docs: improve all README files, add uptime-kuma

2026-04-12 20:11:50 +02:00 · 2026-04-12 20:11:50 +02:00 · 9b069a15c4
parent 7c900c26a1
commit 9b069a15c4
37 changed files with 1491 additions and 1068 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,8 @@
+# Virtual environments
+.kuma_venv/
+venv/
+.envs/
+
 # Environment and secrets
 .env
 .env.*
@ -276,6 +281,7 @@ side-agent/manifest/
 # Claude Code session data and instructions
 .claude/
 CLAUDE.md
+QWEN.md

 # Gitea runtime data (sessions, SSH keys, databases)
 gitea/
--- a/.qwen/settings.json
+++ b/.qwen/settings.json
@ -0,0 +1,41 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(mkdir *)",
+      "Bash(docker compose up *)",
+      "Bash(sleep *)",
+      "Bash(curl *)",
+      "Bash(docker inspect *)",
+      "Bash(python3 *)",
+      "Bash(docker logs *)",
+      "Bash(docker cp *)",
+      "Bash(docker exec *)",
+      "Bash(import *)",
+      "Bash(kuma_url *)",
+      "Bash(token *)",
+      "Bash(as *)",
+      "Bash(1].strip)",
+      "Bash(break)",
+      "Bash(print)",
+      "Bash(exit)",
+      "Bash(monitors *)",
+      "Bash(])",
+      "Bash(sio *)",
+      "Bash(sio.connect)",
+      "Bash(r *)",
+      "Bash('loginbytoken', *)",
+      "Bash(else:)",
+      "Bash(sio.disconnect)",
+      "Bash(added *)",
+      "Bash(p *)",
+      "Bash(elif *)",
+      "Bash(try:)",
+      "Bash('add', *)",
+      "Bash(except *)",
+      "Bash(time.sleep)",
+      "Bash(pyeof)",
+      "Bash(docker ps *)"
+    ]
+  },
+  "$version": 3
+}
--- a/.qwen/settings.json.orig
+++ b/.qwen/settings.json.orig
@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(mkdir *)"
+    ]
+  }
+}
--- a/OPENCLAW_SETUP.md
+++ b/OPENCLAW_SETUP.md
@ -1,6 +1,6 @@
 # OpenClaw Setup Guide

-**OpenClaw**: Personal AI Assistant that executes actions (emails, calendar, shell commands, API integrations)
+> Personal AI Assistant that executes actions - emails, calendar, shell commands, API integrations.

 ## Quick Setup

@ -13,11 +13,14 @@ nano ~/.openclaw_secrets
 ```

 Fill in:
- `ANTHROPIC_API_KEY` - Claude API from Anthropic
- `OPENAI_API_KEY` - GPT-4 / Codex from OpenAI
- `GITHUB_TOKEN` - GitHub Copilot API access
- `TWILIO_*` - WhatsApp integration (optional)
- `TELEGRAM_*` - Telegram bot integration (optional)
+
+| Secret | Purpose |
+|--------|---------|
+| `ANTHROPIC_API_KEY` | Claude API from Anthropic |
+| `OPENAI_API_KEY` | GPT-4 / Codex from OpenAI |
+| `GITHUB_TOKEN` | GitHub Copilot API access |
+| `TWILIO_*` | WhatsApp integration (optional) |
+| `TELEGRAM_*` | Telegram bot integration (optional) |

 ### 2. Load Secrets

@ -31,73 +34,90 @@ Or they auto-load when you open a new shell (bashrc sources them).

 ```bash
 cd ~/mydocker
-docker-compose up -d openclaw
+docker compose up -d openclaw
 ```

-## Access OpenClaw
+## Access

 ### Web UI
- **URL**: https://openclaw.sebson.space (via Traefik)
- **Port**: 3000
- Interface for managing tasks, memory, integrations
+
+| Detail | Value |
+|--------|-------|
+| URL | https://openclaw.sebson.space (via Traefik) |
+| Port | 3000 |
+| Purpose | Task management, memory, integrations |

 ### CLI
+
 ```bash
 # Helper function (auto-loaded)
 openclaw-cli "do something"

 # Or directly
-docker-compose exec openclaw openclaw "command"
+docker compose exec openclaw openclaw "command"
 ```

-### WhatsApp
-Send message to configured Twilio number → OpenClaw responds and executes
+### Telegram (Primary)

-### Telegram
-Send message to bot (if `TELEGRAM_BOT_TOKEN` configured)
+- Enabled - requires `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID`
+- Bot responds to messages and executes actions
+
+### WhatsApp (Placeholder)
+
+- Disabled by default (can be enabled)
+- Requires Twilio account + `TWILIO_*` variables
+- Set `"enabled": true` in config to activate

 ### API
- **Endpoint**: http://localhost:3001
- **Usage**:
+
+| Detail | Value |
+|--------|-------|
+| Internal | http://localhost:3007 (changed from 3001 to avoid Grafana conflict) |
+| Via Traefik | https://api.openclaw.sebson.space (optional - requires DNS record) |
+
 ```bash
-curl -X POST http://localhost:3001/api/execute \
+curl -X POST http://localhost:3007/api/execute \
  -H "Content-Type: application/json" \
  -d '{"action":"email","to":"user@example.com","subject":"test"}'
 ```

+## Port Mapping
+
+| Host | Container | Purpose |
+|------|-----------|---------|
+| 3000 | 3000 | Web UI |
+| 3007 | 3001 | API |
+
 ## Bash Helpers

 Auto-added to `~/.bashrc`:

-```bash
-# Check which integrations are configured
-openclaw-secrets
-
-# Start the service
-openclaw-start
-
-# View logs
-openclaw-logs
-
-# Execute command via CLI
-openclaw-cli "send email to john@example.com saying hello"
-```
+| Command | Description |
+|---------|-------------|
+| `openclaw-secrets` | Check which integrations are configured |
+| `openclaw-start` | Start the service |
+| `openclaw-logs` | View logs |
+| `openclaw-cli "..."` | Execute command via CLI |

 ## Configuration

-**File**: `/home/seba/mydocker/openclaw-config.json`
+**File:** `/home/seba/mydocker/openclaw-config.json`

 Key settings:
- `ai.provider` - Default AI model (claude, gpt, copilot)
- `integrations` - Enable/disable services (WhatsApp, Telegram, Gmail, GitHub, etc.)
- `system.sandbox` - Run in sandbox mode (safe)
- `system.shellAccess` - Allow shell command execution
- `webUI.port` - Web interface port (3000)
- `api.port` - REST API port (3001)

-## AI Models Priority
+| Setting | Description |
+|---------|-------------|
+| `ai.provider` | Default AI model (claude, gpt, copilot) |
+| `integrations` | Enable/disable services (WhatsApp, Telegram, Gmail, GitHub, etc.) |
+| `system.sandbox` | Run in sandbox mode (safe) |
+| `system.shellAccess` | Allow shell command execution |
+| `webUI.port` | Web interface port (3000) |
+| `api.port` | REST API port (3001 internally, mapped to 3007) |
+
+## AI Model Priority
+
+OpenClaw tries models in order:

-OpenClaw tries in order:
 1. **Claude** (Anthropic) - Recommended, most capable
 2. **GPT-4** (OpenAI) - Alternative
 3. **Copilot** (GitHub) - Code-focused
@ -106,26 +126,23 @@ Configure via `OPENCLAW_MODEL` env var or config file.

 ## Persistent Memory

- **Location**: `/data/memory` (Docker volume)
- **Survives restarts**: Yes
- **Clearable**: `docker-compose down` won't delete it
+- **Location:** `/data/memory` (Docker volume)
+- **Survives restarts:** Yes
+- **Clearable:** `docker compose down` will NOT delete it

-Memory stores:
- Your preferences
- Past conversations
- Learned patterns
- Custom skills
+Stores: preferences, past conversations, learned patterns, custom skills.

-## Security & Sandbox
+## Security
+
+> **Important considerations:**

-**⚠️ Important**:
 - OpenClaw runs with shell access (configurable via `system.shellAccess`)
 - Docker container is sandboxed from host
- API keys stored in environment (not in code)
+- API keys stored in environment variables (not in code)
 - Config file mounted read-only

 **To disable shell access** (safer):
-Edit `openclaw-config.json`:
+
 ```json
 "system": {
  "shellAccess": false
@ -134,149 +151,92 @@ Edit `openclaw-config.json`:

 Then restart:
 ```bash
-docker-compose restart openclaw
+docker compose restart openclaw
 ```

-## Skills & Plugins
+## Capabilities

 OpenClaw can:
 - Read/write files
 - Execute shell commands (if enabled)
 - Call APIs (50+ integrations)
- Send emails, messages
+- Send emails and messages
 - Manage calendars
- **Write its own plugins** (with safe limits)
+- Write its own plugins (with safe limits)

 ## Troubleshooting

-### Check Secrets Are Loaded
 ```bash
+# Check secrets are loaded
 openclaw-secrets
-```

-### View Logs
-```bash
+# View logs
 openclaw-logs
-```

-### Rebuild Image
-```bash
-docker-compose build --no-cache openclaw
-```
+# Rebuild image
+docker compose build --no-cache openclaw

-### Full Reset (deletes memory)
-```bash
-docker-compose down openclaw
+# Full reset (DELETES memory)
+docker compose down openclaw
 docker volume rm mydocker_openclaw_memory
-docker-compose up -d openclaw
+docker compose up -d openclaw
 ```

 ## Integration Examples

-### Send Email (via Gmail)
 ```bash
+# Send email
 openclaw-cli "send email to boss@company.com subject 'report' body 'attached is...'"
-```

-### Check Calendar
-```bash
+# Check calendar
 openclaw-cli "what's on my calendar tomorrow"
-```

-### Execute Command
-```bash
+# Execute command
 openclaw-cli "run git status in /home/seba/project"
-```

-### GitHub Action
-```bash
+# GitHub action
 openclaw-cli "create pull request to close issue #123"
-```

-## Environment Variables
-
-All OpenClaw settings via `.env`:
-```bash
-ANTHROPIC_API_KEY=sk-ant-...
-OPENAI_API_KEY=sk-...
-GITHUB_TOKEN=ghp_...
-TWILIO_ACCOUNT_SID=AC...
-TWILIO_AUTH_TOKEN=...
-TELEGRAM_BOT_TOKEN=...
+# Send Telegram message
+openclaw-cli "send message to telegram: hello"
 ```

 ## Docker Commands

 ```bash
 # Start
-docker-compose up -d openclaw
+docker compose up -d openclaw

 # Stop
-docker-compose stop openclaw
+docker compose stop openclaw

 # Restart
-docker-compose restart openclaw
+docker compose restart openclaw

-# View logs
-docker-compose logs -f openclaw
+# Follow logs
+docker compose logs -f openclaw

 # Shell access
-docker-compose exec openclaw /bin/bash
+docker compose exec openclaw /bin/bash

 # Delete service (keeps memory/config)
-docker-compose down openclaw
+docker compose down openclaw

 # Rebuild
-docker-compose build --no-cache openclaw && docker-compose up -d openclaw
+docker compose build --no-cache openclaw && docker compose up -d openclaw
 ```

-## Next Steps
+## Quick Start Checklist

-1. ✅ Add your API keys to `~/.openclaw_secrets`
-2. ✅ Run `source ~/.openclaw_secrets`
-3. ✅ Start service: `openclaw-start`
-4. ✅ Access Web UI: https://openclaw.sebson.space
-5. ✅ Try CLI: `openclaw-cli "hello"`
-6. ✅ Set up WhatsApp/Telegram (optional)
+1. Add API keys to `~/.openclaw_secrets`
+2. Run `source ~/.openclaw_secrets`
+3. Start service: `openclaw-start`
+4. Access Web UI: https://openclaw.sebson.space
+5. Try CLI: `openclaw-cli "hello"`
+6. Set up Telegram (optional)

-## Useful Resources
+## Resources

- **GitHub**: https://github.com/openclaw/openclaw
- **Docs**: https://openclaw.ai/docs
- **API Docs**: https://openclaw.ai/api
-
-## Domeny
-
-### Web UI
- Domain: `openclaw.sebson.space` (dodane do DNS)
- Internal: `http://localhost:3000`
- Via Traefik: `https://openclaw.sebson.space`
-
-### API
- Internal: `http://localhost:3007` (changed from 3001 to avoid Grafana conflict)
- Via Traefik: `https://api.openclaw.sebson.space` (optional - requires DNS record)
-
-## Port Mapping
-
-```
-Host   → Container
-3000   → 3000 (Web UI)
-3007   → 3001 (API)
-```
-
-## Komunikacja
-
-### Telegram ✅ (primary)
- Enabled
- Wymaga: `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`
- Bot will respond to messages and execute actions
-
-### WhatsApp (placeholder)
- Disabled (ale możesz włączyć)
- Wymaga: Twilio account + `TWILIO_*` variables
- Jeśli będziesz chcieć - wystarczy zmienić `"enabled": false` na `true` w config
-
-### CLI ✅ (always available)
-```bash
-openclaw-cli "send message to telegram: hello"
-```
+- **GitHub:** https://github.com/openclaw/openclaw
+- **Docs:** https://openclaw.ai/docs
+- **API Docs:** https://openclaw.ai/api
--- a/README.md
+++ b/README.md
@ -0,0 +1,157 @@
+# MyDocker - Home Infrastructure Stack
+
+> Docker Compose based home infrastructure with 40+ services. Domain: **sebson.space**
+
+## Quick Start
+
+```bash
+cd /home/seba/mydocker
+
+docker compose up -d              # Start all services
+docker compose down               # Stop all
+docker compose ps                 # Running containers
+docker compose logs -f <service>  # Follow logs
+docker compose restart <service>  # Restart single service
+
+./upgrade-container-by-name.sh <service>        # Upgrade service
+./upgrade-container-by-name.sh <service> prune  # Upgrade + prune old images
+./backup_db.sh                                    # DB backup -> Google Drive
+```
+
+## Architecture Overview
+
+```
+                          Internet
+                              |
+                        [ Traefik v3.6.8 ]
+                     TLS (Let's Encrypt ACME)
+                              |
+        ┌─────────────────────┼─────────────────────┐
+        |                     |                     |
+   [Public Services]    [Monitoring Stack]    [Security Layer]
+        |                     |                     |
+   Home Assistant        Prometheus           CrowdSec
+   Bitwarden             Grafana              traefik-bouncer
+   Immich                VictoriaMetrics
+   Jellyfin              Loki + Promtail
+   HA Dashboard          cAdvisor
+   Brana Frontend        Node Exporter
+   OpenClaw              mktxp, ping-exporter
+                         Smartctl Exporter
+```
+
+## Services by Category
+
+### Gateway & Security
+
+| Service | URL | Description |
+|---------|-----|-------------|
+| [Traefik](traefik/README.md) | https://traefik.sebson.space | Reverse proxy, TLS, geo-blocking |
+| [CrowdSec](crowdsec/README.md) | local only | IPS, log analysis, Telegram alerts |
+| [Bitwarden](bitwarden/README.md) | https://bward.sebson.space | Password manager (Vaultwarden + YubiKey 2FA) |
+
+### Home Automation & IoT
+
+| Service | URL | Description |
+|---------|-----|-------------|
+| [Home Assistant](homeassistant/README.md) | https://ha.sebson.space | Central automation engine |
+| [ESPHome](esphome/README.md) | http://localhost:6052 | ESP8266/ESP32 firmware OTA |
+| [Mosquitto](mosquitto/README.md) | 192.168.1.132:1883 | MQTT broker |
+| [UniFi](unifi-config/README.md) | https://192.168.1.239:8443 | Network controller (MongoDB backend) |
+| [Brana Frontend](brana-frontend/README.md) | https://brana.sebson.space | Gate control panel (mobile-first) |
+| [HA Dashboard](ha-dashboard/README.md) | https://hadash.sebson.space | Flask ops dashboard |
+
+### Surveillance & Cameras
+
+| Service | URL | Description |
+|---------|-----|-------------|
+| [Frigate](frigate/README.md) | http://acemagic:5000 | NVR + AI object detection (Coral TPU) |
+| [Camera LLM](camera-llm/README.md) | local API | LLM-powered camera memory (ChromaDB RAG) |
+| [Timelapse](timelapse_service/README.md) | cron-based | Auto timelapse generation from camera frames |
+
+### Media & Storage
+
+| Service | URL | Description |
+|---------|-----|-------------|
+| [Jellyfin](jellyfin/README.md) | https://jfin.sebson.space | Media server (movies, series, music) |
+| [Immich](immich/README.md) | https://immch.sebson.space | Self-hosted photo gallery (AI face recognition) |
+| [Prowlarr](prowlarr/README.md) | http://localhost:9696 | Indexer manager (VPN-routed) |
+| [Duplicati](duplicati/README.md) | http://localhost:8200 | Encrypted incremental backups |
+
+### Monitoring Stack
+
+```
+[Docker Containers] ──> Promtail ──> Loki ──> Grafana
+     |                                      ^
+     v                                      |
+  cAdvisor ──> Prometheus ──> VictoriaMetrics
+     |                    |
+  Node Exporter ──────────┘
+  mktxp (MikroTik)
+  ping-exporter
+  smartctl-exporter
+  PostgreSQL exporter
+```
+
+| Service | URL | Description |
+|---------|-----|-------------|
+| [Prometheus](prometheus/README.md) | https://prom.sebson.space | Metrics collection (30d retention) |
+| [Grafana](grafana/README.md) | https://grafana.sebson.space | Dashboards + alerts (Telegram) |
+| [Uptime Kuma](uptime-kuma/README.md) | https://kuma.sebson.space | External uptime monitoring + status page |
+| [Loki](loki/README.md) | http://loki:3100 | Log aggregation (31d retention) |
+| [Promtail](promtail/README.md) | port 9080 | Log shipper (Docker socket discovery) |
+| [mktxp](mktxp/README.md) | http://localhost:49090 | MikroTik router metrics |
+| [ping-exporter](pingexporter/README.md) | http://localhost:9427 | ICMP latency monitoring |
+
+### Custom Services
+
+| Service | Description |
+|---------|-------------|
+| [side-agent](side-agent/README.md) | Camera snapshot detector, container version checker, backup scheduler |
+| [log-ingester](log-ingester/README.md) | RAG ingestion of Frigate/HA/Docker logs into ChromaDB |
+| [OpenClaw](OPENCLAW_SETUP.md) | Personal AI assistant (CLI, Telegram, Web UI) |
+
+## Network Architecture
+
+### Host Network Services
+These services run on `network_mode: host` for mDNS, Bluetooth, or device discovery:
+- Home Assistant, ESPHome, Mosquitto, UniFi, Node Exporter, ping-exporter
+
+### VPN Namespace (Gluetun)
+Services routed through NordVPN (Germany) via `network_mode: "service:gluetun"`:
+- qBittorrent, Radarr, Prowlarr
+
+## Storage Layout
+
+| Mount | Capacity | Purpose |
+|-------|----------|---------|
+| `/media/seagata16t` | 16TB HDD | Immich photos, Jellyfin media, timelapses, camera archives |
+| `/media/evo2t` | 2TB SSD | Frigate recordings, Duplicati backups, side-agent data |
+| `/media/asustor` | NAS | rsync backup destination |
+| `/media/wd1t` | 1TB | Secondary media storage |
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `docker-compose.yaml` | Single source of truth (2000+ lines) |
+| `.env` | Secrets and environment variables |
+| `./upgrade-container-by-name.sh` | Per-service container upgrade |
+| `./backup_db.sh` | PostgreSQL backup to Google Drive via rclone |
+| `./watchdog.sh` | Service health monitoring |
+| `./truncate_logs.sh` | Log file size management |
+| `side-agent/manifest/container_versions.yaml` | Tracked container versions |
+
+## Torrent Box (Subproject)
+
+Separate Makefile-managed stack in `./torrent-box-with-vpn/`:
+
+```bash
+cd torrent-box-with-vpn
+make start / stop / restart
+make update_containers   # pull + restart all
+make generate_certificate
+make backup
+```
+
+> The legacy `transmission-vpn` service in docker-compose is deprecated and replaced by this subproject.
--- a/bitwarden/README.md
+++ b/bitwarden/README.md
@ -1,52 +1,53 @@
 # Bitwarden / Vaultwarden

-Menedzer hasel oparty na Vaultwarden (kompatybilny z klientami Bitwarden). Backend PostgreSQL, uwierzytelnianie dwuetapowe przez YubiKey.
+> Password manager compatible with all Bitwarden clients. PostgreSQL backend with YubiKey 2FA.

