feat: prepare-new-server playbook + role struktura

playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo

Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}

Pouziti:
  ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml

group_vars/all.yml.example

@@ -2,11 +2,34 @@
 # Spolecne promenne pro vsechny playbooky
 # Zkopiruj na group_vars/all.yml a dopln
 
-# Docker
-docker_user: deploy
-docker_uid: 1000
-docker_gid: 1000
-docker_install_compose_plugin: true
+# ============================================
+# DEPLOY USER (UID 1000)
+# ============================================
+deploy_user: deploy
+deploy_uid: 1000
+deploy_groups:
+  - docker
+  - sudo
+  - adm
+  - systemd-journal
+
+# Verejne SSH klice pro deploy uzivatele
+# Pridej sve klice (verejnou cast z `cat ~/.ssh/id_ed25519.pub`)
+deploy_ssh_public_keys:
+  - "ssh-ed25519 AAAAC3Nz... hermes@mac"   # <-- nahrad svym klicem
+
+# ============================================
+# DOCKER
+# ============================================
+docker_compose_version: "v2.27.0"
+docker_daemon_config:
+  log-driver: json-file
+  log-opts:
+    max-size: "10m"
+    max-file: "3"
+  storage-driver: overlay2
+  live-restore: true
+  userland-proxy: false
 
 # Sluzby k nasazeni (seznam nazvu adresaru v docker-services/)
 services_to_deploy:
@@ -25,11 +48,27 @@ services_to_deploy:
   - speedtest
   - watchtower
 
-# NPM admin (po prvnim loginu zmenit)
+# ============================================
+# NETWORK / FIREWALL
+# ============================================
+ssh_port: 22
+allowed_ports:
+  - { port: 22, proto: tcp, comment: "SSH" }
+  - { port: 80, proto: tcp, comment: "HTTP" }
+  - { port: 443, proto: tcp, comment: "HTTPS" }
+
+# ============================================
+# SECURITY (fail2ban)
+# ============================================
+fail2ban_maxretry: 5
+fail2ban_bantime: 3600
+
+# ============================================
+# SLUZBY (credentials po prvnim spusteni)
+# ============================================
 npm_default_email: admin@example.com
 npm_default_password: changeme
 
-# Gitea admin (po instalaci)
 gitea_admin_user: admin
 gitea_admin_password: changeme
 gitea_admin_email: admin@example.com