refactor: ceske nazvy playbooku a roli bez diakritiky

Playbooky (novy nazev -> co dela):
- priprav-novy-server.yml (kompletni setup noveho serveru)
- nasad-sluzby.yml (nasadi Docker sluzby z docker-services/)
- aktualizuj-sluzby.yml (docker compose pull && up -d)
- zabezpec-server.yml (sysctl, auditd, unattended-upgrades)
- bootstrap-server.yml SMAZAN (duplicitni s priprav-novy-server)

Role (novy nazev -> co dela):
- zaklad (update + base baliky + timezone)
- uzivatel-deploy (vytvori deploy usera UID 1000)
- ssh-klice (authorized_keys deployment)
- docker (Docker Engine + Compose plugin) - ponechan anglicky (IT konvence)
- adresare (/home/deploy/{docker,scripts,backups,logs,...})
- firewall SMAZAN (nepouziva se)

Reference v playbooku aktualizovany na nove nazvy roli.
README.md kompletne prepracovan v cestine pro zacatecniky - vysvetluje
co Ansible je, jak nainstalovat, jak vytvorit inventory, jak spustit
playbook, jak overit ze vse funguje.

playbooks/bootstrap-server.yml

@@ -1,147 +0,0 @@
----
-# Bootstrap noveho Ubuntu serveru
-# - aktualizace systemu
-# - deploy user (UID 1000)
-# - SSH hardening
-# - UFW firewall
-# - fail2ban
-# - Docker
-#
-# Pouziti:
-#   ansible-playbook -i inventory.yml playbooks/bootstrap-server.yml
-#
-- name: Bootstrap home server
-  hosts: homeservers
-  become: true
-  gather_facts: true
-
-  vars:
-    deploy_user: deploy
-    deploy_uid: 1000
-    ssh_port: 22
-    # Verejny klic pro deploy uzivatele (nastav pred spustenim)
-    # deploy_ssh_key: "ssh-ed25519 AAAAC3Nz... hermes@mac"
-
-  tasks:
-    - name: Update apt cache
-      ansible.builtin.apt:
-        update_cache: true
-        cache_valid_time: 3600
-
-    - name: Upgrade vsech baliku
-      ansible.builtin.apt:
-        upgrade: dist
-        update_cache: true
-
-    - name: Instalace zakladnich baliku
-      ansible.builtin.apt:
-        name:
-          - curl
-          - wget
-          - git
-          - vim
-          - htop
-          - ca-certificates
-          - gnupg
-          - ufw
-          - fail2ban
-          - bash-completion
-        state: present
-
-    - name: Nastav timezone
-      community.general.timezone:
-        name: "{{ timezone }}"
-
-    - name: Vytvor deploy uzivatele
-      ansible.builtin.user:
-        name: "{{ deploy_user }}"
-        uid: "{{ deploy_uid }}"
-        shell: /bin/bash
-        create_home: true
-        password: ""
-
-    - name: Nastav SSH klic pro deploy uzivatele
-      ansible.posix.authorized_key:
-        user: "{{ deploy_user }}"
-        state: present
-        key: "{{ deploy_ssh_key }}"
-      when: deploy_ssh_key is defined
-
-    - name: Povol deploy uzivateli sudo bez hesla
-      ansible.builtin.copy:
-        dest: "/etc/sudoers.d/{{ deploy_user }}"
-        content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
-        mode: "0440"
-
-    - name: SSH hardening
-      ansible.builtin.lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: "^#?{{ item.key }}"
-        line: "{{ item.key }} {{ item.value }}"
-        state: present
-      loop:
-        - { key: "Port", value: "{{ ssh_port }}" }
-        - { key: "PermitRootLogin", value: "no" }
-        - { key: "PasswordAuthentication", value: "no" }
-        - { key: "X11Forwarding", value: "no" }
-        - { key: "ClientAliveInterval", value: "300" }
-        - { key: "ClientAliveCountMax", value: "2" }
-      notify: Restart ssh
-
-    - name: UFW vychozi pravidla
-      community.general.ufw:
-        direction: incoming
-        policy: deny
-      notify: Reload ufw
-
-    - name: Povol SSH pres UFW
-      community.general.ufw:
-        rule: allow
-        port: "{{ ssh_port }}"
-        proto: tcp
-
-    - name: Povol HTTP a HTTPS
-      community.general.ufw:
-        rule: allow
-        port: "{{ item }}"
-        proto: tcp
-      loop:
-        - "80"
-        - "443"
-
-    - name: Aktivuj UFW
-      community.general.ufw:
-        state: enabled
-
-    - name: Konfigurace fail2ban
-      ansible.builtin.copy:
-        dest: /etc/fail2ban/jail.local
-        content: |
-          [DEFAULT]
-          bantime  = 1h
-          findtime = 10m
-          maxretry = 5
-
-          [sshd]
-          enabled = true
-          port    = {{ ssh_port }}
-          filter  = sshd
-          logpath = /var/log/auth.log
-          maxretry = 3
-        mode: "0644"
-      notify: Restart fail2ban
-
-  handlers:
-    - name: Restart ssh
-      ansible.builtin.service:
-        name: sshd
-        state: restarted
-
-    - name: Reload ufw
-      community.general.ufw:
-        state: reloaded
-
-    - name: Restart fail2ban
-      ansible.builtin.service:
-        name: fail2ban
-        state: restarted

playbooks/priprav-novy-server.yml

@@ -1,21 +1,23 @@
 ---
-# Playbook: prepare-new-server.yml
+# Playbook: priprav-novy-server.yml
 #
-# Kompletni priprava noveho Ubuntu serveru:
+# Kompletni priprava noveho Ubuntu serveru (od nuly):
 # 1. Update systemu (apt)
-# 2. Deploy user (UID 1000, heslo zamknuto)
-# 3. SSH klice (pro deploy uzivatele)
-# 4. Adresarova struktura (/home/deploy/docker, ...)
+# 2. Zakladni baliky (btop, mc, tree, curl, wget, git, ...)
+# 3. Uzivatel deploy (UID 1000, heslo zamknuto)
+# 4. SSH klice (z keychainu / group_vars)
 # 5. Docker Engine + Compose plugin
-# 6. Deploy user v docker group (docker bez sudo)
-# 7. fail2ban
+# 6. Uzivatel deploy v docker group (docker bez sudo)
+# 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
+# 8. fail2ban (SSH jail)
+#
+# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele.
+# Pro produkcni nasazeni doporucujeme nastavit firewall externe
+# (Cloudflare Tunnel, security group na VPS, docker-network oddeleni, ...).
 #
-# Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele
-# neni firewalled nasazen potreba. Pro produkcni nasazeni doporucujeme
-# nastavit firewall externe (Cloudflare Tunnel, security group na VPS, ...).
 # Pouziti:
 #   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
-#   # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
+#   # 2. ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
 #
 # Co playbook predpoklada:
 # - Server ma Ubuntu 22.04 nebo 24.04 LTS
@@ -57,16 +59,16 @@
       when: confirm_run | default(true) | bool
 
   roles:
-    - role: common
-      tags: [common, base]
-    - role: deploy-user
-      tags: [user, deploy]
-    - role: ssh-keys
-      tags: [ssh, keys]
+    - role: zaklad
+      tags: [zaklad, base]
+    - role: uzivatel-deploy
+      tags: [uzivatel, deploy]
+    - role: ssh-klice
+      tags: [ssh, klice]
     - role: docker
       tags: [docker]
-    - role: directories
-      tags: [directories, docker]
+    - role: adresare
+      tags: [adresare, docker]
 
   post_tasks:
     - name: Nainstaluj fail2ban