-## URL / Dostep
+## Access

- URL: https://bward.sebson.space
- Port wewnetrzny: 9989->80
- Logowanie: email + haslo + YubiKey OTP
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://bward.sebson.space |
+| Internal Port | `9989 -> 80` |
+| Login | Email + Password + YubiKey OTP |

-## Konfiguracja
+## Configuration

- Obraz: `vaultwarden/server`
- Baza danych: PostgreSQL na `postgres18:5432/bitwarden`
- 2FA: YubiKey (YUBICO_CLIENT_ID + YUBICO_SECRET_KEY z `.env`)
- Wlasny serwer weryfikacji Yubico: `bward.sebson.space/wsapi/2.0/verify`
- Konfiguracja przez zmienne srodowiskowe w `.env`
+- **Image:** `vaultwarden/server`
+- **Database:** PostgreSQL on `postgres18:5432` (database: `bitwarden`)
+- **2FA:** YubiKey (`YUBICO_CLIENT_ID` + `YUBICO_SECRET_KEY` from `.env`)
+- **Yubico verification:** self-hosted at `bward.sebson.space/wsapi/2.0/verify`

-## Storage / Dane
+## Storage

-| Sciezka | Zawartosc |
-|---------|-----------|
-| `./bitwarden/attachments/` | zalaczniki do wpisow |
-| `./bitwarden/sends/` | pliki Bitwarden Send |
-| `./bitwarden/icon_cache/` | cache ikon stron |
-| `./bitwarden/tmp/` | pliki tymczasowe |
-| `./bitwarden/rsa_key.pem` | klucz prywatny RSA |
-| `./bitwarden/rsa_key.pub.pem` | klucz publiczny RSA |
+| Path | Contents |
+|------|----------|
+| `./bitwarden/attachments/` | Entry attachments |
+| `./bitwarden/sends/` | Bitwarden Send files |
+| `./bitwarden/icon_cache/` | Website icon cache |
+| `./bitwarden/tmp/` | Temporary files |
+| `./bitwarden/rsa_key.pem` | RSA private key |
+| `./bitwarden/rsa_key.pub.pem` | RSA public key |

-Dane haseł sa w bazie PostgreSQL (`bitwarden` DB na `postgres18`).
+Password data itself is stored in PostgreSQL (`bitwarden` DB on `postgres18`).

-## Powiazania
+## Dependencies

- **postgres18** - glowna baza danych
- **Traefik** - reverse proxy, TLS
- **YubiKey** - sprzętowy klucz 2FA (serwer weryfikacji hostowany lokalnie)
+- **postgres18** - primary database
+- **Traefik** - reverse proxy with TLS
+- **YubiKey** - hardware 2FA key (local verification server)

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f vaultwarden

-# Backup bazy (przez ogolny skrypt)
+# Database backup (via general script)
 ./backup_db.sh

 # Restart
 docker compose restart vaultwarden

-# Eksport/import przez klientow Bitwarden CLI:
+# Export/import via Bitwarden CLI
 bw export --format json
 ```
--- a/brana-frontend/README.md
+++ b/brana-frontend/README.md
@ -1,38 +1,44 @@
-# brana-frontend
+# Brana Frontend - Gate Control Panel

-Customowy panel sterowania brama wjazdowa. Statyczna strona HTML serwowana przez nginx, komunikujaca sie bezposrednio z Home Assistant przez REST API. Zbudowana mobilnie (max-width 420px, dark mode).
+> Static HTML page served by nginx, communicating directly with Home Assistant via REST API. Mobile-first design (max-width 420px, dark mode).

-## URL / Dostep
+## Access

- https://brana.sebson.space (port 9080 -> 80)
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://brana.sebson.space |
+| Internal Port | `9080 -> 80` |

-## Co robi
+## Features

- Wyswietla aktualny stan bramy (open/closed/unknown) z Home Assistant
- Przyciski: otworz brame, zamknij brame, stop
- Wywoluje serwisy HA przez `https://ha.sebson.space` (Content-Security-Policy zezwala tylko na ten host)
- Modal z polem na token HA (przechowywany w localStorage)
- Statusy: ready (zielony), processing (niebieski, animacja), error (czerwony)
+- Displays current gate state (open/closed/unknown) from Home Assistant
+- Action buttons: **open**, **close**, **stop**
+- Calls HA services via `https://ha.sebson.space` (CSP allows only this host)
+- Modal dialog for entering HA token (stored in localStorage)
+- Status indicators:
+  - **Ready** - green
+  - **Processing** - blue (animated)
+  - **Error** - red

-## Konfiguracja nginx
+## Nginx Configuration

- Naglowki bezpieczenstwa: X-Frame-Options DENY, CSP, X-Content-Type-Options
- Real IP z naglowka X-Real-IP (trust 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - Traefik)
- Gzip dla assets
+- Security headers: `X-Frame-Options DENY`, `Content-Security-Policy`, `X-Content-Type-Options`
+- Real IP from `X-Real-IP` header (trusts `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` - Traefik ranges)
+- Gzip compression for assets
 - `/health` - health check endpoint

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi nginx
+# Follow nginx logs
 docker compose logs -f brana-frontend

-# Weryfikacja configu nginx
+# Validate nginx config
 docker exec brana-frontend nginx -t

-# Przeladowanie nginx bez restartu
+# Reload config without restart
 docker exec brana-frontend nginx -s reload

-# Rebuild po zmianach w index.html
+# Rebuild after changes to index.html
 docker compose build brana-frontend && docker compose up -d brana-frontend
 ```
--- a/camera-llm/README.md
+++ b/camera-llm/README.md
@ -1,62 +1,65 @@
-# camera-llm
+# Camera LLM - AI Camera Memory

-System pamieci kamer oparty na LLM. Dwa komponenty: `camera-memory` co sekunde pobiera klatki z kamer Frigate, opisuje je przez model wizyjny i zapisuje embeddingi do ChromaDB; `camera-api` udostepnia interfejs webowy i API do zadawania pytan o to co dzialo sie na kamerach.
+> LLM-powered camera memory system. Captures frames from Frigate cameras, describes them with a vision model, stores embeddings in ChromaDB, and answers natural language questions about camera activity.

-## Architektura
+## Architecture

 ```
 [Frigate /api/<camera>/latest.jpg]
        |
        v
-[camera-memory] --> moondream (opis klatki) --> nomic-embed-text (embedding) --> ChromaDB camera_frames
+[camera-memory] -- moondream (frame description) --> nomic-embed-text (embedding) --> ChromaDB "camera_frames"
        |
        v
-[camera-api] <-- uzytkownik pyta --> ChromaDB (semantic search) --> mistral (odpowiedz) --> wynik
+[camera-api] <-- user asks question --> ChromaDB (semantic search) --> mistral (answer) --> result
 ```

-## Komponenty
+## Components

 ### camera-memory

- Pobiera co INTERVAL sekund najnowsza klatke z kazdej kamery przez Frigate API
- Wysyla do modelu `moondream` prompt: "Describe briefly: people (gender, clothing, action), vehicles (color, type), animals, packages, unusual activity."
- Tworzy embedding przez `nomic-embed-text` i zapisuje w kolekcji `camera_frames`
- Co 3600 iteracji usuwa wpisy starsze niz RETENTION_HOURS (domyslnie 72h)
+- Fetches the latest frame from each camera every `INTERVAL` seconds via Frigate API
+- Sends to `moondream` vision model with prompt: *"Describe briefly: people (gender, clothing, action), vehicles (color, type), animals, packages, unusual activity."*
+- Creates embedding via `nomic-embed-text` and stores in `camera_frames` collection
+- Every 3600 iterations, removes entries older than `RETENTION_HOURS` (default: 72h)

 ### camera-api

- FastAPI + wbudowany HTML frontend (dark mode, PL)
- `GET /` - interfejs webowy do zadawania pytan po polsku
- `GET /ask?q=...` - odpowiedz przez RAG (ChromaDB + mistral), zwraca answer + sources
- `GET /recent?camera=&hours=1` - ostatnie obserwacje
- `GET /stats` - liczba zapisanych klatek
- `GET /health` - health check
+- FastAPI + built-in HTML frontend (dark mode, Polish language)

-## Konfiguracja (zmienne env)
+| Endpoint | Description |
+|----------|-------------|
+| `GET /` | Web interface for asking questions (Polish) |
+| `GET /ask?q=...` | RAG answer via ChromaDB + mistral, returns `answer` + `sources` |
+| `GET /recent?camera=&hours=1` | Recent observations |
+| `GET /stats` | Number of stored frames |
+| `GET /health` | Health check |

-| Zmienna | Domyslnie | Opis |
-|---------|-----------|------|
-| `FRIGATE_URL` | `http://frigate:5000` | Adres API Frigate |
-| `OLLAMA_URL` | `http://ollama:11434` | Adres Ollama |
-| `CHROMA_URL` | `http://chromadb:8000` | Adres ChromaDB |
-| `CAMERAS` | `front_door` | Lista kamer oddzielona przecinkami |
-| `INTERVAL` | `1` | Interwał pobierania klatek (sekundy) |
-| `RETENTION_HOURS` | `72` | Czas retencji wpisow w ChromaDB |
+## Environment Variables

-## Przydatne komendy
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `FRIGATE_URL` | `http://frigate:5000` | Frigate API URL |
+| `OLLAMA_URL` | `http://ollama:11434` | Ollama URL |
+| `CHROMA_URL` | `http://chromadb:8000` | ChromaDB URL |
+| `CAMERAS` | `front_door` | Comma-separated camera list |
+| `INTERVAL` | `1` | Frame capture interval (seconds) |
+| `RETENTION_HOURS` | `72` | Data retention in ChromaDB |
+
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f camera-memory
 docker compose logs -f camera-api

-# Ile klatek jest w pamieci
+# Check how many frames are stored
 curl http://localhost:<port>/stats

-# Pytanie przez API
-curl "http://localhost:<port>/ask?q=czy+bylo+dzisiaj+czerwone+auto"
+# Ask a question via API
+curl "http://localhost:<port>/ask?q=was+there+a+red+car+today"

-# Ostatnie obserwacje z konkretnej kamery (ostatnia godzina)
+# Recent observations from a specific camera (last hour)
 curl "http://localhost:<port>/recent?camera=reolink_1&hours=1"

 # Rebuild
--- a/crowdsec/README.md
+++ b/crowdsec/README.md
@ -1,107 +1,98 @@
-# CrowdSec - dokumentacja
+# CrowdSec - Intrusion Prevention System

-## Jak działa
+> Analyzes logs from multiple services and blocks malicious IPs via Traefik bouncer. Sends Telegram alerts on detections.

-CrowdSec analizuje logi i blokuje złośliwe IP przez dwa komponenty:
+## How It Works

 ```
-Logi → crowdsec (analiza) → decyzja BAN → traefik-bouncer (egzekucja)
-                                         → powiadomienie Telegram
+Logs → crowdsec (analysis) → BAN decision → traefik-bouncer (enforcement)
+                                          → Telegram notification
 ```

-**traefik-bouncer** sprawdza każde żądanie przez Traefika pod CrowdSec API (`crowdsec:8080`). Jeśli IP ma aktywny ban - zwraca 403.
+**traefik-bouncer** checks every request through Traefik against the CrowdSec API (`crowdsec:8080`). Returns `403` if the IP has an active ban.

-## Telegram - jak działa
+## Telegram Notifications

-Powiadomienia idą przez plugin HTTP (`conf/notifications/http.yaml`), który wysyła POST do Telegram Bot API.
+Notifications are sent via the HTTP plugin (`conf/notifications/http.yaml`) posting to the Telegram Bot API.

-**Przepływ:**
-1. CrowdSec wykrywa atak (np. brute-force SSH, skanowanie HTTP)
-2. Profil w `conf/profiles.yaml` dopasowuje alert → przypisuje powiadomienie `http_default`
-3. Plugin HTTP czeka 30s na grupowanie alertów, potem wysyła POST:
+### Flow
+
+1. CrowdSec detects an attack (SSH brute-force, HTTP scanning, etc.)
+2. Profile in `conf/profiles.yaml` matches the alert → assigns `http_default` notification
+3. HTTP plugin waits 30s to group alerts, then sends POST:

 ```
 POST https://api.telegram.org/bot<TOKEN>/sendMessage
 {
  "chat_id": 5479795256,
  "parse_mode": "HTML",
-  "text": "🚨 CrowdSec Alert\n🔒 Scenariusz: ...\n🌍 IP: ...\n📊 Liczba zdarzeń: ..."
+  "text": "🚨 CrowdSec Alert\n🔒 Scenario: ...\n🌍 IP: ...\n📊 Event count: ..."
 }
 ```

-**Zmienne środowiskowe** (w `.env`):
-```
-TELEGRAM_BOT_TOKEN=5580892376:AAHjXRq...
-TELEGRAM_CHAT_ID=5479795256
-```
+Environment variables (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`) are configured in `docker-compose.yaml`.

-Bot token i chat ID skonfigurowane w docker-compose.yaml i przekazywane do kontenera. Format wiadomości edytowalny w `conf/notifications/http.yaml`.
+## Monitored Log Sources (`conf/acquis.yaml`)

-## Monitorowane źródła logów (`conf/acquis.yaml`)
-
-| Źródło | Typ | Ścieżka/kontener |
-|--------|-----|-----------------|
+| Source | Type | Path/Container |
+|--------|------|----------------|
 | SSH | syslog | `/var/log/auth.log` |
 | Traefik | traefik | `/var/log/traefik/access.log` |
 | Jellyfin | jellyfin | `/var/log/jellyfin/log_*.log` |
-| Grafana | docker | kontener `grafana` |
-| Bitwarden | Vaultwarden | kontener `bitwarden` |
+| Grafana | docker | `grafana` container |
+| Bitwarden | vaultwarden | `bitwarden` container |

-## Aktywne kolekcje (scenarios + parsery)
+## Active Collections (Scenarios + Parsers)

- `crowdsecurity/linux` + `sshd` - SSH brute-force
- `crowdsecurity/traefik` + `nginx` - HTTP ataki przez Traefik
- `crowdsecurity/http-cve` - znane CVE (log4j, Spring4Shell, etc.)
- `crowdsecurity/base-http-scenarios` - skanowanie, traversal, bad UA
- `crowdsecurity/home-assistant` - brute-force HA
- `crowdsecurity/whitelist-good-actors` - SEO boty, CDN
- `Dominic-Wagner/vaultwarden` - BF Bitwarden
- `LePresidente/grafana` + `jellyfin` - BF Grafana/Jellyfin
+| Collection | Purpose |
+|------------|---------|
+| `crowdsecurity/linux` + `sshd` | SSH brute-force |
+| `crowdsecurity/traefik` + `nginx` | HTTP attacks via Traefik |
+| `crowdsecurity/http-cve` | Known CVEs (log4j, Spring4Shell, etc.) |
+| `crowdsecurity/base-http-scenarios` | Scanning, path traversal, bad user agents |
+| `crowdsecurity/home-assistant` | HA brute-force |
+| `crowdsecurity/whitelist-good-actors` | SEO bots, CDNs |
+| `Dominic-Wagner/vaultwarden` | Bitwarden brute-force |
+| `LePresidente/grafana` + `jellyfin` | Grafana/Jellyfin brute-force |

-## Whitelista (`conf/parsers/s02-enrich/my-whitelist.yaml`)
+## Whitelist (Never Banned)

-Nigdy nie banowane:
- `127.0.0.1`
- `192.168.1.0/24` (LAN)
- `10.13.13.0/24` (VPN WireGuard)
- `81.201.50.209` (domowy publiczny IP)
- `212.222.3.226` (IP z pracy)
+| IP/Range | Description |
+|----------|-------------|
+| `127.0.0.1` | Localhost |
+| `192.168.1.0/24` | LAN |
+| `10.13.13.0/24` | WireGuard VPN |
+| `81.201.50.209` | Home public IP |
+| `212.222.3.226` | Work IP |

-## Profile i decyzje (`conf/profiles.yaml`)
+## Profiles & Decisions (`conf/profiles.yaml`)

-Dwa profile:
- `default_ip_remediation` - ban IP na 4h
- `default_range_remediation` - ban całego /24 na 4h
+| Profile | Action | Notification |
+|---------|--------|--------------|
+| `default_ip_remediation` | Ban IP for 4h | Telegram |
+| `default_range_remediation` | Ban entire /24 for 4h | Telegram |

-Oba wysyłają powiadomienie `http_default` (Telegram).
-
-## Przydatne komendy
+## Useful Commands

 ```bash
-# Skrypty w crowdsec/bin/
-./crowdsec/bin/alerts-list      # lista alertów
-./crowdsec/bin/decisions        # aktywne bany
-./crowdsec/bin/metrics          # statystyki parsowania
+# Helper scripts in crowdsec/bin/
+./crowdsec/bin/alerts-list     # List recent alerts
+./crowdsec/bin/decisions       # Active bans
+./crowdsec/bin/metrics         # Parsing statistics

-# Bezpośrednio
+# Direct cscli commands
 docker exec crowdsec cscli alerts list
 docker exec crowdsec cscli decisions list
-docker exec crowdsec cscli decisions delete --ip 1.2.3.4   # odbanuj IP
-docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 24h  # ręczny ban
+docker exec crowdsec cscli decisions delete --ip 1.2.3.4     # Unban IP
+docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 24h  # Manual ban

-# Test powiadomienia Telegram
+# Test Telegram notification
 docker exec crowdsec cscli notifications test http_default
-```

-## Ręczny ban IP
-
-```bash
+# Manual ban with custom duration
 docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 168h --reason "manual"
-```

-## Logi
-
-```bash
+# Follow logs
 docker logs crowdsec --tail 100 -f
 docker logs traefik-bouncer --tail 50
 ```
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@ -988,3 +988,16 @@ services:
    devices:
      - /dev/net/tun

+  uptime-kuma:
+    image: louislam/uptime-kuma
+    container_name: uptime-kuma
+    restart: unless-stopped
+    volumes:
+      - ${PWD}/uptime-kuma/data:/app/data
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.uptime-kuma.rule=Host(`kuma.sebson.space`)"
+      - "traefik.http.routers.uptime-kuma.entrypoints=websecure"
+      - "traefik.http.routers.uptime-kuma.tls.certresolver=mytlschallenge"
+      - "traefik.http.services.uptime-kuma.loadbalancer.server.port=3001"
+
--- a/duplicati/README.md
+++ b/duplicati/README.md
@ -1,58 +1,57 @@
-# Duplicati
+# Duplicati - Encrypted Backups

-Narzedzie do tworzenia szyfrowanych, przyrostowych kopii zapasowych. Interfejs webowy dostepny przez przegladarke.
+> Web-based incremental backup tool with AES-256 encryption. Local access only.

