diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index 575ac3f..0273d00 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -51,6 +51,10 @@ services_to_deploy:
 # ============================================
 # NETWORK / FIREWALL
 # ============================================
+# POZNAMKA: firewall (UFW) se nenastavuje automaticky.
+# Pokud chces firewall, nastav ho rucne (Cloudflare Tunnel,
+# security group na VPS, docker-network oddeleni, ...).
+# Tato promenna zustava pro pripadnou budouci konfiguraci.
 ssh_port: 22
 allowed_ports:
   - { port: 22, proto: tcp, comment: "SSH" }
diff --git a/playbooks/prepare-new-server.yml b/playbooks/prepare-new-server.yml
index ca2f6f5..f9dfc5f 100644
--- a/playbooks/prepare-new-server.yml
+++ b/playbooks/prepare-new-server.yml
@@ -8,9 +8,11 @@
 # 4. Adresarova struktura (/home/deploy/docker, ...)
 # 5. Docker Engine + Compose plugin
 # 6. Deploy user v docker group (docker bez sudo)
-# 7. UFW firewall (povoleno SSH, HTTP, HTTPS)
-# 8. fail2ban
+# 7. fail2ban
 #
+# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele
+# neni firewalled nasazen potreba. Pro produkcni nasazeni doporucujeme
+# nastavit firewall externe (Cloudflare Tunnel, security group na VPS, ...).
 # Pouziti:
 #   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
 #   # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
@@ -45,7 +47,7 @@
           - nahraje SSH klice
           - nainstaluje Docker + Compose
           - vytvori adresarovou strukturu
-          - nastavi firewall
+          - nainstaluje fail2ban
 
           SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
           Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
@@ -61,8 +63,6 @@
       tags: [user, deploy]
     - role: ssh-keys
       tags: [ssh, keys]
-    - role: firewall
-      tags: [firewall, ufw]
     - role: docker
       tags: [docker]
     - role: directories
diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml
index 0f23bce..67c0dad 100644
--- a/roles/common/defaults/main.yml
+++ b/roles/common/defaults/main.yml
@@ -11,11 +11,16 @@ deploy_groups:
 
 timezone: Europe/Prague
 
-# Balíky co se instalují vždy
+# Zakladni baliky co se instaluji vzdy
 base_packages:
   - curl
   - wget
   - git
+  - unzip
+  - rsync
+  - tree
+  - btop
+  - mc
   - vim
   - htop
   - ca-certificates
@@ -24,7 +29,5 @@ base_packages:
   - apt-transport-https
   - bash-completion
   - software-properties-common
-  - unzip
   - zip
-  - rsync
   - net-tools
diff --git a/roles/firewall/defaults/main.yml b/roles/firewall/defaults/main.yml
deleted file mode 100644
index f154a0f..0000000
--- a/roles/firewall/defaults/main.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-# Proměnné pro firewall roli
-ssh_port: 22
-# Dalsi porty co chces povolit (pro servery)
-allowed_ports:
-  - { port: 80, proto: tcp, comment: "HTTP" }
-  - { port: 443, proto: tcp, comment: "HTTPS" }
-  - { port: "{{ ssh_port }}", proto: tcp, comment: "SSH" }
diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
deleted file mode 100644
index 675372a..0000000
--- a/roles/firewall/tasks/main.yml
+++ /dev/null
@@ -1,32 +0,0 @@
----
-- name: Nainstaluj UFW
-  ansible.builtin.apt:
-    name: ufw
-    state: present
-    update_cache: true
-
-- name: Reset UFW na default
-  community.general.ufw:
-    state: reset
-
-- name: UFW default - deny incoming
-  community.general.ufw:
-    direction: incoming
-    policy: deny
-
-- name: UFW default - allow outgoing
-  community.general.ufw:
-    direction: outgoing
-    policy: allow
-
-- name: Povol porty pres UFW
-  community.general.ufw:
-    rule: allow
-    port: "{{ item.port }}"
-    proto: "{{ item.proto }}"
-    comment: "{{ item.comment }}"
-  loop: "{{ allowed_ports }}"
-
-- name: Aktivuj UFW
-  community.general.ufw:
-    state: enabled