fix: odstranit firewall roli + pridat btop, mc, tree do base packages

Firewall (UFW) neni pozadovan:
- smazana cela role roles/firewall/
- odstraneny reference z prepare-new-server.yml
- pridana poznamka v group_vars/all.yml.example
- doporuceni: firewall resit externe (Cloudflare Tunnel, security group)

Base packages - pridany chybejici utility:
+ btop (system monitor - lepsi nez htop)
+ mc  (Midnight Commander - textovy file manager)
+ tree (struktura adresaru v terminalu)
Ponechany: curl, wget, git, vim, htop, ca-certificates, gnupg,
          lsb-release, apt-transport-https, bash-completion,
          software-properties-common, unzip, zip, rsync, net-tools

group_vars/all.yml.example

@@ -51,6 +51,10 @@ services_to_deploy:
 # ============================================
 # NETWORK / FIREWALL
 # ============================================
+# POZNAMKA: firewall (UFW) se nenastavuje automaticky.
+# Pokud chces firewall, nastav ho rucne (Cloudflare Tunnel,
+# security group na VPS, docker-network oddeleni, ...).
+# Tato promenna zustava pro pripadnou budouci konfiguraci.
 ssh_port: 22
 allowed_ports:
   - { port: 22, proto: tcp, comment: "SSH" }

playbooks/prepare-new-server.yml

@@ -8,9 +8,11 @@
 # 4. Adresarova struktura (/home/deploy/docker, ...)
 # 5. Docker Engine + Compose plugin
 # 6. Deploy user v docker group (docker bez sudo)
-# 7. UFW firewall (povoleno SSH, HTTP, HTTPS)
+# 7. fail2ban
-# 8. fail2ban
 #
+# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele
+# neni firewalled nasazen potreba. Pro produkcni nasazeni doporucujeme
+# nastavit firewall externe (Cloudflare Tunnel, security group na VPS, ...).
 # Pouziti:
 #   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
 #   # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
@@ -45,7 +47,7 @@
           - nahraje SSH klice
           - nainstaluje Docker + Compose
           - vytvori adresarovou strukturu
-          - nastavi firewall
+          - nainstaluje fail2ban
 
           SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
           Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
@@ -61,8 +63,6 @@
       tags: [user, deploy]
     - role: ssh-keys
       tags: [ssh, keys]
-    - role: firewall
-      tags: [firewall, ufw]
     - role: docker
       tags: [docker]
     - role: directories

roles/common/defaults/main.yml

@@ -11,11 +11,16 @@ deploy_groups:
 
 timezone: Europe/Prague
 
-# Balíky co se instalují vždy
+# Zakladni baliky co se instaluji vzdy
 base_packages:
   - curl
   - wget
   - git
+  - unzip
+  - rsync
+  - tree
+  - btop
+  - mc
   - vim
   - htop
   - ca-certificates
@@ -24,7 +29,5 @@ base_packages:
   - apt-transport-https
   - bash-completion
   - software-properties-common
-  - unzip
   - zip
-  - rsync
   - net-tools

roles/firewall/defaults/main.yml

@@ -1,8 +0,0 @@
----
-# Proměnné pro firewall roli
-ssh_port: 22
-# Dalsi porty co chces povolit (pro servery)
-allowed_ports:
-  - { port: 80, proto: tcp, comment: "HTTP" }
-  - { port: 443, proto: tcp, comment: "HTTPS" }
-  - { port: "{{ ssh_port }}", proto: tcp, comment: "SSH" }

roles/firewall/tasks/main.yml

@@ -1,32 +0,0 @@
----
-- name: Nainstaluj UFW
-  ansible.builtin.apt:
-    name: ufw
-    state: present
-    update_cache: true
-
-- name: Reset UFW na default
-  community.general.ufw:
-    state: reset
-
-- name: UFW default - deny incoming
-  community.general.ufw:
-    direction: incoming
-    policy: deny
-
-- name: UFW default - allow outgoing
-  community.general.ufw:
-    direction: outgoing
-    policy: allow
-
-- name: Povol porty pres UFW
-  community.general.ufw:
-    rule: allow
-    port: "{{ item.port }}"
-    proto: "{{ item.proto }}"
-    comment: "{{ item.comment }}"
-  loop: "{{ allowed_ports }}"
-
-- name: Aktivuj UFW
-  community.general.ufw:
-    state: enabled