-## URL / Dostep
+## Access

- UI: http://localhost:8200 (brak publicznego dostępu przez Traefik)
- Dostep tylko z sieci lokalnej lub przez VPN/tunel
+| Endpoint | Details |
+|----------|---------|
+| Web UI | http://localhost:8200 |
+| Public access | None (LAN/VPN only) |

-## Konfiguracja
+## Configuration

- Port: 8200
- Konfiguracja jobow backupu przechowywana w `./duplicati/config/`
- Harmonogram i ustawienia definiowane przez UI
+- **Port:** 8200
+- **Job config:** stored in `./duplicati/config/` (SQLite database)
+- Schedule and settings managed via the web UI

-### Zrodla backupu
+### Backup Sources

-| Zrodlo | Opis |
-|--------|------|
-| `/home/seba` | katalog domowy |
-| `/home/seba/mydocker` | caly stack Docker |
-| `/home/seba/git.repos` | repozytoria git |
+| Source | Description |
+|--------|-------------|
+| `/home/seba` | Home directory |
+| `/home/seba/mydocker` | Entire Docker stack |
+| `/home/seba/git.repos` | Git repositories |

-### Cel backupu
+### Backup Destinations

-| Lokalizacja | Opis |
-|-------------|------|
-| `/media/evo2t/backups` | lokalny dysk SSD |
-| `/media/seagata16t/` | 16TB dysk HDD |
+| Location | Description |
+|----------|-------------|
+| `/media/evo2t/backups` | Local SSD disk |
+| `/media/seagata16t/` | 16TB HDD |

-## Storage / Dane
+## Storage

-| Sciezka | Zawartosc |
-|---------|-----------|
-| `./duplicati/config/` | konfiguracja jobow, baza SQLite |
+| Path | Contents |
+|------|----------|
+| `./duplicati/config/` | Job configurations, SQLite database |

-## Powiazania
+All source directories are mounted read-only. Destination disks are read-write.

- Montuje wiele katalogow hosta jako read-only (zrodla)
- Montuje dyski docelowe jako read-write
-
-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f duplicati

 # Restart
 docker compose restart duplicati

-# Przywrocenie pliku przez CLI (wewnatrz kontenera)
+# Restore entire backup (inside container)
 docker exec -it duplicati dotnet /app/duplicati/Duplicati.CommandLine.dll restore \
  "your-backup-path" --targetpath="/restore"

-# Przywrocenie konkretnego pliku
+# Restore a specific file
 docker exec -it duplicati dotnet /app/duplicati/Duplicati.CommandLine.dll restore \
  "file://backup/path" --restore-path="/tmp/restore" --include="**/myfile.txt"
 ```
--- a/esphome/README.md
+++ b/esphome/README.md
@ -1,59 +1,60 @@
-# ESPHome
+# ESPHome - ESP Firmware Dashboard

-Dashboard do kompilacji firmware i zarzadzania urzadzeniami ESP8266/ESP32. Udostepnia OTA (aktualizacje Over-the-Air) i integracje z Home Assistant przez API natywne.
+> Web dashboard for compiling firmware and managing ESP8266/ESP32 devices. Provides OTA updates and native API integration with Home Assistant.

-## URL / Dostep
+## Access

- Dashboard: http://localhost:6052 (brak reverse proxy, dostep lokalny)
- Port: 6052 (host network)
+| Endpoint | Details |
+|----------|---------|
+| Dashboard | http://localhost:6052 |
+| Network | `network_mode: host` (required for OTA + mDNS discovery) |

-## Konfiguracja
+## Configuration

- Obraz: `esphome/esphome`
- Siec: `network_mode: host` (wymagane do OTA i odkrywania urzadzen przez mDNS)
- Pliki YAML urzadzen: `./esphome/*.yaml`
- Sekrety: `./esphome/secrets.yaml`
+- **Image:** `esphome/esphome`
+- **Device YAML:** `./esphome/*.yaml`
+- **Secrets:** `./esphome/secrets.yaml`

-## Urzadzenia
+## Devices

-| Plik YAML | Urzadzenie | Opis |
-|-----------|-----------|------|
-| `sonoff_mini_hall.yaml` | Sonoff Mini (ESP8266) | Oswietlenie gorne w przedpokoju (192.168.20.62) |
-| `sonoff_mini_stefi.yaml` | Sonoff Mini | Oswietlenie w pokoju Stefi |
-| `sonoff_mini_small_hall.yaml` | Sonoff Mini | Maly przedpokoj |
-| `sonoff_mini_driveway` | Sonoff Mini | Oswietlenie podjazdu |
-| `sonoff-mini-r2-1.yaml` | Sonoff Mini R2 | Przekaznik #1 |
-| `sonoff-mini-r2-2.yaml` | Sonoff Mini R2 | Przekaznik #2 |
-| `sonoff-mini-digestor.yaml` | Sonoff Mini | Okap kuchenny |
-| `sonoff-mini-kitchen-led.yaml` | Sonoff Mini | Tasmowanie LED w kuchni |
-| `sonofft13guk.yaml` | Sonoff T1 | Przelacznik dotykowy |
-| `bathroom-shelly-1l-01.yaml` | Shelly 1L | Oswietlenie lazienki |
-| `light_driveway.yaml` | ESP (custom) | Inteligentne oswietlenie podjazdu |
-| `esp_mini_office.yaml` | ESP32 Mini | Biuro |
-| `esp_woox_dining.yaml` | ESP Woox | Jadalnia |
-| `esp_woox_fan.yaml` | ESP Woox | Wentylator |
-| `lsmin-gat/` | LSMini | Brama |
+| YAML File | Device | Description |
+|-----------|--------|-------------|
+| `sonoff_mini_hall.yaml` | Sonoff Mini (ESP8266) | Hallway ceiling light (192.168.20.62) |
+| `sonoff_mini_stefi.yaml` | Sonoff Mini | Stefi's room light |
+| `sonoff_mini_small_hall.yaml` | Sonoff Mini | Small hallway |
+| `sonoff_mini_driveway.yaml` | Sonoff Mini | Driveway light |
+| `sonoff-mini-r2-1.yaml` | Sonoff Mini R2 | Relay #1 |
+| `sonoff-mini-r2-2.yaml` | Sonoff Mini R2 | Relay #2 |
+| `sonoff-mini-digestor.yaml` | Sonoff Mini | Kitchen hood |
+| `sonoff-mini-kitchen-led.yaml` | Sonoff Mini | Kitchen LED strip |
+| `sonofft13guk.yaml` | Sonoff T1 | Touch switch |
+| `bathroom-shelly-1l-01.yaml` | Shelly 1L | Bathroom light |
+| `light_driveway.yaml` | ESP (custom) | Smart driveway lighting |
+| `esp_mini_office.yaml` | ESP32 Mini | Office |
+| `esp_woox_dining.yaml` | ESP Woox | Dining room |
+| `esp_woox_fan.yaml` | ESP Woox | Fan |
+| `lsmin-gat/` | LSMini | Gate |

-Urzadzenia laczya sie przez WiFi IoT (VLAN 20, `wifi_ssid_iot`) z WPA2 oraz posiadaja fallback AP.
+All devices connect via WiFi IoT network (VLAN 20, `wifi_ssid_iot`) with WPA2 and have a fallback AP.

-## Architektura / Powiazania
+## Architecture

 ```
 ESPHome Dashboard
-  ├── kompiluje firmware i wgrywa OTA do urzadzen ESP
-  ├── urzadzenia ESP raportuja stany do Home Assistant przez API natywne
-  └── czesc urzadzen komunikuje sie rowniez przez MQTT (Mosquitto)
+  ├── Compiles firmware and flashes OTA to ESP devices
+  ├── Devices report states to Home Assistant via native API
+  └── Some devices also communicate via MQTT (Mosquitto)
 ```

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi dashboardu
+# Follow dashboard logs
 docker compose logs -f esphome

 # Restart
 docker compose restart esphome

-# Kompilacja i wgranie firmware (z linii polecen, poza dashboardem)
+# Compile and flash firmware from CLI
 docker compose exec esphome esphome run /config/sonoff_mini_hall.yaml
 ```
--- a/frigate/README.md
+++ b/frigate/README.md
@ -1,89 +1,90 @@
-# Frigate
+# Frigate - AI-Powered NVR

-System NVR (Network Video Recorder) z detekcja obiektow AI w czasie rzeczywistym. Obsluguje 8 kamer, wykrywa osoby, samochody, psy i koty, integruje sie z Home Assistant przez MQTT.
+> Real-time object detection NVR system. 8 cameras, detects persons, cars, dogs and cats. Integrates with Home Assistant via MQTT.

-## URL / Dostep
+## Access

- UI: http://acemagic:5000 (dostep lokalny, brak Traefik)
- API: http://acemagic:5000/api/
- go2rtc restream: http://acemagic:8554/ (RTSP)
+| Endpoint | Details |
+|----------|---------|
+| Web UI | http://acemagic:5000 (local only, no Traefik) |
+| API | http://acemagic:5000/api/ |
+| go2rtc restream | http://acemagic:8554/ (RTSP) |

-## Konfiguracja
+## Configuration

- Wersja konfiguracji: `0.17-0` (config.yml)
- Limit RAM: 6 GB (`mem_limit: 6g`)
- Plik konfiguracyjny: `./frigate/config.yml`
- Nagrania: `/media/evo2t/frigate/` (szybkie SSD)
- Baza danych: `./frigate/frigate.db` (SQLite)
+- **Config version:** `0.17-0` (`config.yml`)
+- **RAM limit:** 6 GB
+- **MQTT:** `192.168.1.132:1883` (Mosquitto), topic prefix `frigate`

-### Akceleracja
+### Hardware Acceleration

- **Detekcja AI**: Google Coral TPU USB (`device: usb`)
- **Dekodowanie wideo**: AMD GPU `radeonsi` przez VAAPI (hwaccel)
- **MQTT**: `192.168.1.132:1883` (Mosquitto), topic prefix `frigate`
+| Component | Hardware | Purpose |
+|-----------|----------|---------|
+| Google Coral TPU | USB (`device: usb`) | AI object detection |
+| AMD GPU `radeonsi` | VAAPI | Video decoding (hwaccel) |

-## Kamery
+## Cameras

-| Nazwa | Model | IP | Sledzone obiekty | Strefy |
-|-------|-------|-----|-----------------|--------|
-| `frigate_reolink_1` | Reolink | 192.168.1.101 | person, car, dog | parking, driveway, r1_my-garden |
-| `frigate_reolink_2` | Reolink | 192.168.1.62 | person, dog | my_sidewalk |
-| `frigate_reolink_3` | Reolink | 192.168.1.150 | person, car, dog | terrace, kennel, my-garden |
-| `frigate_reolink_4` | Reolink | 192.168.1.168 | person, car, dog | main_area, entrance |
-| `frigate_reolink_5` | Reolink | 192.168.1.172 | person, dog | terrace |
-| `frigate_hikvision_2` | Hikvision | 192.168.1.65 | person, car, dog | my-garden |
-| `frigate_hikvision_4` | Hikvision (domofon) | 192.168.1.127 | person | street-left, robo, at-gate |
-| `mercusys_mc200` | Mercusys (wew.) | 192.168.20.33 | person, cat | - |
+| Name | Model | IP | Tracked Objects | Zones |
+|------|-------|-----|-----------------|-------|
+| `reolink_1` | Reolink | 192.168.1.101 | person, car, dog | parking, driveway, r1_my-garden |
+| `reolink_2` | Reolink | 192.168.1.62 | person, dog | my_sidewalk |
+| `reolink_3` | Reolink | 192.168.1.150 | person, car, dog | terrace, kennel, my-garden |
+| `reolink_4` | Reolink | 192.168.1.168 | person, car, dog | main_area, entrance |
+| `reolink_5` | Reolink | 192.168.1.172 | person, dog | terrace |
+| `hikvision_2` | Hikvision | 192.168.1.65 | person, car, dog | my-garden |
+| `hikvision_4` | Hikvision (intercom) | 192.168.1.127 | person | street-left, robo, at-gate |
+| `mercusys_mc200` | Mercusys (indoor) | 192.168.20.33 | person, cat | - |

-Wszystkie strumienie sa reroutowane przez wbudowany go2rtc (RTSP restream) w celu oszczednosci RAM - Frigate pobiera jeden strumien z go2rtc zamiast bezposrednio z kamery.
+All streams are rerouted through built-in go2rtc (RTSP restream) to save RAM - Frigate pulls one stream from go2rtc instead of directly from each camera.

-## Retencja nagran
+## Retention

-| Typ | Czas |
-|-----|------|
-| Snapshoty (osoby) | 3650 dni (10 lat) |
-| Snapshoty (samochody) | 180 dni |
-| Snapshoty (domyslnie) | 365 dni |
-| Nagrania - alerty | 30 dni |
-| Nagrania - detekcje | 90 dni |
-| Nagrania ciagle (hikvision_4) | 90 dni |
-| Nagrania z ruchem | 7 dni (tylko reolink_1) |
+| Type | Duration |
+|------|----------|
+| Snapshots (persons) | 3650 days (10 years) |
+| Snapshots (cars) | 180 days |
+| Snapshots (default) | 365 days |
+| Recordings - alerts | 30 days |
+| Recordings - detections | 90 days |
+| Continuous recordings (hikvision_4) | 90 days |
+| Recordings with motion | 7 days (reolink_1 only) |

-Jakosc snapshotow: 90%, z czystymi kopiami (`clean_copy: true`).
+Snapshot quality: 90%, with clean copies (`clean_copy: true`).

-## Architektura / Powiazania
+## Architecture

 ```
-Kamery IP (RTSP)
-  └── go2rtc (restream wewnetrzny)
-        └── Frigate detekcja (Coral TPU, 640x360@7-10fps)
-              ├── MQTT -> Mosquitto -> Home Assistant (zdarzenia, binarki)
-              ├── nagrania -> /media/evo2t/frigate/
-              └── snapshoty -> frigate.db + /media/evo2t/frigate/clips/
+Camera IP (RTSP)
+  └── go2rtc (internal restream)
+        └── Frigate detection (Coral TPU, 640x360 @ 7-10fps)
+              ├── MQTT → Mosquitto → Home Assistant (events, binary sensors)
+              ├── recordings → /media/evo2t/frigate/
+              └── snapshots → frigate.db + /media/evo2t/frigate/clips/
 ```

-## Klucze konfiguracji
+## Key Configuration Details

- Detekcja: 640x360, 7-10 fps (sub-stream), stationary object suppression
- Wyszukiwanie semantyczne: wlaczone (model `small`)
- Birdseye: 1920x1080, tryb continuous
- Maski ruchu dla kazdej kamery (eliminacja falszywych alarow od cieni, znakow drogowych)
+- Detection: 640x360, 7-10 fps (sub-stream), stationary object suppression
+- Semantic search: enabled (model `small`)
+- Birdseye: 1920x1080, continuous mode
+- Motion masks per camera (eliminates false alarms from shadows, road signs)

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f frigate

 # Restart
 docker compose restart frigate

-# Sprawdzenie zuzycia RAM przez Frigate
+# Check RAM usage
 docker stats frigate --no-stream

-# Podglad zdarzen MQTT z Frigate
-mosquitto_sub -h 192.168.1.132 -u mosquitto -P <haslo> -t 'frigate/#' -v
+# Watch Frigate MQTT events
+mosquitto_sub -h 192.168.1.132 -u mosquitto -P <password> -t 'frigate/#' -v

