feat: prepare-new-server playbook + role struktura

playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo

Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}

Pouziti:
  ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml

roles/common/defaults/main.yml

@@ -0,0 +1,30 @@
+---
+# Společné proměnné pro common roli
+deploy_user: deploy
+deploy_uid: 1000
+deploy_group: docker
+deploy_groups:
+  - docker
+  - sudo
+  - adm
+  - systemd-journal
+
+timezone: Europe/Prague
+
+# Balíky co se instalují vždy
+base_packages:
+  - curl
+  - wget
+  - git
+  - vim
+  - htop
+  - ca-certificates
+  - gnupg
+  - lsb-release
+  - apt-transport-https
+  - bash-completion
+  - software-properties-common
+  - unzip
+  - zip
+  - rsync
+  - net-tools

roles/common/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Upgrade vsech baliku
+  ansible.builtin.apt:
+    upgrade: dist
+    update_cache: true
+    autoremove: true
+
+- name: Instalace zakladnich baliku
+  ansible.builtin.apt:
+    name: "{{ base_packages }}"
+    state: present
+    update_cache: true
+
+- name: Nastav timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+
+- name: Over ze hostname je spravne
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+  when: inventory_hostname is defined