feat: prepare-new-server playbook + role struktura

playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo

Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}

Pouziti:
  ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml

playbooks/prepare-new-server.yml

@@ -0,0 +1,124 @@
+---
+# Playbook: prepare-new-server.yml
+#
+# Kompletni priprava noveho Ubuntu serveru:
+# 1. Update systemu (apt)
+# 2. Deploy user (UID 1000, heslo zamknuto)
+# 3. SSH klice (pro deploy uzivatele)
+# 4. Adresarova struktura (/home/deploy/docker, ...)
+# 5. Docker Engine + Compose plugin
+# 6. Deploy user v docker group (docker bez sudo)
+# 7. UFW firewall (povoleno SSH, HTTP, HTTPS)
+# 8. fail2ban
+#
+# Pouziti:
+#   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
+#   # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
+#
+# Co playbook predpoklada:
+# - Server ma Ubuntu 22.04 nebo 24.04 LTS
+# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
+# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
+#
+- name: Priprav novy Ubuntu server
+  hosts: homeservers
+  become: true
+  gather_facts: true
+
+  vars:
+    # Default pro prepare-new-server.yml - lze prepsat v inventory
+    ssh_port: 22
+    fail2ban_maxretry: 5
+    fail2ban_bantime: 3600  # 1 hodina
+
+  pre_tasks:
+    - name: Varovani pred spustenim
+      ansible.builtin.pause:
+        prompt: |
+
+          ============================================
+          PRIPRAVA NOVEHO SERVERU
+
+          Tento playbook:
+          - updatuje system
+          - vytvori deploy usera (UID 1000)
+          - nahraje SSH klice
+          - nainstaluje Docker + Compose
+          - vytvori adresarovou strukturu
+          - nastavi firewall
+
+          SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
+          Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).
+
+          Pokracovat? (Enter = ano, Ctrl+C = prerusit)
+          ============================================
+      when: confirm_run | default(true) | bool
+
+  roles:
+    - role: common
+      tags: [common, base]
+    - role: deploy-user
+      tags: [user, deploy]
+    - role: ssh-keys
+      tags: [ssh, keys]
+    - role: firewall
+      tags: [firewall, ufw]
+    - role: docker
+      tags: [docker]
+    - role: directories
+      tags: [directories, docker]
+
+  post_tasks:
+    - name: Nainstaluj fail2ban
+      ansible.builtin.apt:
+        name:
+          - fail2ban
+        state: present
+        update_cache: true
+
+    - name: Nastav fail2ban jail pro SSH
+      ansible.builtin.copy:
+        dest: /etc/fail2ban/jail.local
+        content: |
+          [DEFAULT]
+          bantime  = {{ fail2ban_bantime }}
+          findtime = 10m
+          maxretry = {{ fail2ban_maxretry }}
+
+          [sshd]
+          enabled = true
+          port    = {{ ssh_port }}
+          filter  = sshd
+          logpath = /var/log/auth.log
+          maxretry = {{ fail2ban_maxretry }}
+        mode: "0644"
+      notify: Restart fail2ban
+
+    - name: Aktivuj fail2ban
+      ansible.builtin.systemd:
+        name: fail2ban
+        state: started
+        enabled: true
+
+    - name: Vypis stav serveru
+      ansible.builtin.debug:
+        msg: |
+          ============================================
+          SERVER PRIPRAVEN
+
+          SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
+          Docker: docker --version (bez sudo)
+          Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/
+
+          Dalsi kroky:
+          1. SSH jako deploy: ssh deploy@<server-ip>
+          2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
+          3. Nasaď Portainer: cd docker/portainer && docker compose up -d
+
+          ============================================
+
+  handlers:
+    - name: Restart fail2ban
+      ansible.builtin.systemd:
+        name: fail2ban
+        state: restarted