-# Czyszczenie starych nagran recznie (Frigate ma to automatyczne)
-# Uzyj UI Frigate: http://acemagic:5000 -> Storage
+# Clean old recordings manually (auto-handled by Frigate)
+# Use UI: http://acemagic:5000 → Storage
 ```
--- a/grafana/README.md
+++ b/grafana/README.md
@ -1,59 +1,67 @@
-# Grafana
+# Grafana - Monitoring Dashboards

-Platforma do wizualizacji metryk i logów. Wyswietla dane z VictoriaMetrics (metryki) oraz Loki (logi). Wysyla alerty przez Telegram.
+> Visualization platform for metrics (VictoriaMetrics) and logs (Loki). Sends alerts via Telegram.

-## URL / Dostep
+## Access

- Publiczny: https://grafana.sebson.space
- Lokalny: http://localhost:3001
- Login: `seba` (haslo z `.env`: `GRAFANA_ADMIN_PASSWORD`)
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://grafana.sebson.space |
+| Internal | http://localhost:3001 |
+| Login | `seba` (password in `.env`: `GRAFANA_ADMIN_PASSWORD`) |

-## Konfiguracja
+## Configuration

-Provisioning automatyczny z `./etc/grafana/provisioning/`:
+Automatically provisioned from `./etc/grafana/provisioning/`:

- `datasources/datasource.yaml` - 3 zrodla danych:
-  - **VictoriaMetrics** (domyslne) - `http://victoriametrics:8428`, uid: `prometheus`
-  - **Prometheus-Raw** - `http://prometheus:9090` z basic auth
-  - **Loki** - `http://loki:3100`, max 1000 linii
- `dashboards/` - preinstalowane dashboardy JSON:
-  - `home-assistant.json` - metryki Home Assistant
-  - `ping-monitoring.json` - monitoring dostepnosci sieci
-  - `node-exporter-*.json`, `node.exporter.server.metrics.json` - metryki hostow
-  - `traefik2.json` - metryki reverse proxy
-  - `system-monitoring-complete.json` - ogolny monitoring systemu
-  - `mazda.json`, `windows-wmi.json` - dodatkowe zrodla
+### Data Sources

-Plugin: `grafana-piechart-panel`
+| Source | URL | UID | Notes |
+|--------|-----|-----|-------|
+| **VictoriaMetrics** (default) | `http://victoriametrics:8428` | `prometheus` | Long-term metrics |
+| **Prometheus-Raw** | `http://prometheus:9090` | - | With basic auth |
+| **Loki** | `http://loki:3100` | `loki` | Max 1000 lines per query |

-Alerty Telegram: `GF_UNIFIED_ALERTING_ENABLED=true`, bot token i chat ID z `.env` (`TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`).
+### Pre-installed Dashboards

-## Co monitoruje / metryki
+- `home-assistant.json` - HA entity metrics
+- `ping-monitoring.json` - Network availability
+- `node-exporter-*.json`, `node.exporter.server.metrics.json` - Host metrics
+- `traefik2.json` - Reverse proxy metrics
+- `system-monitoring-complete.json` - Overall system monitoring
+- `mazda.json`, `windows-wmi.json` - Additional sources

-Grafana sama w sobie nie zbiera metryk - wizualizuje dane z innych serwisow:
- Metryki systemowe hostow (CPU, RAM, dyski, siec)
- Metryki kontenerow Docker (cAdvisor)
- Metryki Home Assistant (encje, stany)
- Metryki Traefik (requesty, latencja)
- Logi kontenerow (przez Loki)
- Ping/dostepnosc urzadzen
+**Plugin:** `grafana-piechart-panel`

-## Powiazania z innymi serwisami
+**Alerts:** Telegram via Grafana Unified Alerting (`GF_UNIFIED_ALERTING_ENABLED=true`). Bot token and chat ID from `.env`.

-| Serwis | Rola |
-|--------|------|
-| VictoriaMetrics | glowne zrodlo danych (dlugoterminowe metryki) |
-| Prometheus | zrodlo surowych metryk (krotkoterminowe) |
-| Loki | zrodlo logow kontenerow |
-| Alertmanager | opcjonalnie (alerty SA zarzadzane przez Grafana Unified Alerting) |
+## Monitored Metrics

-## Przydatne komendy
+Grafana visualizes data from other services:
+
+- Host system metrics (CPU, RAM, disks, network)
+- Docker container metrics (cAdvisor)
+- Home Assistant metrics (entities, states)
+- Traefik metrics (requests, latency)
+- Container logs (via Loki)
+- Ping / device availability
+
+## Dependencies
+
+| Service | Role |
+|---------|------|
+| VictoriaMetrics | Primary data source (long-term metrics) |
+| Prometheus | Raw metrics source (short-term) |
+| Loki | Container log source |
+| Alertmanager | Optional (alerts managed by Grafana Unified Alerting) |
+
+## Useful Commands

 ```bash
 # Restart
 docker compose restart grafana

-# Logi
+# Follow logs
 docker compose logs -f grafana

 # Upgrade
--- a/ha-dashboard/README.md
+++ b/ha-dashboard/README.md
@ -1,71 +1,81 @@
-# HA Dashboard (Brana)
+# HA Dashboard - Operations Panel

-Niestandardowa aplikacja webowa Flask bedaca centralnym panelem operacyjnym dla calej infrastruktury domowej. Agreguje dane z Home Assistant, PostgreSQL, Docker i Crowdsec w jednym widoku.
+> Custom Flask application serving as the central operations dashboard for the entire home infrastructure. Aggregates data from Home Assistant, PostgreSQL, Docker and CrowdSec into a single view.

-## URL / Dostep
+## Access

- Panel: https://hadash.sebson.space
- Port lokalny: 9081 -> 8080
- Wymagane logowanie (rejestracja z zatwierdzeniem przez administratora)
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://hadash.sebson.space |
+| Internal Port | `9081 -> 8080` |
+| Auth | Login required (registration with admin approval) |

-## Konfiguracja
+## Configuration

- Zbudowany lokalnie z `./ha-dashboard/Dockerfile` (Python 3.12-slim + Flask)
- Zaleznosci: `flask`, `psycopg2-binary`, `requests`, `docker`
- Zmienne srodowiskowe: `DB_HOST`, `DB_PORT`, `DB_USER`, `DB_PASS`, `HA_URL`, `HA_TOKEN`, `SECRET_KEY`
- Wolumeny:
-  - `/var/run/docker.sock` - dostep do Docker API (informacje o kontenerach, Crowdsec)
-  - `./backup.log` -> `/backup.log` - log backupow bazy danych
-  - `./ha-dashboard/auth/` -> `/auth/` - katalog uwierzytelnienia uzytkownikow
-  - `./homeassistant/config/` -> `/ha_config/` - dostep do rejestrow ZigBee i urzadzen HA
+- Built locally from `./ha-dashboard/Dockerfile` (Python 3.12-slim + Flask)
+- **Dependencies:** `flask`, `psycopg2-binary`, `requests`, `docker`
+- **Environment:** `DB_HOST`, `DB_PORT`, `DB_USER`, `DB_PASS`, `HA_URL`, `HA_TOKEN`, `SECRET_KEY`

-## Architektura / Powiazania
+### Volumes
+
+| Mount | Container Path | Purpose |
+|-------|---------------|---------|
+| `/var/run/docker.sock` | - | Docker API access (container info, CrowdSec exec) |
+| `./backup.log` | `/backup.log` | Database backup log |
+| `./ha-dashboard/auth/` | `/auth/` | User authentication files |
+| `./homeassistant/config/` | `/ha_config/` | HA device registry, ZigBee database |
+
+## Architecture

 ```
 HA Dashboard (Flask)
-  ├── Home Assistant REST API    - stany encji, automatyzacje, logbook
-  ├── PostgreSQL 18              - rozmiary baz homeassistant i bitwarden
-  ├── Docker socket              - lista kontenerow, exec do crowdsec
-  ├── /ha_config/zigbee.db       - baza ZigBee (ostatnia aktywnosc, LQI)
-  └── /backup.log                - historia backupow PostgreSQL
+  ├── Home Assistant REST API  - entity states, automations, logbook
+  ├── PostgreSQL 18            - homeassistant & bitwarden DB sizes
+  ├── Docker socket            - container list, exec into crowdsec
+  ├── /ha_config/zigbee.db     - ZigBee DB (last_seen, LQI)
+  └── /backup.log              - PostgreSQL backup history
 ```

-## Dostepne widoki / API
+## API Endpoints

-| Endpoint | Opis |
-|----------|------|
-| `/` | Glowny dashboard (SPA) |
-| `/api/overview` | Osoby w domu, otwarte okna/drzwi, temperatury, status Mazdy, backup |
-| `/api/home` | Stan bramy, automatyzacje bramy, lista swiatel z jasnosciami |
-| `/api/power` | Aktualne zuzycie energii (zacisk glowny, NAS, Shelly, Tasmota) |
-| `/api/frigate` | Ostatnie 9 detekcji z kamer Frigate (obrazy przez proxy) |
-| `/api/automations` | Statystyki automatyzacji HA, ostatnio uruchomione |
-| `/api/containers` | Status wszystkich kontenerow Docker |
-| `/api/crowdsec` | Aktywne bany i ostatnie alerty Crowdsec |
-| `/api/db` | Rozmiary baz danych i top 10 tabel |
-| `/api/bitwarden` | Statystyki Vaultwarden (liczba hasel wg typu) |
-| `/api/zigbee` | Lista urzadzen ZigBee z last_seen, LQI i poziomem baterii |
-| `/api/gate/events` | Historia otwarc bramy z bazy PostgreSQL |
-| `/api/gate/logbook` | Logbook bramy i automatyzacji z HA API |
-| `/api/scene/all_lights_off` | Wlaczenie sceny "wszystkie swiatla wylaczone" |
-| `/api/toggle/<entity_id>` | Wylaczenie dowolnej encji HA |
+| Endpoint | Description |
+|----------|-------------|
+| `/` | Main dashboard (SPA) |
+| `/api/overview` | People at home, open windows/doors, temperatures, Mazda status, backup |
+| `/api/home` | Gate state, gate automations, light list with brightness |
+| `/api/power` | Current power consumption (main clamp, NAS, Shelly, Tasmota) |
+| `/api/frigate` | Last 9 Frigate detections (images proxied) |
+| `/api/automations` | HA automation stats, recently triggered |
+| `/api/containers` | All Docker container statuses |
+| `/api/crowdsec` | Active bans and recent alerts |
+| `/api/db` | Database sizes and top 10 tables |
+| `/api/bitwarden` | Vaultwarden stats (password count by type) |
+| `/api/zigbee` | ZigBee devices with last_seen, LQI and battery level |
+| `/api/gate/events` | Gate open events from PostgreSQL |
+| `/api/gate/logbook` | Gate logbook and automations from HA API |
+| `/api/scene/all_lights_off` | Trigger "all lights off" scene |
+| `/api/toggle/<entity_id>` | Toggle any HA entity |

-## System uwierzytelnienia
+## Authentication

-Dwuetapowy: uzytkownik rejestruje sie (`/register`), konto wymaga recznego zatwierdzenia przez administratora (stworzenie pliku w `auth/approved/<username>`). Sesje Flask z kluczem `SECRET_KEY`.
+Two-step: user registers at `/register`, account requires manual admin approval (creation of file at `auth/approved/<username>`). Flask sessions keyed by `SECRET_KEY`.

-## Przydatne komendy
+### Approving a User

 ```bash
-# Rebuild po zmianach kodu
-docker compose build ha-dashboard && docker compose up -d ha-dashboard
-
-# Logi
-docker compose logs -f ha-dashboard
-
-# Zatwierdzenie nowego uzytkownika
+# Approve a pending user
 touch ./ha-dashboard/auth/approved/<username>

-# Lista oczekujacych na zatwierdzenie
+# List pending users
 ls ./ha-dashboard/auth/pending/
 ```
+
+## Useful Commands
+
+```bash
+# Rebuild after code changes
+docker compose build ha-dashboard && docker compose up -d ha-dashboard
+
+# Follow logs
+docker compose logs -f ha-dashboard
+```
--- a/ha-dashboard/templates/index.html
+++ b/ha-dashboard/templates/index.html
@ -313,6 +313,7 @@
 <header>
  <h1>🏠 HA Dashboard — sebson.space</h1>
  <div class="header-links">
+    <a href="https://kuma.sebson.space" target="_blank" rel="noopener" style="color:#22c55e;text-decoration:none;font-weight:600;font-size:12px;padding:4px 10px;border-radius:6px;border:1px solid #166534;" title="Uptime Kuma">🟢 Uptime</a>
    <a href="/niepalenie" style="color:#94a3b8;text-decoration:none;font-weight:600;font-size:12px;padding:4px 10px;border-radius:6px;border:1px solid #334155;" title="Niepalenie">🚭 Niepalenie</a>
    <a href="/ansible" style="color:#60a5fa;text-decoration:none;font-weight:600;font-size:12px;background:#1e3a5f;padding:4px 10px;border-radius:6px;border:1px solid #2563eb;">🚀 Ansible</a>
    <span id="refresh-info">Refresh in <span id="countdown">60</span>s</span>
--- a/homeassistant/README.md
+++ b/homeassistant/README.md
@ -1,80 +1,82 @@
-# Home Assistant
+# Home Assistant - Home Automation

-Centralny system automatyki domowej zarządzający ogrzewaniem, oświetleniem, bezpieczeństwem, czujnikami i urządzeniami IoT.
+> Central home automation engine managing heating, lighting, security, sensors and IoT devices.

-## URL / Dostep
+## Access

- UI: https://ha.sebson.space
- Port lokalny: 8123 (host network)
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://ha.sebson.space |
+| Internal Port | 8123 (`network_mode: host`) |

-## Konfiguracja
+## Configuration

- Obraz: `homeassistant/home-assistant:stable`
- Siec: `network_mode: host` (wymagane do mDNS, Bluetooth, odkrywania urzadzen)
- ZigBee: `/dev/ttyACM0` (Sonoff ZBT-2 coordinator)
- Bluetooth: `/dev/vhci`
- Baza danych: PostgreSQL 18 (`postgres18:5432`, baza `homeassistant`)
- Glowny katalog konfiguracji: `./homeassistant/config/`
- TZ: `Europe/Prague`
+- **Image:** `homeassistant/home-assistant:stable`
+- **Network:** `network_mode: host` (required for mDNS, Bluetooth, device discovery)
+- **ZigBee:** `/dev/ttyACM0` (Sonoff ZBT-2 coordinator)
+- **Bluetooth:** `/dev/vhci`
+- **Database:** PostgreSQL 18 (`postgres18:5432`, database: `homeassistant`)
+- **Config directory:** `./homeassistant/config/`
+- **Timezone:** `Europe/Prague`

-## Architektura / Powiazania
+## Architecture

 ```
 Home Assistant
-  ├── PostgreSQL 18       - baza stanow i historii (zamiast SQLite)
-  ├── Mosquitto (MQTT)    - komunikacja z ESPHome, Frigate, Tasmota, Shelly
-  ├── ESPHome             - zarzadzanie urzadzeniami ESP8266/ESP32
-  ├── Frigate             - powiadomienia o detekcji obiektow z kamer
-  ├── ZigBee (ZBT-2)      - czujniki Aqara, przelaczniki IKEA, Sonoff ZBMINI
-  └── Netatmo, Mazda API  - zewnetrzne integracje (pogoda, samochod)
+  ├── PostgreSQL 18      - state & history database (replaces SQLite)
+  ├── Mosquitto (MQTT)   - communication with ESPHome, Frigate, Tasmota, Shelly
+  ├── ESPHome            - ESP8266/ESP32 device management
+  ├── Frigate            - camera object detection notifications
+  ├── ZigBee (ZBT-2)     - Aqara sensors, IKEA switches, Sonoff ZBMINI
+  └── Netatmo, Mazda API - external integrations (weather, car)
 ```

-## Skrypty pyscript (`config/pyscript/`)
+## Pyscript Scripts (`config/pyscript/`)

-Skrypty wykonywane bezposrednio w kontekscie HA (dostep do stanow encji, MQTT, uslug).
+Scripts run directly in the HA context (access to entity states, MQTT, services).

-| Plik | Opis |
-|------|------|
-| `house_manager.py` | Glowna logika sterowania ogrzewaniem - tryby dzienny/nocny/eco, harmonogramy, wiele klimatyzatorow |
-| `vigilant_switch_manager.py` | Tryb "czujny" - wykrywa, czy ktos jest w domu na podstawie czujnikow ruchu i odleglosci GPS |
-| `terrace_light_manager.py` | Sterowanie oswietleniem tarasu - wlacza po detekcji ruchu/osoby z Frigate, wylacza z timeoutem |
-| `ikea_remote_entrance.py` | Obsluga pilota IKEA przy wejsciu - oswietlenie zewnetrzne, brama, Spotify |
-| `domofon_manager.py` | Integracja z domotem Hikvision DS-KD8003Y - przelaczanie chipow RFID, tryb Stefi |
-| `stefi_custody_days_calculator.py` | Oblicza i aktualizuje harmonogram opieki nad Stefi (naprzemienne tygodnie, swieta) |
-| `stefi_custody_calendar_generator.py` | Generuje wydarzenia w kalendarzu Google dla harmonogramu opieki |
-| `stefi_morning_wakeup_playbook.py` | Poranna rutyna budzenia Stefi - oswietlenie sceniczne + Spotify (warunkowo: szkola, swieta) |
-| `stefi_lights_scening.py` | Automatyczne scenariusze oswietlenia w pokoju Stefi |
-| `stefi_media_control.py` | Sterowanie odtwarzaczem Symfonisk w pokoju Stefi |
-| `garage_charging_coordinator.py` | Harmonogram ladowania samochodow w garazu (co 3 dni, z progiem temperatury) |
-| `kitchen_manager.py` | Automatyzacje swiatla w kuchni |
-| `tv_manager.py` | Automatyzacje zwiazane z telewizorem |
-| `attic_fan_manager.py` | Zarzadzanie wentylatorem na poddaszu |
-| `christmas_lights_manager.py` | Sterowanie swiatecznym oswietleniem zewnetrznym |
-| `driveway_lights_on_dark.py` | Oswietlenie podjazdu po zmroku |
-| `set_outside_lights_timeouts.py` | Konfiguracja timeoutow dla swiatel zewnetrznych |
-| `outside_lights_watchdog.py` | Watchdog - wylacza swiatla zewnetrzne jesli zostaly zapomniane |
-| `small_hall_light_watchdog.py` | Watchdog oswietlenia malego przedpokoju |
-| `late_lamps_off_office_n_living_room.py` | Wylacza lampy w biurze i salonie po poznej godzinie |
-| `purifiers_lifecycle_manager.py` | Sledzenie zycia filtra w oczyszczaczach powietrza |
-| `windows_monitor.py` | Monitorowanie otwartych okien, powiadomienia |
-| `camera_snapshots.py` | Pobieranie snapshotow z kamer Frigate do HA |
-| `camera_person_snapshots.py` | Snapshoty z detekcji osob z kamer |
-| `camera_hik4_robo_snapshot.py` | Automatyczny snapshot z domofonu Hikvision przy detekcji w strefie "robo" |
-| `low_battery_digest.py` | Raport urzadzen z niskim poziomem baterii (skan wszystkich sensor.battery_*) |
-| `zombie_hunter.py.off` | (wylaczony) Skanowanie encji w stanie "unavailable" |
+| Script | Description |
+|--------|-------------|
+| `house_manager.py` | Heating control - day/night/eco modes, schedules, multiple AC units |
+| `vigilant_switch_manager.py` | "Vigilant" mode - detects occupancy via motion sensors and GPS distance |
+| `terrace_light_manager.py` | Terrace lighting - triggers on Frigate person detection, auto-off with timeout |
+| `ikea_remote_entrance.py` | IKEA remote at entrance - outdoor lights, gate, Spotify |
+| `domofon_manager.py` | Hikvision DS-KD8003Y intercom integration - RFID chip management, Stefi mode |
+| `stefi_custody_days_calculator.py` | Calculates Stefi custody schedule (alternating weeks, holidays) |
+| `stefi_custody_calendar_generator.py` | Generates Google Calendar events for custody schedule |
+| `stefi_morning_wakeup_playbook.py` | Stefi morning routine - scenic lighting + Spotify (conditional: school day, not holiday) |
+| `stefi_lights_scening.py` | Automatic lighting scenes in Stefi's room |
+| `stefi_media_control.py` | Symfonisk player control in Stefi's room |
+| `garage_charging_coordinator.py` | Car charging scheduler in garage (every 3 days, with temperature threshold) |
+| `kitchen_manager.py` | Kitchen lighting automations |
+| `tv_manager.py` | TV-related automations |
+| `attic_fan_manager.py` | Attic fan management |
+| `christmas_lights_manager.py` | Outdoor Christmas lighting control |
+| `driveway_lights_on_dark.py` | Driveway lights after dusk |
+| `set_outside_lights_timeouts.py` | Configures outdoor light timeouts |
+| `outside_lights_watchdog.py` | Watchdog - turns off forgotten outdoor lights |
+| `small_hall_light_watchdog.py` | Small hallway light watchdog |
+| `late_lamps_off_office_n_living_room.py` | Turns off office and living room lamps late at night |
+| `purifiers_lifecycle_manager.py` | Air purifier filter lifetime tracking |
+| `windows_monitor.py` | Open window monitoring, notifications |
+| `camera_snapshots.py` | Fetches Frigate camera snapshots into HA |
+| `camera_person_snapshots.py` | Person detection snapshots from cameras |
+| `camera_hik4_robo_snapshot.py` | Auto snapshot from Hikvision intercom on "robo" zone detection |
+| `low_battery_digest.py` | Low battery device report (scans all `sensor.battery_*`) |
+| `zombie_hunter.py.off` | (disabled) Scans for "unavailable" entities |

-## Przydatne komendy
+## Useful Commands

 ```bash
 # Restart Home Assistant
 docker compose restart homeassistant

-# Logi
+# Follow logs
 docker compose logs -f homeassistant

-# Sprawdzenie konfiguracji przed restartem
+# Validate config before restart
 docker compose exec homeassistant ha core check

-# Wejscie do shellu kontenera
+# Enter container shell
 docker compose exec homeassistant bash
 ```
--- a/immich/README.md
+++ b/immich/README.md
@ -1,54 +1,54 @@
-# Immich
+# Immich - Self-Hosted Photo Gallery

-Samohostowana galeria zdjęć i filmów z AI rozpoznawaniem twarzy, obiektów i wyszukiwaniem semantycznym. Alternatywa dla Google Photos.
+> Photo and video gallery with AI-powered face recognition, object detection and semantic search. Alternative to Google Photos.

