diff --git a/Makefile b/Makefile
index 87641a9..aa4286a 100644
--- a/Makefile
+++ b/Makefile
@@ -12,6 +12,9 @@ SHELL := /bin/bash
 INVENTORY ?= staging
 VERSION   ?= latest
 
+ANSIBLE_CONFIG := ansible/ansible.cfg
+export ANSIBLE_CONFIG
+
 ANSIBLE := ansible-playbook -i ansible/inventory/$(INVENTORY).yml
 
 # =============================================================================
diff --git a/README.md b/README.md
index 3d5e1dc..8b7a02b 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,56 @@ ansible/
 observability/           # Prometheus rules, Grafana dashboards
 ```
 
+## New server setup
+
+Before running Ansible, prepare the server manually:
+
+1. Generate an SSH key pair (if you don't have one):
+   ```bash
+   ssh-keygen -t ed25519 -C "guitar0-deploy"
+   ```
+
+2. Add your public key to the server via the hosting control panel, or copy it as root:
+   ```bash
+   ssh root@<server-ip>
+   mkdir -p /home/deploy/.ssh
+   echo "<your public key>" >> /home/deploy/.ssh/authorized_keys
+   ```
+
+3. Create the `deploy` user with passwordless sudo:
+   ```bash
+   adduser deploy
+   echo "deploy ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/deploy
+   mkdir -p /home/deploy/.ssh
+   cp /root/.ssh/authorized_keys /home/deploy/.ssh/
+   chown -R deploy:deploy /home/deploy/.ssh
+   chmod 700 /home/deploy/.ssh && chmod 600 /home/deploy/.ssh/authorized_keys
+   ```
+
+4. Update `ansible/inventory/production.yml` with the new server IP/hostname.
+
+5. Create the vault password file:
+   ```bash
+   echo "<vault-password>" > ansible/.vault_pass
+   chmod 600 ansible/.vault_pass
+   ```
+
+6. Remove the old host key and trust the new server:
+   ```bash
+   ssh-keygen -R <server-hostname>
+   ssh-keyscan -H <server-hostname> >> ~/.ssh/known_hosts
+   ```
+
+7. Verify connectivity:
+   ```bash
+   make ping INVENTORY=production SSH_PRIVATE_KEY_FILE=~/.ssh/<your-key>
+   ```
+
+8. Run one-time setup:
+   ```bash
+   make setup INVENTORY=production SSH_PRIVATE_KEY_FILE=~/.ssh/<your-key>
+   ```
+
 ## Usage
 
 ```bash
diff --git a/ansible/roles/backend/tasks/deploy.yml b/ansible/roles/backend/tasks/deploy.yml
index f754d07..f327142 100644
--- a/ansible/roles/backend/tasks/deploy.yml
+++ b/ansible/roles/backend/tasks/deploy.yml
@@ -65,7 +65,7 @@
         services:
           - db
         state: present
-        pull: never
+        pull: missing
 
     - name: Run migrations
       ansible.builtin.command:
diff --git a/ansible/roles/backend/tasks/directories.yml b/ansible/roles/backend/tasks/directories.yml
index e30950d..489c7fd 100644
--- a/ansible/roles/backend/tasks/directories.yml
+++ b/ansible/roles/backend/tasks/directories.yml
@@ -13,7 +13,16 @@
   loop:
     - "{{ backend_app_dir }}"
     - "{{ backend_shared_dir }}"
+    - "{{ backend_backup_dir }}"
+
+- name: Create backend directories writable by container appuser (uid=1001)
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "1001"
+    group: "1001"
+    mode: "0755"
+  loop:
     - "{{ backend_shared_dir }}/staticfiles"
     - "{{ backend_shared_dir }}/media"
-    - "{{ backend_backup_dir }}"
     - "{{ backend_log_dir }}"
diff --git a/ansible/roles/common/defaults/main.yml b/ansible/roles/common/defaults/main.yml
index cbf7ca5..a31f0af 100644
--- a/ansible/roles/common/defaults/main.yml
+++ b/ansible/roles/common/defaults/main.yml
@@ -16,3 +16,6 @@ firewall_allowed_ports:
 fail2ban_bantime: 3600
 fail2ban_findtime: 600
 fail2ban_maxretry: 3
+
+# Log directory
+log_dir: /var/log
diff --git a/ansible/roles/common/templates/jail.local.j2 b/ansible/roles/common/templates/jail.local.j2
index e68924a..5796384 100644
--- a/ansible/roles/common/templates/jail.local.j2
+++ b/ansible/roles/common/templates/jail.local.j2
@@ -34,3 +34,10 @@ logpath = {{ log_dir }}/nginx/error.log
 maxretry = 10
 findtime = 60
 bantime = 600
+
+[recidive]
+enabled = true
+logpath = /var/log/fail2ban.log
+bantime = 1w
+findtime = 1d
+maxretry = 5