\ adresarovou strukturu	Pro logy, skripty, assets

Vlastni ikonka pro C:\X9\ slozku	Desktop.ini + X9-ikona.ico

          Rename-Computer vyzaduje restart. Tento krok musi byt posledni pred finalnim shrnutim.
          Technik vi, ze po deployi nasleduje restart.

        Script: novy 09-pc-identity.ps1
        + Komentar v Issues

        10
        Network discovery + firewall
        New

Nastavit sitovy profil jako Private (ne Public)	Set-NetConnectionProfile -NetworkCategory Private

Povolit ping (ICMP) pro diagnostiku	Firewall rule: Enable ICMPv4/ICMPv6

Zapnout Network Discovery pro Private profil	netsh advfirewall nebo Set-NetFirewallRule

          Pozor: Sitovy profil (Private/Public) se muze zmenit po kazdem prihlaseni k jine siti.
          Zvazit scheduled task pri logonu pro opakovanou korekci profilu.

        Script: novy 10-network.ps1
        + Komentar v Issues

        ---
        Taskbar pinned apps (profily)
        New
        Future

-ProfileType parametr: admin vs user varianta	Ruzna sada pinnutych appek dle role uzivatele

XML layout pro "admin": Explorer, PS, Edge, Notepad++, …	TaskbarLayoutModification.xml

XML layout pro "user": Edge, Outlook, Teams, Explorer, …	Odlisna sada pro bezneho zamestnance

          Win11 24H2 zmenil zpusob aplikace Taskbar layoutu (ProvisionedLayoutModification.xml vs. starsi TaskbarLayoutModification.xml).
          Nutno overit kompatibilitu s ruznymy buildy pred implementaci.

        Zacleneni: STEP 04 nebo vlastni script
        + Komentar v Issues

Architektura (budoucnost)

        Arc
        xetup.exe – Go TUI launcher
        Future

Single binary (go:embed scripty + assets)	Offline provoz, jedna stazitelna .exe

TUI form (huh/bubbletea): PC name, popis, product key	Interaktivni zadani dat technikem

Checklist kroku (on/off per-script) + ulozit do config.json	Opakovatelne nasazeni u stejneho klienta

Live log output behem spousteni PS scriptu	Stdout z powershell.exe v realnem case

Finalni summary OK/ERROR	Na konci nasazeni

Self-update: stahnout novou verzi z xetup.x9.cz	Overit hash pred spustenim

config.json: per-klient preset (prefix jmena PC, SW, klic)	Lezi vedle .exe na USB klienta

OpenVPN soubor + doménovy join + domén. uzivatel pro profil	Rozsireni TUI formulare v budoucnu

          Struktura: cmd/xetup/, internal/config/,
          internal/spec/, internal/tui/, internal/runner/

          Go zavislosti:
          bubbletea (TUI framework), huh (forms), lipgloss (styling)

        Status: navrh, zatim zadny kod
        + Komentar v Issues

        Arc
        spec.yaml – single source of truth
        Future

Popis vsech kroku: id, label, script, default	xetup.exe cte spec.yaml pro TUI checklist

Pole "requires" (napr. activation vyzaduje productKey)	TUI upozorni pokud chybi

Auto-generovana dokumentace z spec.yaml	CI akce: spec.yaml → tato stranka

spec.yaml jako SSOT pro tuto stranku i deploy skripty	Idealni stav: stranka vzdy odpovida kodu

          Navrh struktury spec.yaml:

          steps:
  - id: admin-account
    label: "Admin account (adminx9)"
    script: 00-admin-account.ps1
    default: true
  - id: activation
    label: "Windows activation"
    script: 08-activation.ps1
    default: true
    requires: [productKey]

        Status: navrh, zatim zadny soubor
        + Komentar v Issues

  © 2026 X9.cz s.r.o.
   ·
  Forgejo
   ·
  xetup.x9.cz