-## URL / Dostęp
+## Access

- Zewnętrzny: `https://immch.sebson.space`
- Lokalny: `http://192.168.1.132:2283`
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://immch.sebson.space |
+| Internal | http://192.168.1.132:2283 |

-## Architektura
+## Architecture

-```
-immich-server       - główny backend (API, UI)
-immich-postgres     - PostgreSQL 14 + vectorchord (wektory ML)
-immich-redis        - cache sesji i kolejek
-immich-machine-learning - AI (CLIP embeddings, face recognition buffalo_l)
-```
+| Component | Purpose |
+|-----------|---------|
+| `immich-server` | Main backend (API, UI) |
+| `immich-postgres` | PostgreSQL 14 + vectorchord (ML vectors) |
+| `immich-redis` | Session cache and job queue |
+| `immich-machine-learning` | AI (CLIP embeddings, face recognition buffalo_l) |

 ## Storage

- Zdjęcia/wideo: `/media/seagata16t/immich/`
- Model cache ML: `./immich/model-cache/`
- Baza danych: `./immich/postgres/`
+| Path | Contents |
+|------|----------|
+| `/media/seagata16t/immich/` | Photos and videos |
+| `./immich/model-cache/` | ML model cache |
+| `./immich/postgres/` | Database files |

-## Limity zasobów
+## Resource Limits

- `immich-server`: 6 GB RAM
- `immich-machine-learning`: 2 CPU, 3 GB RAM
+| Component | Limit |
+|-----------|-------|
+| `immich-server` | 6 GB RAM |
+| `immich-machine-learning` | 2 CPU, 3 GB RAM |

-## Konfiguracja
+## Notes

-Zmienne środowiskowe w `.env` (wspólne z resztą stacku):
- `DB_PASSWORD` - hasło do immich_postgres
- `REDIS_*` - opcjonalne, domyślnie bez hasła
+- Dedicated PostgreSQL instance (`immich_postgres`) - separate from the shared `postgres18`
+- Dedicated Redis (`immich_redis`) - not shared with other services
+- ML runs on CPU only (no GPU passthrough)

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker logs immich_server -f
 docker logs immich_machine_learning -f

 # Restart
 docker compose restart immich-server immich-machine-learning

-# Rozmiar biblioteki
+# Check library size
 du -sh /media/seagata16t/immich/
 ```
-
-## Uwagi
-
- Własna baza PostgreSQL (immich_postgres) - oddzielna od postgres18
- Redis (immich_redis) - dedykowany, nie współdzielony
- ML działa na CPU (brak GPU passthrough)
--- a/jellyfin/README.md
+++ b/jellyfin/README.md
@ -1,38 +1,40 @@
-# Jellyfin
+# Jellyfin - Media Server

-Serwer multimediow open-source. Strumieniuje filmy, seriale i muzyke z podlaczonych dyskow.
+> Open-source media streaming server for movies, TV series and music from attached storage.

-## URL / Dostep
+## Access

- URL: https://jfin.sebson.space
- Port wewnetrzny: 8096
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://jfin.sebson.space |
+| Internal Port | 8096 |

-## Konfiguracja
+## Configuration

- Konfiguracja w `./jellyfin/config/`
- PUID=1000, PGID=1000 (uprawnienia plikow)
- TZ=Europe/Prague
+- **Config:** `./jellyfin/config/`
+- **PUID/PGID:** 1000 (file permissions)
+- **Timezone:** `Europe/Prague`

-## Storage / Dane
+## Storage

-| Sciezka (host) | Montaz w kontenerze | Zawartosc |
-|----------------|---------------------|-----------|
-| `./jellyfin/config/` | `/config` | konfiguracja, baza metadanych |
-| `/media/seagata16t/` | `/media/seagata16t` | 16TB - glowne media |
-| `/media/wd1t/` | `/media/wd1t` | dysk pomocniczy |
-| `/media/evo2t/` | `/media/evo2t` | SSD cache / dodatkowe media |
-| `/media/asustor/` | `/media/asustor` | NAS - dodatkowe media |
+| Host Path | Container Mount | Contents |
+|-----------|-----------------|----------|
+| `./jellyfin/config/` | `/config` | Configuration, metadata database |
+| `/media/seagata16t/` | `/media/seagata16t` | 16TB - primary media |
+| `/media/wd1t/` | `/media/wd1t` | Secondary disk |
+| `/media/evo2t/` | `/media/evo2t` | SSD cache / additional media |
+| `/media/asustor/` | `/media/asustor` | NAS - additional media |

-## Powiazania
+## Dependencies

- **Traefik** - reverse proxy, TLS
- **Prometheus** - mozliwe metryki przez plugin jellyfin-prometheus-exporter
- Wspoldzieli dostep do dyskow z Immich i qBittorrent
+- **Traefik** - reverse proxy with TLS
+- **Prometheus** - optional metrics via jellyfin-prometheus-exporter plugin
+- Shares disk access with Immich and qBittorrent

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f jellyfin

 # Restart
@ -41,7 +43,7 @@ docker compose restart jellyfin
 # Upgrade
 ./upgrade-container-by-name.sh jellyfin

-# Skanowanie biblioteki przez API
+# Trigger library scan via API
 curl -X POST "http://localhost:8096/Library/Refresh" \
  -H "X-Emby-Token: <API_KEY>"
 ```
--- a/log-ingester/README.md
+++ b/log-ingester/README.md
@ -1,8 +1,8 @@
-# log-ingester
+# Log Ingester - RAG Data Pipeline

-Customowy serwis RAG. Co 5 minut pobiera dane z czterech zrodel, tworzy embeddingi przez Ollama i zapisuje do ChromaDB. Udostepnia tez API wyszukiwania semantycznego dla Open WebUI.
+> Custom RAG (Retrieval-Augmented Generation) service. Ingests data from four sources every 5 minutes, creates embeddings via Ollama, and stores them in ChromaDB. Provides semantic search API for Open WebUI.

-## Architektura
+## Architecture

 ```
 [Frigate SQLite]   --\
@ -10,55 +10,57 @@ Customowy serwis RAG. Co 5 minut pobiera dane z czterech zrodel, tworzy embeddin
 [home-assistant.log] -/
 [Docker logs]      --/

-[Open WebUI Tool] --> [search_api.py] --> [ChromaDB] --> wyniki semantyczne
+[Open WebUI Tool] --> [search_api.py] --> [ChromaDB] --> semantic results
 ```

-## Pliki
+## Files

-| Plik | Opis |
-|------|------|
-| `ingest.py` | Glowna petla ingestion, uruchamiana co INGEST_INTERVAL sekund |
-| `search_api.py` | FastAPI do wyszukiwania semantycznego po kolekcjach |
-| `openwebui_tool.py` | Tool plugin dla Open WebUI |
-| `state/state.json` | Persystentny stan (ostatni przetworzony ID, pozycja w logu, timestamp) |
+| File | Description |
+|------|-------------|
+| `ingest.py` | Main ingestion loop, runs every `INGEST_INTERVAL` seconds |
+| `search_api.py` | FastAPI semantic search endpoint |
+| `openwebui_tool.py` | Open WebUI tool plugin |
+| `state/state.json` | Persistent state (last processed ID, log position, timestamp) |

-## Konfiguracja (zmienne env)
+## Environment Variables

-| Zmienna | Domyslnie | Opis |
-|---------|-----------|------|
-| `CHROMA_HOST` | `chromadb` | Host ChromaDB |
-| `CHROMA_PORT` | `8000` | Port ChromaDB |
-| `OLLAMA_URL` | `http://ollama:11434` | URL Ollama |
-| `FRIGATE_DB` | `/data/frigate/frigate.db` | Sciezka do bazy Frigate |
-| `HA_LOG` | `/data/ha/home-assistant.log` | Sciezka do logu HA |
-| `STATE_FILE` | `/data/state/state.json` | Plik stanu |
-| `INGEST_INTERVAL` | `300` | Interwał w sekundach |
-| `PG_HOST` | `postgres18` | Host PostgreSQL (HA recorder) |
-| `PG_DB` | `homeassistant` | Baza HA |
-| `PG_PASS` | - | Haslo PostgreSQL (wymagane) |
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `CHROMA_HOST` | `chromadb` | ChromaDB host |
+| `CHROMA_PORT` | `8000` | ChromaDB port |
+| `OLLAMA_URL` | `http://ollama:11434` | Ollama URL |
+| `FRIGATE_DB` | `/data/frigate/frigate.db` | Frigate database path |
+| `HA_LOG` | `/data/ha/home-assistant.log` | HA log file path |
+| `STATE_FILE` | `/data/state/state.json` | State file path |
+| `INGEST_INTERVAL` | `300` | Interval in seconds |
+| `PG_HOST` | `postgres18` | PostgreSQL host (HA recorder) |
+| `PG_DB` | `homeassistant` | HA database name |
+| `PG_PASS` | - | PostgreSQL password (required) |

-## Kolekcje ChromaDB
+## ChromaDB Collections

- `frigate_events` - zdarzenia detekcji (label, camera, timestamp, score)
- `ha_history` - zmiany stanow encji HA (ostatnie 7 dni, okno kroczace)
- `ha_logs` - bloki 25 linii z home-assistant.log
- `docker_logs` - logi kontenerow: homeassistant, frigate, mosquitto, esphome, traefik, crowdsec, immich_server, ha-dashboard
+| Collection | Contents |
+|------------|----------|
+| `frigate_events` | Detection events (label, camera, timestamp, score) |
+| `ha_history` | HA entity state changes (rolling 7-day window) |
+| `ha_logs` | 25-line blocks from home-assistant.log |
+| `docker_logs` | Logs from: homeassistant, frigate, mosquitto, esphome, traefik, crowdsec, immich_server, ha-dashboard |

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi ingestion
+# Follow ingestion logs
 docker compose logs -f log-ingester

-# Stan przetworzonych danych
+# Check processed state
 cat /home/seba/mydocker/log-ingester/state/state.json

-# Test API wyszukiwania
+# Test search API
 curl -X POST http://localhost:8765/search \
  -H "Content-Type: application/json" \
-  -d '{"query": "kto byl przy drzwiach wczoraj", "n_results": 5}'
+  -d '{"query": "who was at the door yesterday", "n_results": 5}'

-# Statystyki kolekcji
+# Collection statistics
 curl http://localhost:8765/stats

 # Rebuild
--- a/loki/README.md
+++ b/loki/README.md
@ -1,53 +1,57 @@
-# Loki
+# Loki - Log Aggregation

-System agregacji logow (Grafana Loki). Przyjmuje logi od Promtail i udostepnia je Grafanie przez LogQL.
+> Grafana Loki log aggregation system. Receives logs from Promtail and exposes them to Grafana via LogQL.

-## URL / Dostep
+## Access

- Wewnetrzny: http://loki:3100 (brak publicznego dostepu przez Traefik)
- Lokalny: http://localhost:3100
- Brak uwierzytelniania (`auth_enabled: false`)
+| Endpoint | Details |
+|----------|---------|
+| Internal | http://loki:3100 (no public Traefik access) |
+| Local | http://localhost:3100 |
+| Auth | None (`auth_enabled: false`) |

-## Konfiguracja
+## Configuration

-Plik: `./loki/loki-config.yaml`
+Config file: `./loki/loki-config.yaml`

-Kluczowe parametry:
- Port HTTP: `3100`
- Backend storage: `tsdb` (schemat v13, od 2024-01-01)
- Dane na dysku: `./loki/data/` (wolumen Docker)
-  - Indeks: `/loki/index`
-  - Chunki: `/loki/chunks`
-  - Cache: `/loki/cache`
-  - WAL: `./loki/wal/`
- Retencja logow: **744h (31 dni)**
- Ingestion rate: max 10 MB/s (burst 20 MB/s)
- Kompakcja z usuwaniem: wlaczona (`retention_enabled: true`), opoznienie 2h
+### Key Parameters

-## Co monitoruje / metryki
+| Parameter | Value |
+|-----------|-------|
+| HTTP Port | `3100` |
+| Storage backend | `tsdb` (schema v13, from 2024-01-01) |
+| Data location | `./loki/data/` (Docker volume) |
+| Index | `/loki/index` |
+| Chunks | `/loki/chunks` |
+| Cache | `/loki/cache` |
+| WAL | `./loki/wal/` |
+| **Log retention** | **744h (31 days)** |
+| Ingestion rate | max 10 MB/s (burst 20 MB/s) |
+| Compaction + retention | enabled (`retention_enabled: true`), 2h delay |

-Loki przechowuje logi - nie metryki. Zrodla logow:
- Wszystkie kontenery Docker (dostarczane przez Promtail przez Docker socket)
+## Data Sources

-Dostep do logow w Grafanie: datasource `Loki` (uid: `loki`), max 1000 linii na zapytanie.
+Loki stores logs - not metrics. All Docker containers push logs via Promtail (Docker socket discovery).

-## Powiazania z innymi serwisami
+Access in Grafana: datasource `Loki` (uid: `loki`), max 1000 lines per query.

-| Serwis | Rola |
-|--------|------|
-| Promtail | jedyny klient push (POST `/loki/api/v1/push`) |
-| Grafana | odpytuje logi przez LogQL |
+## Dependencies

-## Przydatne komendy
+| Service | Role |
+|---------|------|
+| Promtail | Only push client (POST `/loki/api/v1/push`) |
+| Grafana | Queries logs via LogQL |
+
+## Useful Commands

 ```bash
 # Restart
 docker compose restart loki

-# Logi
+# Follow logs
 docker compose logs -f loki

-# Sprawdz status/metryki Loki
+# Check Loki status
 curl http://localhost:3100/ready
 curl http://localhost:3100/metrics | grep loki_ingester

--- a/mktxp/README.md
+++ b/mktxp/README.md
@ -1,80 +1,79 @@
-# mktxp (MikroTik Exporter)
+# mktxp - MikroTik Prometheus Exporter

-Eksporter Prometheus dla routera MikroTik. Laczy sie z routerem przez API RouterOS i udostepnia metryki do scrapowania przez Prometheus.
+> Exporter for MikroTik RouterOS metrics. Connects via RouterOS API and exposes metrics for Prometheus scraping.

-## URL / Dostep
+## Access

- Metryki: http://localhost:49090/metrics (wewnetrzny, brak Traefik)
- Polaczenie z routerem: `192.168.1.1:8728` (RouterOS API, plaintext)
+| Endpoint | Details |
+|----------|---------|
+| Metrics | http://localhost:49090/metrics (internal, no Traefik) |
+| Router API | `192.168.1.1:8728` (RouterOS API, plaintext) |

-## Konfiguracja
+## Configuration

-Pliki w `./mktxp/`:
- `mktxp.conf` - konfiguracja routerow (credentials, co zbierac)
- `_mktxp.conf` - parametry globalne exportera
+Files in `./mktxp/`:

-**Router MikroTik** (`mktxp.conf`):
- Host: `192.168.1.1`, port `8728`
- Uzytkownik API: `prometheus` (konto dedykowane na routerze)
- SSL: wylaczone (plaintext login)
+| File | Purpose |
+|------|---------|
+| `mktxp.conf` | Router credentials, collection toggles |
+| `_mktxp.conf` | Global exporter parameters |

-Wlaczone zbieranie (`mktxp.conf`):
- `dhcp` + `dhcp_lease` - dzierzawy DHCP
- `connections` - aktywne polaczenia
- `interface` - statystyki interfejsow
- `monitor` - monitoring portu (ethernet)
- `public_ip` - publiczny adres IP
- `route` - tablice routingu
- `queue` - kolejki QoS
- `wireguard` + `wireguard_peers` - VPN WireGuard
+### Router Connection

-Parametry globalne (`_mktxp.conf`):
- Port nasluchiwania: `0.0.0.0:49090`
- Timeout: 8s, maks 5 watkow roboczych
- Test przepustowosci: wylaczony (`bandwidth = False`)
- Minimalny interwal: 5s, max czas scrape: 15s
+- **Host:** `192.168.1.1`, port `8728`
+- **API user:** `prometheus` (dedicated read-only account on router)
+- **SSL:** disabled (plaintext login)

-## Co monitoruje / metryki
+### Enabled Collections

-| Obszar | Przyklad metryk |
-|--------|----------------|
-| DHCP | liczba dzierzaw, aktywni klienci |
-| Interfejsy | tx/rx bytes, pps, bledy, status linka |
-| Polaczenia | aktywne sesje TCP/UDP |
-| Routing | trasy statyczne i dynamiczne |
-| QoS | kolejki, drop rate |
-| WireGuard | status peerow, transfer, last handshake |
-| IP publiczne | zewnetrzny adres IP routera |
+| Collection | Metrics |
+|------------|---------|
+| `dhcp` + `dhcp_lease` | DHCP leases, active clients |
+| `connections` | Active TCP/UDP connections |
+| `interface` | Interface statistics (tx/rx bytes, pps, errors) |
+| `monitor` | Ethernet port monitoring |
+| `public_ip` | External IP address |
+| `route` | Routing table |
+| `queue` | QoS queues |
+| `wireguard` + `wireguard_peers` | WireGuard VPN peers, transfer, last handshake |

-## Powiazania z innymi serwisami
+### Global Parameters (`_mktxp.conf`)

-| Serwis | Rola |
-|--------|------|
-| MikroTik 192.168.1.1 | zrodlo danych (RouterOS API :8728) |
-| Prometheus | scrapuje metryki z `:49090` co 30s |
-| VictoriaMetrics | dlugoterminowe archiwum (przez Prometheus remote_write) |
-| Grafana | wizualizacja metryk routera |
+- Listen: `0.0.0.0:49090`
+- Timeout: 8s, max 5 worker threads
+- Bandwidth test: disabled
+- Min interval: 5s, max scrape time: 15s

-## Przydatne komendy
+## Dependencies
+
+| Service | Role |
+|---------|------|
+| MikroTik 192.168.1.1 | Data source (RouterOS API :8728) |
+| Prometheus | Scrapes metrics from `:49090` every 30s |
+| VictoriaMetrics | Long-term archive (via Prometheus remote_write) |
+| Grafana | Router metrics visualization |
+
+## Router Account Setup
+
+Create a read-only `prometheus` account on MikroTik:
+
+```
+/user add name=prometheus group=read password=<secure_password>
+/ip service enable api
+```
+
+## Useful Commands

