feat: prepare-new-server playbook + role struktura

playbook prepare-new-server.yml:
- update systemu
- deploy user (UID 1000, heslo zamknuto)
- SSH klic pro deploy uzivatele
- adresarova struktura (/home/deploy/{docker,scripts,backups,logs,...})
- Docker Engine + Compose plugin (bez sudo)
- UFW firewall (22, 80, 443)
- fail2ban
- overeni docker bez sudo

Role (kazda v samostatnem adresari):
- common: update, base packages, timezone
- deploy-user: vytvoreni usera UID 1000
- ssh-keys: authorized_keys deployment
- firewall: UFW konfigurace
- docker: Docker Engine + Compose + daemon.json
- directories: /home/deploy/{docker/<sluzba>,backups,scripts,logs}

Pouziti:
  ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml

roles/docker/defaults/main.yml

@@ -0,0 +1,14 @@
+---
+# Proměnné pro docker roli
+deploy_user: deploy
+docker_compose_version: "v2.27.0"
+
+# Docker daemon nastaveni
+docker_daemon_config:
+  log-driver: json-file
+  log-opts:
+    max-size: "10m"
+    max-file: "3"
+  storage-driver: overlay2
+  live-restore: true
+  userland-proxy: false

roles/docker/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart docker
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted

roles/docker/tasks/main.yml

@@ -0,0 +1,89 @@
+---
+- name: Nainstaluj prerekvizity pro Docker
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - curl
+      - gnupg
+    state: present
+    update_cache: true
+
+- name: Vytvor adresar pro Docker GPG klic
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: "0755"
+
+- name: Stahn Docker GPG klic
+  ansible.builtin.get_url:
+    url: https://download.docker.com/linux/ubuntu/gpg
+    dest: /etc/apt/keyrings/docker.asc
+    mode: "0644"
+    force: true
+
+- name: Pridej Docker repo
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [arch={{ ansible_architecture | replace('x86_64', 'amd64') | replace('aarch64', 'arm64') }}
+      signed-by=/etc/apt/keyrings/docker.asc]
+      https://download.docker.com/linux/ubuntu
+      {{ ansible_distribution_release }} stable
+    filename: docker
+    state: present
+    update_cache: true
+
+- name: Nainstaluj Docker Engine a Compose plugin
+  ansible.builtin.apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-buildx-plugin
+      - docker-compose-plugin
+    state: present
+    update_cache: true
+
+- name: Over ze Docker bezi
+  ansible.builtin.systemd:
+    name: docker
+    state: started
+    enabled: true
+
+- name: Nastav docker daemon.json
+  ansible.builtin.copy:
+    content: "{{ docker_daemon_config | to_nice_json }}"
+    dest: /etc/docker/daemon.json
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart docker
+
+- name: Pridej deploy uzivatele do docker group (docker bez sudo)
+  ansible.builtin.user:
+    name: "{{ deploy_user }}"
+    groups: docker
+    append: true
+
+- name: Over docker verze
+  ansible.builtin.command: docker --version
+  register: docker_version_output
+  changed_when: false
+- ansible.builtin.debug:
+    msg: "Docker nainstalovan: {{ docker_version_output.stdout }}"
+
+- name: Over docker compose verze
+  ansible.builtin.command: docker compose version
+  register: docker_compose_output
+  changed_when: false
+- ansible.builtin.debug:
+    msg: "Docker Compose: {{ docker_compose_output.stdout }}"
+
+- name: Test docker bez sudo
+  ansible.builtin.command: docker ps
+  become: true
+  become_user: "{{ deploy_user }}"
+  changed_when: false
+  register: docker_ps_test
+  failed_when: docker_ps_test.rc != 0
+- ansible.builtin.debug:
+    msg: "Docker bez sudo funguje pro {{ deploy_user }}"