diff --git a/README.md b/README.md
index 16638d0..60cc020 100644
--- a/README.md
+++ b/README.md
@@ -39,11 +39,12 @@ a Ansible to udělá **na všech serverech** najednou.
 
 | Role | Co dělá |
 |---|---|
-| `zaklad` | Základ: update systému, base balíky (btop, mc, tree, curl, …), timezone |
+| `zaklad` | Update systému, base balíky (btop, mc, tree, curl, …), timezone |
 | `uzivatel-deploy` | Vytvoří uživatele `deploy` (UID 1000) s uzamknutým heslem |
 | `ssh-klice` | Nasadí SSH klíč pro `deploy` (heslo = klíč, ne heslo) |
 | `docker` | Docker Engine + Compose plugin + nastavení daemon.json |
 | `adresare` | `/home/deploy/{docker,scripts,backups,logs,~/.local/bin}` + 14 složek pro služby |
+| `netbird` | Nainstaluje NetBird (mesh VPN klient) a registruje přes setup key |
 
 ### ⚙️ Konfigurace
 
@@ -132,8 +133,9 @@ ansible-playbook -i inventory.yml playbooks/priprav-novy-server.yml
 6. ✅ Přidá tvůj SSH klíč do `~/.ssh/authorized_keys`
 7. ✅ Nainstaluje Docker Engine + Compose plugin
 8. ✅ Přidá `deploy` do `docker` group (docker **bez sudo**)
-9. ✅ Vytvoří adresářovou strukturu pro 14 Docker služeb
-10. ✅ Nainstaluje fail2ban (ochrana proti brute-force SSH)
+7. ✅ Vytvoří adresářovou strukturu pro 14 Docker služeb
+8. ✅ Nainstaluje NetBird (mesh VPN) a registruje přes setup key
+9. ✅ Nainstaluje fail2ban (ochrana proti brute-force SSH)
 
 **Trvání:** 5-10 minut.
 
@@ -212,7 +214,8 @@ mates-ansible/
     ├── uzivatel-deploy/               # Vytvoření deploy usera
     ├── ssh-klice/                    # Nasazení SSH klíče
     ├── docker/                        # Docker Engine + Compose
-    └── adresare/                      # Adresářová struktura
+    ├── adresare/                      # Adresářová struktura
+    └── netbird/                       # NetBird (mesh VPN)
 ```
 
 ---
diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index 0273d00..feb3feb 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -18,6 +18,16 @@ deploy_groups:
 deploy_ssh_public_keys:
   - "ssh-ed25519 AAAAC3Nz... hermes@mac"   # <-- nahrad svym klicem
 
+# ============================================
+# NETBIRD (mesh VPN - klient)
+# ============================================
+# Setup key z NetBird dashboardu: https://app.netbird.io/ -> Setup Keys
+# Napr: AAAA-BBBB-CCCC-DDDD-EEEE
+# Prazdne = NetBird se nainstaluje ale nezaregistruje (setup rucne)
+netbird_setup_key: ""
+netbird_run_as_system_service: true
+netbird_management_url: "https://api.netbird.io"
+
 # ============================================
 # DOCKER
 # ============================================
diff --git a/playbooks/priprav-novy-server.yml b/playbooks/priprav-novy-server.yml
index 6d9d22f..c56077f 100644
--- a/playbooks/priprav-novy-server.yml
+++ b/playbooks/priprav-novy-server.yml
@@ -9,7 +9,8 @@
 # 5. Docker Engine + Compose plugin
 # 6. Uzivatel deploy v docker group (docker bez sudo)
 # 7. Adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
-# 8. fail2ban (SSH jail)
+# 8. NetBird (mesh VPN - klient + setup key)
+# 9. fail2ban (SSH jail)
 #
 # Poznamka: firewall (UFW) se nenastavuje - podle pozadavku uzivatele.
 # Pro produkcni nasazeni doporucujeme nastavit firewall externe
@@ -69,6 +70,8 @@
       tags: [docker]
     - role: adresare
       tags: [adresare, docker]
+    - role: netbird
+      tags: [netbird, vpn]
 
   post_tasks:
     - name: Nainstaluj fail2ban
@@ -110,6 +113,7 @@
 
           SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
           Docker: docker --version (bez sudo)
+          NetBird: netbird status (mesh VPN)
           Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
 
           Dalsi kroky:
diff --git a/roles/netbird/defaults/main.yml b/roles/netbird/defaults/main.yml
new file mode 100644
index 0000000..0030bca
--- /dev/null
+++ b/roles/netbird/defaults/main.yml
@@ -0,0 +1,15 @@
+---
+# Promenne pro netbird roli
+# NetBird - WireGuard-based mesh VPN (https://netbird.io)
+
+# Setup klice pro NetBird registraci
+# Najdes v NetBird dashboardu: https://app.netbird.io/ -> Setup Keys
+# Napr: AAAA-BBBB-CCCC-DDDD-EEEE
+netbird_setup_key: ""
+
+# NetBird spust jako systemova sluzba (root)
+# Pro user-level: netbird up --setup-key XXX (interaktivni)
+netbird_run_as_system_service: true
+
+# Vychozi Management Server (self-hosted nebo oficialni)
+netbird_management_url: "https://api.netbird.io"
diff --git a/roles/netbird/tasks/main.yml b/roles/netbird/tasks/main.yml
new file mode 100644
index 0000000..c63234d
--- /dev/null
+++ b/roles/netbird/tasks/main.yml
@@ -0,0 +1,46 @@
+---
+- name: Stahnout NetBird GPG klic
+  ansible.builtin.get_url:
+    url: https://pkgs.netbird.io/deb/public.key
+    dest: /etc/apt/keyrings/netbird.asc
+    mode: "0644"
+    force: true
+
+- name: Pridat NetBird repo
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by=/etc/apt/keyrings/netbird.asc] https://pkgs.netbird.io/deb stable main"
+    filename: netbird
+    state: present
+    update_cache: true
+
+- name: Nainstalovat NetBird
+  ansible.builtin.apt:
+    name:
+      - netbird
+    state: present
+    update_cache: true
+
+- name: Over NetBird verzi
+  ansible.builtin.command: netbird version
+  register: netbird_version_output
+  changed_when: false
+- ansible.builtin.debug:
+    msg: "NetBird nainstalovan: {{ netbird_version_output.stdout }}"
+
+- name: Spust NetBird s setup key (system service)
+  ansible.builtin.command: netbird up --setup-key {{ netbird_setup_key }} --management-url {{ netbird_management_url }}
+  when:
+    - netbird_setup_key | length > 0
+    - netbird_run_as_system_service | bool
+  register: netbird_up_result
+  changed_when: netbird_up_result.rc == 0
+  failed_when: false
+
+- name: Over NetBird stav
+  ansible.builtin.command: netbird status
+  register: netbird_status_output
+  changed_when: false
+  failed_when: false
+- ansible.builtin.debug:
+    msg: "NetBird status: {{ netbird_status_output.stdout }}"
+  when: netbird_setup_key | length > 0