 ```bash
 # Restart
 docker compose restart mktxp

-# Logi
+# Follow logs
 docker compose logs -f mktxp

-# Sprawdz metryki recznie
+# Check metrics manually
 curl http://localhost:49090/metrics | grep mktxp_

 # Upgrade
 ./upgrade-container-by-name.sh mktxp
 ```
-
-## Konto na routerze
-
-Na MikroTik nalezy miec konto `prometheus` z minimalnym dostepem tylko do odczytu (grup API read). Konfiguracja w RouterOS:
-```
-/user add name=prometheus group=read password=mktxp_monitor123
-/ip service enable api
-```
--- a/mosquitto/README.md
+++ b/mosquitto/README.md
@ -1,67 +1,72 @@
-# Mosquitto
+# Mosquitto - MQTT Broker

-Broker MQTT bedacy magistrala komunikacyjna dla calego systemu smart home - laczy Home Assistant, Frigate, urzadzenia Tasmota, Shelly i czujniki ESP.
+> Central message bus for the smart home - connects Home Assistant, Frigate, Tasmota, Shelly and ESP devices.

-## URL / Dostep
+## Access

- MQTT: `192.168.1.132:1883` (TCP, wymaga uwierzytelnienia)
- WebSockets: `192.168.1.132:9001`
- Brak interfejsu webowego
+| Endpoint | Details |
+|----------|---------|
+| MQTT TCP | `192.168.1.132:1883` (authentication required) |
+| WebSockets | `192.168.1.132:9001` |
+| Web UI | None (headless broker) |

-## Konfiguracja
+## Configuration

- Obraz: `eclipse-mosquitto:2` (seria 2.x; unikamy niejawnego `:latest`)
- Siec: `network_mode: host`
- Plik konfiguracyjny: `./mosquitto/config/mosquitto.conf`
- Hasla: `./mosquitto/config/mosquitto.passwd` (format bcrypt)
- Dane persystentne: `./mosquitto/data/`
- Logi: `./mosquitto/log/`
+- **Image:** `eclipse-mosquitto:2` (pinned to 2.x series)
+- **Network:** `network_mode: host`
+- **Config:** `./mosquitto/config/mosquitto.conf`
+- **Passwords:** `./mosquitto/config/mosquitto.passwd` (bcrypt format)
+- **Data:** `./mosquitto/data/`
+- **Logs:** `./mosquitto/log/`

-Kluczowe ustawienia:
- `allow_anonymous false` - wymagane uwierzytelnienie
- `persistence false` - broker nie zapisuje retajnowanych wiadomości ani stanu na dysku (po restarcie znikają retained; dla typowego HA + czujników często OK)
- `persistence_location` wskazuje na volume `/mosquitto/data` (gdyby włączyć `persistence true`)
- Opcjonalne fragmenty konfiguracji: katalog `config/conf.d/*.conf` (ładowane przez `include_dir`)
- `persistent_client_expiration 3m` - klienci offline usuwani po 3 minutach
- `max_inflight_messages 40`
- Logowane tylko bledy, ostrzezenia i powiadomienia (nie kazde polaczenie)
+### Key Settings

-## Architektura / Powiazania
+| Setting | Value | Notes |
+|---------|-------|-------|
+| `allow_anonymous` | `false` | Authentication mandatory |
+| `persistence` | `false` | Retained messages cleared on restart - fine for typical HA sensor workloads |
+| `persistent_client_expiration` | `3m` | Offline clients removed after 3 minutes |
+| `max_inflight_messages` | `40` | |
+| Log level | errors, warnings, notifications only | No per-connection logging |
+
+Optional config fragments can be placed in `config/conf.d/*.conf` (loaded via `include_dir`).
+
+## Architecture

 ```
-Mosquitto MQTT Broker (port 1883)
-  ├── Home Assistant   - subskrybuje/publikuje stany urzadzen
-  ├── Frigate          - publikuje zdarzenia detekcji (topic: frigate/#)
-  ├── ESPHome          - niektore urzadzenia przez MQTT zamiast API natywnego
-  ├── Tasmota          - inteligentne gniazdka, przelaczniki
-  └── Shelly           - przekazniki, mierniki mocy
+Mosquitto MQTT Broker (:1883)
+  ├── Home Assistant   - subscribes/publishes device states
+  ├── Frigate          - publishes detection events (topic: frigate/#)
+  ├── ESPHome          - some devices via MQTT instead of native API
+  ├── Tasmota          - smart plugs, switches
+  └── Shelly           - relays, power meters
 ```

-## Zarzadzanie uzytkownikami
+## User Management

 ```bash
-# Dodanie nowego uzytkownika (wewnatrz kontenera)
-docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd nowy_uzytkownik
+# Add a new user (inside container)
+docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd <username>

-# Zmiana hasla
-docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd uzytkownik
+# Change password
+docker compose exec mosquitto mosquitto_passwd /mosquitto/config/mosquitto.passwd <username>

-# Restart po zmianach
+# Restart after changes
 docker compose restart mosquitto
 ```

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi brokera
+# Follow broker logs
 docker compose logs -f mosquitto

-# Podsluchiwanie wszystkich wiadomosci (z hosta, wymaga mosquitto-clients)
-mosquitto_sub -h 192.168.1.132 -u mosquitto -P <haslo> -t '#' -v
+# Subscribe to ALL topics (requires mosquitto-clients on host)
+mosquitto_sub -h 192.168.1.132 -u mosquitto -P <password> -t '#' -v

-# Podsluchiwanie tylko zdarzen Frigate
-mosquitto_sub -h 192.168.1.132 -u mosquitto -P <haslo> -t 'frigate/#' -v
+# Subscribe to Frigate events only
+mosquitto_sub -h 192.168.1.132 -u mosquitto -P <password> -t 'frigate/#' -v

-# Testowe wyslanie wiadomosci
-mosquitto_pub -h 192.168.1.132 -u mosquitto -P <haslo> -t 'test/topic' -m 'hello'
+# Publish a test message
+mosquitto_pub -h 192.168.1.132 -u mosquitto -P <password> -t 'test/topic' -m 'hello'
 ```
--- a/pingexporter/README.md
+++ b/pingexporter/README.md
@ -1,67 +1,73 @@
-# ping-exporter
+# Ping Exporter - ICMP Network Monitor

-Eksporter Prometheus mierzacy dostepnosc i latencje sieci przez ICMP ping. Generuje metryki RTT, packet loss i jitter dla skonfigurowanych hostow.
+> Prometheus exporter measuring network availability and latency via ICMP ping. Tracks RTT, packet loss and jitter for configured hosts.

-## URL / Dostep
+## Access

- Metryki: http://localhost:9427/metrics (host network)
- Brak publicznego dostepu przez Traefik
+| Endpoint | Details |
+|----------|---------|
+| Metrics | http://localhost:9427/metrics (`network_mode: host`) |
+| Public access | None (no Traefik) |

-## Konfiguracja
+## Configuration

-Plik: `./pingexporter/config/config.yml`
+Config file: `./pingexporter/config/config.yml`

-**Hosty docelowe:**
+### Target Hosts

-| Host | Typ |
-|------|-----|
-| 8.8.8.8 | Google DNS (internet) |
-| 8.8.4.4 | Google DNS 2 (internet) |
-| 4.2.2.1 | Level3 DNS (internet) |
-| klfree.cz | zewnetrzny host (internet) |
-| 192.168.1.1 | router MikroTik (LAN) |
-| 192.168.1.132 | host glowny (acemagic) |
-| 192.168.1.219 | inne urzadzenie LAN |
+| Host | Type |
+|------|------|
+| `8.8.8.8` | Google DNS (internet) |
+| `8.8.4.4` | Google DNS 2 (internet) |
+| `4.2.2.1` | Level3 DNS (internet) |
+| `klfree.cz` | External host (internet) |
+| `192.168.1.1` | MikroTik router (LAN) |
+| `192.168.1.132` | Main host (acemagic) |
+| `192.168.1.219` | Other LAN device |

-**Parametry pingu:**
- Interwal pomiaru: co **2s**
- Timeout: 3s
- Historia: ostatnie 60 pomiarow (2 minuty okna)
- Rozmiar pakietu ICMP: 120 bajtow
- IPv6: wylaczone
+### Ping Parameters
+
+| Parameter | Value |
+|-----------|-------|
+| Measurement interval | Every **2s** |
+| Timeout | 3s |
+| History | Last 60 measurements (2-minute window) |
+| ICMP packet size | 120 bytes |
+| IPv6 | Disabled |
+
+### DNS

-**DNS:**
 - Resolver: `1.1.1.1` (Cloudflare)
- Odswiezanie rekordow: co 2 min 15 s
+- Record refresh: every 2 min 15 s

-## Co monitoruje / metryki
+## Metrics

-| Metryka | Opis |
-|---------|------|
+| Metric | Description |
+|--------|-------------|
 | `ping_rtt_seconds` | Round-trip time (min/mean/max/std) |
 | `ping_loss_ratio` | Packet loss (0.0 - 1.0) |
-| `ping_up` | Host osiagalny (1/0) |
+| `ping_up` | Host reachable (1/0) |

-Pozwala wykryc: utrate polaczenia internetowego, degradacje jakosci lacza, problemy z konkretnym segmentem sieci LAN.
+Useful for detecting: internet connection drops, link quality degradation, specific LAN segment issues.

-## Powiazania z innymi serwisami
+## Dependencies

-| Serwis | Rola |
-|--------|------|
-| Prometheus | scrapuje `acemagic:9427` co 15s |
-| VictoriaMetrics | dlugoterminowe archiwum |
-| Grafana | dashboard `ping-monitoring.json` |
+| Service | Role |
+|---------|------|
+| Prometheus | Scrapes `acemagic:9427` every 15s |
+| VictoriaMetrics | Long-term archive |
+| Grafana | `ping-monitoring.json` dashboard |

-## Przydatne komendy
+## Useful Commands

 ```bash
 # Restart
 docker compose restart ping-exporter

-# Logi
+# Follow logs
 docker compose logs -f ping-exporter

-# Sprawdz metryki recznie
+# Check metrics manually
 curl http://localhost:9427/metrics | grep ping_

 # Upgrade
--- a/prometheus/README.md
+++ b/prometheus/README.md
@ -1,66 +1,72 @@
-# Prometheus
+# Prometheus - Metrics Collection

-System zbierania metryk (time-series database). Scrapuje eksportery co 15s, przechowuje dane 30 dni / max 20 GB, nastepnie zapisuje do VictoriaMetrics (remote_write) jako archiwum dlugoterminowe.
+> Time-series database. Scrapes exporters every 15s, retains data for 30 days / 20 GB, then forwards to VictoriaMetrics via remote_write for long-term storage.

-## URL / Dostep
+## Access

- Publiczny: https://prom.sebson.space
- Lokalny: http://localhost:29090
- Basic auth: uzytkownik `seba` (haslo z `.env`)
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://prom.sebson.space |
+| Internal | http://localhost:29090 |
+| Auth | Basic auth, user `seba` (password in `.env`) |

-## Konfiguracja
+## Configuration

-Pliki w `./prometheus/`:
- `prometheus.yml` - glowna konfiguracja scrapowania
- `web.yml` - basic auth (bcrypt hash hasla)
- `pinghosts.yaml` - hosty dla blackbox exportera (google.com, github.com)
- `hosts` - lokalne mapowania DNS dla scrapowanych hostow
- `storage/` - dane TSDB (retencja 30d)
+Files in `./prometheus/`:

-Parametry startu (z docker-compose):
- `--storage.tsdb.retention.time=30d`
- `--storage.tsdb.retention.size=20GB`
- `--web.config.file=/etc/prometheus/web.yml`
+| File | Purpose |
+|------|---------|
+| `prometheus.yml` | Main scrape configuration |
+| `web.yml` | Basic auth (bcrypt password hash) |
+| `pinghosts.yaml` | Blackbox exporter targets (google.com, github.com) |
+| `hosts` | Local DNS mappings for scraped hosts |
+| `storage/` | TSDB data (30d retention) |

-## Co monitoruje / metryki
+### Startup Parameters

-Skonfigurowane joby (`prometheus.yml`):
+```
+--storage.tsdb.retention.time=30d
+--storage.tsdb.retention.size=20GB
+--web.config.file=/etc/prometheus/web.yml
+```

-| Job | Cel | Interwal |
-|-----|-----|---------|
+## Scrape Jobs
+
+| Job | Target | Interval |
+|-----|--------|----------|
 | `prometheus` | localhost:9090 (self-monitoring) | 5s |
 | `node-exporter` | acemagic, rpi4, sebas-macpro, asustor-lan1, mycloud, crowdsec:6060 | 15s |
 | `ping-exporter` | acemagic:9427 | 15s |
-| `cadvisor` | cadvisor:8080 (kontenery Docker) | 15s |
+| `cadvisor` | cadvisor:8080 (Docker containers) | 15s |
 | `home-assistant` | 192.168.1.132:8123/api/prometheus | 10s |
 | `traefik` | traefik:8080 | 5s |
-| `pushgateway` | 192.168.1.132:9091 (metryki push z side-agent) | 5s |
+| `pushgateway` | 192.168.1.132:9091 (side-agent push metrics) | 5s |
 | `postgres` | postgres-exporter:9187 | 15s |
-| `smartctl` | smartctl-exporter:9633 (S.M.A.R.T. dyskow) | 15s |
+| `smartctl` | smartctl-exporter:9633 (disk S.M.A.R.T.) | 15s |
 | `mktxp` | mktxp:49090 (MikroTik router) | 30s |
 | `wireguard` | 172.17.0.1:9586 | 15s |

-Remote write: wszystkie metryki kopiowane do `http://victoriametrics:8428/api/v1/write`.
+**Remote write:** all metrics replicated to `http://victoriametrics:8428/api/v1/write`.

-## Powiazania z innymi serwisami
+## Dependencies

-| Serwis | Rola |
-|--------|------|
-| VictoriaMetrics | archiwum dlugoterminowe (remote_write) |
-| Grafana | odczytuje metryki (jako `Prometheus-Raw`) |
-| Alertmanager | odbiera alerty z Prometheus (`alertmanager:9093`) |
-| Wszystkie eksportery | zrodla metryk (node, cadvisor, mktxp, smartctl, itd.) |
+| Service | Role |
+|---------|------|
+| VictoriaMetrics | Long-term archive (remote_write) |
+| Grafana | Reads metrics (as `Prometheus-Raw` source) |
+| Alertmanager | Receives alerts (`alertmanager:9093`) |
+| All exporters | Metric sources |

-## Przydatne komendy
+## Useful Commands

 ```bash
 # Restart
 docker compose restart prometheus

-# Logi
+# Follow logs
 docker compose logs -f prometheus

-# Sprawdz aktywne targety
+# Check active targets
 curl -s http://localhost:29090/api/v1/targets | jq '.data.activeTargets[] | {job: .labels.job, health: .health}'

 # Upgrade
--- a/promtail/README.md
+++ b/promtail/README.md
@ -1,54 +1,63 @@
-# Promtail
+# Promtail - Log Shipper

-Agent zbierajacy logi i wysylajacy je do Loki. Automatycznie odkrywa wszystkie kontenery Docker przez Docker socket i przekazuje ich stdout/stderr.
+> Log collection agent that discovers Docker containers via the Docker socket and forwards stdout/stderr to Loki.

-## URL / Dostep
+## Access

- Wewnetrzny port HTTP: `9080` (health check, metryki)
- Brak publicznego dostepu
- Dostep do Docker socket: `unix:///var/run/docker.sock`
+| Endpoint | Details |
+|----------|---------|
+| HTTP Port | `9080` (health check, metrics) |
+| Public access | None |
+| Docker socket | `unix:///var/run/docker.sock` |

-## Konfiguracja
+## Configuration

-Plik: `./promtail/promtail-config.yaml`
+Config file: `./promtail/promtail-config.yaml`

-Kluczowe parametry:
- Port HTTP: `9080`
- Cel push: `http://loki:3100/loki/api/v1/push`
- Plik pozycji (checkpointing): `/tmp/positions.yaml`
- Odswiezanie listy kontenerow: co 5s
+### Key Parameters

-Scrape job `docker`:
- Odkrywa kontenery przez `docker_sd_configs`
- Label `container` - nazwa kontenera (bez `/`)
- Label `stream` - `stdout` lub `stderr`
- Parser `pipeline_stages: docker` - parsuje format logow Docker
+| Parameter | Value |
+|-----------|-------|
+| HTTP Port | `9080` |
+| Push target | `http://loki:3100/loki/api/v1/push` |
+| Positions file | `/tmp/positions.yaml` (checkpointing) |
+| Container refresh | Every 5s |

-## Co monitoruje / metryki
+### Scrape Job: `docker`

-Zbiera logi ze wszystkich uruchomionych kontenerow Docker na hoscie. Kazdy log wzbogacony jest o:
- `container` - nazwa kontenera
- `stream` - typ strumienia
- Metadane z Docker (image, compose project, itd.)
+- Discovers containers via `docker_sd_configs`
+- Label `container` - container name (without leading `/`)
+- Label `stream` - `stdout` or `stderr`
+- Pipeline: `docker` parser for Docker log format

-## Powiazania z innymi serwisami
+## Data Collected

-| Serwis | Rola |
-|--------|------|
-| Docker socket | zrodlo logow (service discovery + streaming) |
-| Loki | cel push logow |
-| Grafana | posrednio - Grafana odpytuje Loki |
+Collects logs from all running Docker containers on the host. Each log entry is enriched with:

-## Przydatne komendy
+| Label | Description |
+|-------|-------------|
+| `container` | Container name |
+| `stream` | Stream type (stdout/stderr) |
+| Docker metadata | Image, compose project, etc. |
+
+## Dependencies
+
+| Service | Role |
+|---------|------|
+| Docker socket | Log source (service discovery + streaming) |
+| Loki | Push destination |
+| Grafana | Indirect - Grafana queries Loki |
+
+## Useful Commands

 ```bash
 # Restart
 docker compose restart promtail

-# Logi (promtaila)
+# Follow logs
 docker compose logs -f promtail

-# Sprawdz status
+# Check status
 curl http://localhost:9080/ready
 curl http://localhost:9080/targets

--- a/prowlarr/Definitions/dasunerwartete-api.yml
+++ b/prowlarr/Definitions/dasunerwartete-api.yml
@ -10,9 +10,9 @@ links:

 caps:
  categorymappings:
-    - {id: 145, cat: Movies, desc: "Filme > DRG"}
    - {id: 28, cat: Movies/SD, desc: "Filme > SD"}
    - {id: 32, cat: Movies/HD, desc: "Filme > HD"}
+    - {id: 145, cat: Movies, desc: "Filme > DRG"}
    - {id: 114, cat: Movies/UHD, desc: "Filme > UHD"}
    - {id: 140, cat: Movies/BluRay, desc: "Filme > BluRay"}
    - {id: 143, cat: TV/Anime, desc: "Filme > Anime"}
@ -36,6 +36,7 @@ caps:
    - {id: 15, cat: TV/Documentary, desc: "Doku > SD"}
    - {id: 14, cat: TV/Documentary, desc: "Doku > HD"}
    - {id: 123, cat: TV/Documentary, desc: "Doku > Reihe"}
+    - {id: 153, cat: TV/Documentary, desc: "Doku > Dokus/UHD"}
    - {id: 126, cat: PC/Mobile-Other, desc: "Spiel > Mobil"}
    - {id: 17, cat: PC/Games, desc: "Spiel > PC"}
    - {id: 24, cat: Console, desc: "Spiel > Konsole"}
@ -51,9 +52,13 @@ caps:
    - {id: 142, cat: XXX/ImageSet, desc: "XXX > Pic´s"}
    - {id: 129, cat: Movies/SD, desc: "Internal > Film SD"}
    - {id: 128, cat: Movies/HD, desc: "Internal > Film HD"}
+    - {id: 152, cat: Movies/UHD, desc: "Internal > Film UHD"}
    - {id: 131, cat: TV/SD, desc: "Internal > Serien SD"}
    - {id: 130, cat: TV/HD, desc: "Internal > Serien HD"}
    - {id: 132, cat: Other, desc: "Internal > Sonstiges"}
+    - {id: 149, cat: Movies/UHD, desc: "Internal > Packs UHD"}
+    - {id: 150, cat: Movies/HD, desc: "Internal > Packs HD"}
+    - {id: 151, cat: Movies/SD, desc: "Internal > Packs SD"}

  modes:
    search: [q]
--- a/prowlarr/Definitions/dasunerwartete.yml
+++ b/prowlarr/Definitions/dasunerwartete.yml
@ -10,9 +10,9 @@ links:

 caps:
  categorymappings:
-    - {id: 145, cat: Movies, desc: "Filme > DRG"}
    - {id: 28, cat: Movies/SD, desc: "Filme > SD"}
    - {id: 32, cat: Movies/HD, desc: "Filme > HD"}
+    - {id: 145, cat: Movies, desc: "Filme > DRG"}
    - {id: 114, cat: Movies/UHD, desc: "Filme > UHD"}
    - {id: 140, cat: Movies/BluRay, desc: "Filme > BluRay"}
    - {id: 143, cat: TV/Anime, desc: "Filme > Anime"}
@ -36,6 +36,7 @@ caps:
    - {id: 15, cat: TV/Documentary, desc: "Doku > SD"}
    - {id: 14, cat: TV/Documentary, desc: "Doku > HD"}
    - {id: 123, cat: TV/Documentary, desc: "Doku > Reihe"}
+    - {id: 153, cat: TV/Documentary, desc: "Doku > Dokus/UHD"}
    - {id: 126, cat: PC/Mobile-Other, desc: "Spiel > Mobil"}
    - {id: 17, cat: PC/Games, desc: "Spiel > PC"}
    - {id: 24, cat: Console, desc: "Spiel > Konsole"}
@ -51,9 +52,13 @@ caps:
    - {id: 142, cat: XXX/ImageSet, desc: "XXX > Pic´s"}
    - {id: 129, cat: Movies/SD, desc: "Internal > Film SD"}
    - {id: 128, cat: Movies/HD, desc: "Internal > Film HD"}
+    - {id: 152, cat: Movies/UHD, desc: "Internal > Film UHD"}
    - {id: 131, cat: TV/SD, desc: "Internal > Serien SD"}
    - {id: 130, cat: TV/HD, desc: "Internal > Serien HD"}
    - {id: 132, cat: Other, desc: "Internal > Sonstiges"}
+    - {id: 149, cat: Movies/UHD, desc: "Internal > Packs UHD"}
+    - {id: 150, cat: Movies/HD, desc: "Internal > Packs HD"}
+    - {id: 151, cat: Movies/SD, desc: "Internal > Packs SD"}

  modes:
    search: [q]
--- a/prowlarr/README.md
+++ b/prowlarr/README.md
@ -1,45 +1,45 @@
-# Prowlarr
+# Prowlarr - Indexer Manager

-Menedzer indekserow torrent/usenet. Agreguje zrodla i udostepnia je klientom (Radarr, Sonarr, qBittorrent).
+> Torrent/Usenet indexer manager. Aggregates sources and shares them with clients (Radarr, Sonarr, qBittorrent).

-## URL / Dostep
+## Access

- URL: http://localhost:9696 (brak publicznego dostępu przez Traefik)
- Uwierzytelnienie: Forms (login/haslo)
+| Endpoint | Details |
+|----------|---------|
+| Web UI | http://localhost:9696 (no public Traefik access) |
+| Auth | Forms (login/password) |

-## Konfiguracja
+## Configuration

- Obraz: `linuxserver/prowlarr`
- Port: 9696
- Branch: master
- API Key: przechowywany w `./prowlarr/config.xml`
- PUID=1000, PGID=1000
- TZ=Europe/Prague
+- **Image:** `linuxserver/prowlarr`
+- **Port:** 9696
+- **Branch:** master
+- **API Key:** stored in `./prowlarr/config.xml`
+- **PUID/PGID:** 1000
+- **Timezone:** `Europe/Prague`

-Konfiguracja serwisu: `./prowlarr/config.xml`
+## Storage

-## Storage / Dane
+| Path | Contents |
+|------|----------|
+| `./prowlarr/` | Entire config directory mounted as `/config` |
+| `./prowlarr/config.xml` | Main config (API key, port, auth) |
+| `./prowlarr/prowlarr.db` | SQLite database with indexers |
+| `./prowlarr/Definitions/` | Indexer definitions |
+| `./prowlarr/Backups/` | Automatic config backups |
+| `./prowlarr/logs/` | Application logs |

-| Sciezka | Zawartosc |
-|---------|-----------|
-| `./prowlarr/` | caly katalog konfiguracyjny montowany jako `/config` |
-| `./prowlarr/config.xml` | glowna konfiguracja (API key, port, auth) |
-| `./prowlarr/prowlarr.db` | baza SQLite z indekserami |
-| `./prowlarr/Definitions/` | definicje indekserow |
-| `./prowlarr/Backups/` | automatyczne backupy konfiguracji |
-| `./prowlarr/logs/` | logi aplikacji |
+## Dependencies

-## Powiazania
+- **Radarr** - receives movie search results
+- **Sonarr** - receives TV show search results
+- **qBittorrent** (torrent-box-with-vpn) - download client
+- Shares VPN network with qBittorrent via `network_mode: "service:gluetun"`

- **Radarr** - pobiera wyniki wyszukiwan filmow
- **Sonarr** - pobiera wyniki wyszukiwan seriali
- **qBittorrent** (torrent-box-with-vpn) - klient pobierania
- Dzieli siec VPN z qBittorrent: `network_mode: "service:gluetun"`
-
-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f prowlarr

 # Restart
--- a/setup_kuma_monitors.py
+++ b/setup_kuma_monitors.py
@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""Add monitors to Uptime Kuma via Socket.IO.
+Runs on the host, connects directly to Kuma container's IP.
+Token read from .env - never exposed to chat."""
+import os
+import sys
+import time
+import json
+import subprocess
+
+try:
+    import socketio
+except ImportError:
+    venv = os.path.join(os.path.dirname(__file__), ".kuma_venv")
+    if not os.path.exists(venv):
+        print("Creating virtual environment...")
+        subprocess.check_call([sys.executable, "-m", "venv", venv])
+    pip = os.path.join(venv, "bin", "pip")
+    print("Installing python-socketio[client]...")
+    subprocess.check_call([pip, "install", "-q", "python-socketio[client]"])
+    python = os.path.join(venv, "bin", "python")
+    os.execv(python, [python] + sys.argv)
+
+import socketio
+
+# Read token from .env
+token = None
+env_file = os.path.join(os.path.dirname(__file__), ".env")
+with open(env_file) as f:
+    for line in f:
+        if line.startswith("UPTIME_KUMA_API_KEY="):
+            token = line.split("=", 1)[1].strip()
+            break
+
+if not token:
+    print("ERROR: UPTIME_KUMA_API_KEY not found in .env")
+    sys.exit(1)
+
+# Find Kuma's container IP
+result = subprocess.run(
+    ["docker", "inspect", "uptime-kuma", "-f", "{{.NetworkSettings.Networks.mydocker_default.IPAddress}}"],
+    capture_output=True, text=True
+)
+kuma_ip = result.stdout.strip()
+kuma_url = f"http://{kuma_ip}:3001"
+
+MONITORS = [
+    {"name": "Traefik", "type": "https", "url": "https://traefik.sebson.space"},
+    {"name": "Home Assistant", "type": "https", "url": "https://ha.sebson.space"},
+    {"name": "Grafana", "type": "https", "url": "https://grafana.sebson.space"},
+    {"name": "Bitwarden", "type": "https", "url": "https://bward.sebson.space"},
+    {"name": "Immich", "type": "https", "url": "https://immch.sebson.space"},
+    {"name": "Jellyfin", "type": "https", "url": "https://jfin.sebson.space"},
+    {"name": "Prometheus", "type": "https", "url": "https://prom.sebson.space"},
+    {"name": "HA Dashboard", "type": "https", "url": "https://hadash.sebson.space"},
+    {"name": "Brana Frontend", "type": "https", "url": "https://brana.sebson.space"},
+    {"name": "MikroTik", "type": "ping", "hostname": "192.168.1.1"},
+    {"name": "Google DNS", "type": "ping", "hostname": "8.8.8.8"},
+    {"name": "Frigate", "type": "http", "url": "http://acemagic:5000"},
+    {"name": "Ollama", "type": "http", "url": "http://acemagic:11434"},
+    {"name": "Gotify", "type": "http", "url": "http://acemagic:86"},
+    {"name": "Dozzle", "type": "http", "url": "http://acemagic:8080"},
+    {"name": "OpenSpeedTest", "type": "http", "url": "http://acemagic:3000"},
+    {"name": "Gitea", "type": "http", "url": "http://acemagic:3002"},
+    {"name": "PostgreSQL", "type": "tcp", "hostname": "acemagic", "port": 5432},
+    {"name": "Mosquitto", "type": "tcp", "hostname": "acemagic", "port": 1883},
+    {"name": "Redis", "type": "tcp", "hostname": "acemagic", "port": 6379},
+]
+
+sio = socketio.Client(logger=False, engineio_logger=False, reconnection=False)
+print(f"Connecting to Kuma at {kuma_url}...")
+sio.connect(kuma_url, wait_timeout=10)
+print("Connected via Socket.IO")
+
+r = sio.call("loginByToken", {"token": token}, timeout=10)
+if r.get("ok"):
+    print("API token accepted")
+else:
+    print(f"Token rejected: {r}")
+    sio.disconnect()
+    sys.exit(1)
+
+print(f"Adding {len(MONITORS)} monitors...")
+added = 0
+for m in MONITORS:
+    p = {"name": m["name"], "type": m["type"], "interval": 30, "maxretries": 3, "retryInterval": 15, "notificationIDList": {}, "upsideDown": False}
+    if m["type"] in ("https", "http"):
+        p["url"] = m["url"]
+        if m["type"] == "https":
+            p["expiryNotification"] = True
+    elif m["type"] == "ping":
+        p["hostname"] = m["hostname"]
+    elif m["type"] == "tcp":
+        p["hostname"] = m["hostname"]
+        p["port"] = m["port"]
+    try:
+        r = sio.call("add", p, timeout=10)
+        if r.get("ok") or "Successfully" in str(r.get("msg", "")):
+            print(f"  OK  {m['name']} (id={r.get('monitorID', '?')})")
+            added += 1
+        else:
+            print(f"  ?   {m['name']} -> {r}")
+    except Exception as e:
+        print(f"  FAIL {m['name']} -> {e}")
+    time.sleep(0.2)
+
+sio.disconnect()
+print(f"\nDone. {added}/{len(MONITORS)} added.")
--- a/side-agent/README.md
+++ b/side-agent/README.md
@ -1,63 +1,63 @@
-# side-agent
+# Side Agent - Custom Background Daemons

-Customowy kontener z trzema daemonami uruchamianymi rownoczesnie. Ma dostep do docker.sock i montuje caly katalog /mydocker. Sluzy jako "klej" laczacy monitoring kamer, zarzadzanie kontenerami i harmonogram backupow.
+> Custom container running three daemons simultaneously. Has Docker socket access and mounts the entire `/mydocker` directory. Acts as "glue" connecting camera monitoring, container management and backup scheduling.

-## Daemony
+## Daemons

-### snapit.py
+### snapit.py - Camera Snapshot Monitor

-Monitoruje katalog z klipami Frigate (`/media/evo2t/frigate/clips`). Wykrywa nowe pliki JPG per kamera, kopiuje je jako plik notyfikacji dla Home Assistant i wysyla metryki gauge do Prometheus Pushgateway.
+Monitors the Frigate clips directory (`/media/evo2t/frigate/clips`). Detects new JPG files per camera, copies them as notification files for Home Assistant, and pushes gauge metrics to Prometheus Pushgateway.

- Kamery: reolink_1-5, hikvision_2, hikvision_4
- Wykrywane obiekty: person, car, dog, cat, animal
- Pushgateway: `http://<PUSHGATEWAY_HOST>:9091/metrics/job/camera_detection/camera/<name>`
- Metryka `person_detected{camera="..."}` - licznik aktywnych detekcji, resetuje sie po 30s od ostatniego zdarzenia
- Archiwizacja klatek: `/hikvision/objects-detected/<camera>/<data>/`
+- **Cameras:** reolink_1-5, hikvision_2, hikvision_4
+- **Detected objects:** person, car, dog, cat, animal
+- **Pushgateway:** `http://<PUSHGATEWAY_HOST>:9091/metrics/job/camera_detection/camera/<name>`
+- **Metric:** `person_detected{camera="..."}` - gauge of active detections, resets after 30s from last event
+- **Archive:** frames archived to `/hikvision/objects-detected/<camera>/<date>/`

-### container_manager.py
+### container_manager.py - Container Version Checker

-Sprawdza co 3600s czy sa dostepne nowe wersje obrazow Docker dla wszystkich uruchomionych kontenerow (pomija lokalne buildy i obrazy bez taga). Aktualizuje manifest wersji.
+Checks every 3600s for new Docker image versions across all running containers (skips local builds and SHA-referenced images). Updates the version manifest.

- Manifest: `./side-agent/manifest/container_versions.yaml`
- Pomija: obrazy z prefiksem `mydocker_`, `docker-`, obrazy referencjonowane po SHA
+- **Manifest:** `./side-agent/manifest/container_versions.yaml`
+- **Skips:** images prefixed with `mydocker_`, `docker-`, SHA-referenced images

-### backup_scheduler.py
+### backup_scheduler.py - NAS Backup Scheduler

-Harmonogram rsync do NAS Asustor (`root@asustor-lan1`). Zastepuje crony z Ansible.
+Schedules rsync to Asustor NAS (`root@asustor-lan1`). Replaces Ansible crons.

-| Zadanie | Harmonogram | Zrodlo | Cel |
-|---------|-------------|--------|-----|
-| mydocker backup (rotacja 3 dni) | codziennie 07:33 | `/mydocker/` | `/volume1/data/rsyncs/mydocker_YYYYMMDD/` |
-| myansible sync | codziennie 01:10 | `../git.repos/myansible/` | `/volume1/data/rsyncs/myansible/` |
-| myansible -> gdrive | niedziele 01:15 | `../git.repos/myansible/` | `/volume1/data/google-drive-sync/...` |
-| /etc/hosts | codziennie 01:15 | `/etc/hosts` | `/volume1/data/rsyncs/hosts` |
-| valuable_scripts | codziennie 01:15 | `../valuable_scripts/` | `/volume1/data/rsyncs/valuable_scripts/` |
+| Task | Schedule | Source | Destination |
+|------|----------|--------|-------------|
+| mydocker backup (3-day rotation) | Daily 07:33 | `/mydocker/` | `/volume1/data/rsyncs/mydocker_YYYYMMDD/` |
+| myansible sync | Daily 01:10 | `../git.repos/myansible/` | `/volume1/data/rsyncs/myansible/` |
+| myansible -> gdrive | Sundays 01:15 | `../git.repos/myansible/` | `/volume1/data/google-drive-sync/...` |
+| /etc/hosts | Daily 01:15 | `/etc/hosts` | `/volume1/data/rsyncs/hosts` |
+| valuable_scripts | Daily 01:15 | `../valuable_scripts/` | `/volume1/data/rsyncs/valuable_scripts/` |

-## Wolumeny
+## Volumes

-```
-/var/run/docker.sock  - dostep do Docker API
-/home/seba/mydocker   - montowany jako /mydocker
-/media/evo2t/frigate/clips - zrodlo klipow Frigate (SOURCE_DIR)
-/media/seagata16t/hikvision16t - archiwum detekcji (TARGET_DIR)
-```
+| Host Mount | Container Mount | Purpose |
+|------------|-----------------|---------|
+| `/var/run/docker.sock` | - | Docker API access |
+| `/home/seba/mydocker` | `/mydocker` | Full project directory |
+| `/media/evo2t/frigate/clips` | - | Frigate clip source (`SOURCE_DIR`) |
+| `/media/seagata16t/hikvision16t` | - | Detection archive (`TARGET_DIR`) |

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi wszystkich daemonow
+# Follow all daemon logs
 docker compose logs -f side-agent

-# Aktualny manifest wersji kontenerow
+# View current container version manifest
 cat /home/seba/mydocker/side-agent/manifest/container_versions.yaml

-# Reczny test backupu mydocker
+# Manual test: mydocker backup
 docker exec side-agent python3 /app/backup_scheduler.py --test-mydocker

-# Reczny test wszystkich backupow
+# Manual test: all backups
 docker exec side-agent python3 /app/backup_scheduler.py --test-all

-# Sprawdz metryki pushgateway
+# Check pushgateway metrics
 curl http://192.168.1.132:9091/metrics | grep person_detected

 # Rebuild
--- a/timelapse_service/README.md
+++ b/timelapse_service/README.md
@ -1,63 +1,63 @@
-# timelapse_service
+# Timelapse Service - Camera Timelapse Generator

-Customowy serwis generowania timelapsy z nagran kamer. Oparty na cronie i ffmpeg. Przetwarza zdjecia JPG nagrane przez kamery Hikvision/Reolink i tworzy pliki MP4 dla roznych okresow.
+> Cron-based service generating timelapse videos from camera recordings. Processes Hikvision/Reolink JPG frames and creates MP4 files for various time periods.

-## Jak dziala
+## How It Works

-1. Kamery zapisuja klatki JPG do `/media/seagata16t/hikvision16t/<kamera>/<data>/`
-2. Cron w kontenerze uruchamia `timelapse_maker.py` z odpowiednim parametrem
-3. Skrypt zbiera JPG, skleja przez ffmpeg (libx264, 1920x1080, 30fps) w MP4
-4. Wyniki trafiaja do `/media/seagata16t/all_timelapses/`
-5. Co uruchomienie `today` usuwa katalogi JPG starsze niz 7 dni
+1. Cameras save JPG frames to `/media/seagata16t/hikvision16t/<camera>/<date>/`
+2. Cron in container triggers `timelapse_maker.py` with the appropriate parameter
+3. Script collects JPGs, stitches via ffmpeg (libx264, 1920x1080, 30fps) into MP4
+4. Results saved to `/media/seagata16t/all_timelapses/`
+5. On each `today` run, deletes JPG directories older than 7 days

-## Kamery
+## Cameras

 reolink_1, reolink_2, reolink_3, reolink_4, reolink_5, hikvision_2, hikvision_4

-Przetwarzanie rownolegne: 2 procesy jednoczesnie (`Pool(processes=2)`).
+Parallel processing: 2 concurrent processes (`Pool(processes=2)`).

-## Harmonogram cron
+## Cron Schedule

-| Kiedy | Komenda | Opis |
-|-------|---------|------|
-| codziennie 23:59 | `timelapse_maker.py today` | Timelapse dzisiejszego dnia + czyszczenie starych JPG |
-| co tydzien | `timelapse_maker.py week` | Timelapse tygodniowy (cel: 120s) |
-| co miesiac | `timelapse_maker.py month` | Timelapse miesiac poprzedni (cel: 180s) |
-| 31 grudnia 23:09 | `timelapse_maker.py year` | Timelapse roczny za miniony rok (cel: 300s) |
+| When | Command | Description |
+|------|---------|-------------|
+| Daily 23:59 | `timelapse_maker.py today` | Today's timelapse + cleanup old JPGs |
+| Weekly | `timelapse_maker.py week` | Weekly timelapse (target: 120s) |
+| Monthly | `timelapse_maker.py month` | Previous month (target: 180s) |
+| Dec 31 23:09 | `timelapse_maker.py year` | Previous year (target: 300s) |

-Dla `week`, `month`, `year` - skrypt laczy dzienne MP4 i przyspiesza do docelowego czasu trwania.
+For `week`, `month`, `year` - the script merges daily MP4s and speeds up to the target duration.

-## Parametry CLI
+## CLI Parameters

 ```bash
-python3 timelapse_maker.py today          # dzisiaj
-python3 timelapse_maker.py 2025-01-15    # konkretna data
-python3 timelapse_maker.py week          # biezacy tydzien
-python3 timelapse_maker.py month         # poprzedni miesiac
-python3 timelapse_maker.py year          # poprzedni rok
-python3 timelapse_maker.py today --cleanup  # wymus czyszczenie JPG
+python3 timelapse_maker.py today            # Today
+python3 timelapse_maker.py 2025-01-15      # Specific date
+python3 timelapse_maker.py week            # Current week
+python3 timelapse_maker.py month           # Previous month
+python3 timelapse_maker.py year            # Previous year
+python3 timelapse_maker.py today --cleanup # Force JPG cleanup
 ```

-## Sciezki
+## Paths

-| Zrodlo JPG | `/media/seagata16t/hikvision16t/<kamera>/<YYYY-MM-DD>/` |
-|---|---|
-| Wyniki MP4 | `/media/seagata16t/all_timelapses/timelapse_<kamera>_<okres>.mp4` |
-| Logi cron | `/var/log/cron.log` wewnatrz kontenera |
+| Source JPGs | `/media/seagata16t/hikvision16t/<camera>/<YYYY-MM-DD>/` |
+|-------------|----------------------------------------------------------|
+| Output MP4s | `/media/seagata16t/all_timelapses/timelapse_<camera>_<period>.mp4` |
+| Cron logs | `/var/log/cron.log` inside container |

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi kontenera
+# Follow container logs
 docker compose logs -f timelapse-service

-# Reczne uruchomienie dla konkretnej daty
+# Manual run for a specific date
 docker exec timelapse-service python3 /usr/src/app/timelapse_maker.py 2025-06-01

-# Reczne uruchomienie tygodniowego
+# Manual weekly timelapse
 docker exec timelapse-service python3 /usr/src/app/timelapse_maker.py week

-# Sprawdz logi cron wewnatrz kontenera
+# Check cron logs inside container
 docker exec timelapse-service tail -100 /var/log/cron.log

 # Rebuild
--- a/traefik/README.md
+++ b/traefik/README.md
@ -1,55 +1,59 @@
-# Traefik
+# Traefik - Reverse Proxy

-Reverse proxy dla wszystkich serwisów w stacku. Obsługuje routing HTTP/HTTPS, automatyczne certyfikaty TLS via Let's Encrypt (ACME) oraz middleware bezpieczenstwa.
+> Single entry point for all services in the stack. Handles HTTP/HTTPS routing, automatic TLS certificates via Let's Encrypt (ACME), and security middleware.

-## URL / Dostep
+## Access

- Dashboard: https://traefik.sebson.space (basic auth: seba)
- Wejscie: port 80 (HTTP) i 443 (HTTPS)
+| Endpoint | Details |
+|----------|---------|
+| Dashboard | https://traefik.sebson.space (basic auth: `seba`) |
+| Entry points | Port 80 (HTTP) and 443 (HTTPS) |

-## Konfiguracja
+## Configuration

- Glowna konfiguracja statyczna: `./traefik/config/traefik.yml`
- Konfiguracja dynamiczna: `./traefik/config/dynamic_conf.yml`
- Certyfikaty ACME (Let's Encrypt): `./traefik/letsencrypt/acme.json` (chmod 600)
- ACME email: rewelacyjny.rower@gmail.com
- Serwisy rejestruja sie automatycznie przez Docker labels (`traefik.enable=true`)
+- **Static config:** `./traefik/config/traefik.yml`
+- **Dynamic config:** `./traefik/config/dynamic_conf.yml`
+- **ACME certs:** `./traefik/letsencrypt/acme.json` (must be `chmod 600`)
+- **ACME email:** rewelacyjny.rower@gmail.com
+- Services auto-register via Docker labels (`traefik.enable=true`)

 ### Middleware

- `crowdsec@file` - integracja z CrowdSec (ForwardAuth do `traefik-bouncer:8080`)
- `my-geoblock` - blokada geograficzna, przepuszcza tylko CH (Szwajcaria) + lokalne
+| Middleware | Purpose |
+|------------|---------|
+| `crowdsec@file` | CrowdSec integration (ForwardAuth to `traefik-bouncer:8080`) |
+| `my-geoblock` | Geographic block - allows only Switzerland (CH) + local ranges |

 ### Plugin

- `geoblock` v0.2.8 (github.com/PascalMinder/geoblock)
+- **geoblock** v0.2.8 ([github.com/PascalMinder/geoblock](https://github.com/PascalMinder/geoblock))

-## Storage / Dane
+## Storage

-| Sciezka | Zawartosc |
-|---------|-----------|
+| Path | Contents |
+|------|----------|
 | `./traefik/config/` | traefik.yml, dynamic_conf.yml |
-| `./traefik/letsencrypt/acme.json` | certyfikaty TLS |
-| `./traefik/logs/access.log` | logi dostepu (czytane przez CrowdSec i Promtail) |
+| `./traefik/letsencrypt/acme.json` | TLS certificates |
+| `./traefik/logs/access.log` | Access logs (consumed by CrowdSec and Promtail) |

-## Powiazania
+## Dependencies

- **CrowdSec** - analizuje `access.log`, bouncer blokuje zle IP
- **Promtail** - pobiera `access.log` do Loki
- **Prometheus** - metryki wbudowane w Traefik
- Kazdy serwis z `traefik.enable=true` jest automatycznie rejestrowany
+- **CrowdSec** - analyzes `access.log`, bouncer blocks bad IPs
+- **Promtail** - ships `access.log` to Loki
+- **Prometheus** - built-in Traefik metrics
+- Every service with `traefik.enable=true` is auto-registered

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi Traefika
+# Follow Traefik logs
 docker compose logs -f traefik

-# Sprawdzenie certyfikatow (plik musi miec 600)
+# Check certificate file permissions (must be 600)
 ls -la traefik/letsencrypt/acme.json

-# Reload konfiguracji dynamicznej (bez restartu)
-# Traefik wykrywa zmiany w dynamic_conf.yml automatycznie
+# Dynamic config reload (no restart needed)
+# Traefik auto-detects changes in dynamic_conf.yml

 # Restart
 docker compose restart traefik
--- a/transmission-vpn/README.md
+++ b/transmission-vpn/README.md
@ -1,50 +1,52 @@
-# Transmission VPN
+# Transmission VPN - Legacy

-Klient torrent Transmission tunelowany przez NordVPN (OpenVPN).
+> Torrent client tunneled through NordVPN (OpenVPN).

-> **LEGACY** - Ten kontener zostal zastapiony przez `torrent-box-with-vpn` (w katalogu `./torrent-box-with-vpn/`). Pozostawiony dla kompatybilnosci wstecznej.
+> **DEPRECATED** - This service has been replaced by [`torrent-box-with-vpn`](../torrent-box-with-vpn/). Kept for backward compatibility only.

-## URL / Dostep
+## Access

- Web UI: http://localhost:9092 (port 9092->9091)
- Brak publicznego dostepu przez Traefik
+| Endpoint | Details |
+|----------|---------|
+| Web UI | http://localhost:9092 (port mapping: 9092->9091) |
+| Public access | None |

-## Konfiguracja
+## Configuration

- Obraz: `haugene/transmission-openvpn`
- VPN: NordVPN (OPENVPN_PROVIDER=NORDVPN), serwery DE (Niemcy)
- Dane dostepu VPN z `.env` (OPENVPN_USERNAME, OPENVPN_PASSWORD)
- Wymaga `NET_ADMIN` capability (tun/tap dla OpenVPN)
+- **Image:** `haugene/transmission-openvpn`
+- **VPN:** NordVPN (`OPENVPN_PROVIDER=NORDVPN`), DE (Germany) servers
+- **Credentials:** from `.env` (`OPENVPN_USERNAME`, `OPENVPN_PASSWORD`)
+- **Capability:** requires `NET_ADMIN` (tun/tap for OpenVPN)

-## Storage / Dane
+## Storage

-| Sciezka | Zawartosc |
-|---------|-----------|
-| `./transmission-vpn/completed/` | ukonczane pobierania |
-| `./transmission-vpn/incomplete/` | pobierania w toku |
-| `./transmission-vpn/watch/` | katalog watch (automatyczne dodawanie .torrent) |
-| `./transmission-vpn/music_downloads/` | pobrane pliki muzyczne |
-| `./transmission-vpn/transmission-home/` | konfiguracja Transmission |
-| `./transmission-vpn/shared/` | katalog wspolny |
+| Path | Contents |
+|------|----------|
+| `./transmission-vpn/completed/` | Completed downloads |
+| `./transmission-vpn/incomplete/` | In-progress downloads |
+| `./transmission-vpn/watch/` | Watch folder (auto-add .torrent files) |
+| `./transmission-vpn/music_downloads/` | Music downloads |
+| `./transmission-vpn/transmission-home/` | Transmission configuration |
+| `./transmission-vpn/shared/` | Shared directory |

-## Powiazania
+## Notes

- **NordVPN** - caly ruch routowany przez VPN (kill switch aktywny)
- Nowy stack: `./torrent-box-with-vpn/` (preferowany)
+- All traffic is routed through VPN (kill switch active)
+- The preferred replacement stack is in `./torrent-box-with-vpn/`

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi
+# Follow logs
 docker compose logs -f transmission-vpn

-# Sprawdzenie IP VPN (powinno pokazac DE)
+# Verify VPN IP (should show Germany)
 docker exec transmission-vpn curl -s https://ipinfo.io/ip

 # Restart
 docker compose restart transmission-vpn

-# Nowy preferowany stack
+# Migrate to new stack
 cd /home/seba/mydocker/torrent-box-with-vpn
 make start
 ```
--- a/unifi-config/README.md
+++ b/unifi-config/README.md
@ -1,48 +1,50 @@
-# UniFi Controller
+# UniFi Controller - Network Management

-Kontroler sieci UniFi (Ubiquiti) do zarzadzania punktami dostepu i switchami.
+> Ubiquiti UniFi network controller for managing access points and switches.

-## URL / Dostep
+## Access

- Panel: https://192.168.1.239:8443 (lokalna siec)
- Traefik proxy: skonfigurowane jako `unifi-svc` w `traefik.yml`
- Siec: `network_mode: host` (wymagane do device discovery / mDNS)
+| Endpoint | Details |
+|----------|---------|
+| Panel | https://192.168.1.239:8443 (LAN only) |
+| Traefik proxy | Configured as `unifi-svc` in `traefik.yml` |
+| Network | `network_mode: host` (required for device discovery / mDNS) |

-## Konfiguracja
+## Configuration

- Obraz: `jacobalberty/unifi`
- Siec: host network (port 8443 HTTPS, 8080 HTTP, 3478/UDP STUN, 6789 speed test)
- Baza danych: MongoDB 7.0 na `localhost:27017` (kontener `unifi-db`)
- Konfiguracja przez zmienne w `.env`
+- **Image:** `jacobalberty/unifi`
+- **Network:** host network (ports: 8443 HTTPS, 8080 HTTP, 3478/UDP STUN, 6789 speed test)
+- **Database:** MongoDB 7.0 on `localhost:27017` (container `unifi-db`)

-## Storage / Dane
+## Storage

-| Sciezka | Zawartosc |
-|---------|-----------|
-| `./unifi-config/data/` | konfiguracja kontrolera, certyfikaty |
-| `./unifi-config/log/` | logi aplikacji |
-| `./unifi-config/run/` | pliki PID / runtime |
+| Path | Contents |
+|------|----------|
+| `./unifi-config/data/` | Controller configuration, certificates |
+| `./unifi-config/log/` | Application logs |
+| `./unifi-config/run/` | PID / runtime files |

-Baza MongoDB trzyma swoje dane w `./unifi-db/`.
+MongoDB data stored in `./unifi-db/`.

-## Powiazania
+## Dependencies

- **unifi-db** - MongoDB 7.0, baza danych kontrolera
- **Traefik** - proxy do panelu (passHostHeader: false)
- Host network - wymagany do automatycznego wykrywania urzadzen w sieci LAN
+- **unifi-db** - MongoDB 7.0, controller database
+- **Traefik** - proxy to panel (passHostHeader: false)
+- **Host network** - required for automatic LAN device discovery

-## Przydatne komendy
+## Useful Commands

 ```bash
-# Logi kontrolera
+# Follow controller logs
 docker compose logs -f unifi

-# Logi MongoDB
+# Follow MongoDB logs
 docker compose logs -f unifi-db

 # Restart
 docker compose restart unifi unifi-db

-# Backup konfiguracji (przez panel: Settings > Backup)
-# Lub reczne skopiowanie ./unifi-config/data/
+# Backup configuration
+# Via panel: Settings > Backup
+# Or manually copy ./unifi-config/data/
 ```
--- a/uptime-kuma/README.md
+++ b/uptime-kuma/README.md
@ -0,0 +1,57 @@
+# Uptime Kuma - Uptime Monitoring
+
+> Self-hosted uptime monitoring with status pages. Monitors HTTP(S), TCP, DNS, ICMP and more. Sends notifications on downtime.
+
+## Access
+
+| Endpoint | Details |
+|----------|---------|
+| Public URL | https://kuma.sebson.space |
+| Internal Port | 3001 |
+| Auth | Shared Traefik basic auth (same as Traefik dashboard / Prometheus) |
+
+## Configuration
+
+- **Image:** `louislam/uptime-kuma:1`
+- **Data:** `./uptime-kuma/data/` (SQLite database, all config persisted)
+- Setup done via web UI on first access
+
+## Features
+
+- Monitoring protocols: HTTP(s), TCP, Ping, DNS, Docker containers, and more
+- Status pages with custom domains
+- Notifications via Telegram, Gotify, email, webhook, and 40+ more
+- 20-second check interval
+- Certificate expiry monitoring
+- Multi-language support
+
+## Typical Monitors to Add
+
+| Monitor | Type | Target |
+|---------|------|--------|
+| Traefik | HTTPS | https://traefik.sebson.space |
+| Home Assistant | HTTPS | https://ha.sebson.space |
+| Grafana | HTTPS | https://grafana.sebson.space |
+| Bitwarden | HTTPS | https://bward.sebson.space |
+| Immich | HTTPS | https://immch.sebson.space |
+| Jellyfin | HTTPS | https://jfin.sebson.space |
+| Prometheus | HTTPS | https://prom.sebson.space |
+| HA Dashboard | HTTPS | https://hadash.sebson.space |
+| MikroTik | Ping | 192.168.1.1 |
+| Internet | Ping | 8.8.8.8 |
+
+## Useful Commands
+
+```bash
+# Start
+docker compose up -d uptime-kuma
+
+# Follow logs
+docker compose logs -f uptime-kuma
+
+# Restart
+docker compose restart uptime-kuma
+
+# Stop
+docker compose stop uptime-kuma
+```
--- a/uptime-kuma/data/.env_host
+++ b/uptime-kuma/data/.env_host