nog een update

tasks/preprovision.yml

@@ -0,0 +1,40 @@
+- name: Add sudo group
+  ansible.builtin.group:
+    name: sudo
+    state: present
+- name: Add wheel group
+  ansible.builtin.group:
+    name: wheel
+    state: present
+- name: Add ansible user
+  ansible.builtin.user:
+    name: nerevar
+    append: true
+    generate_ssh_key: true
+    shell: /bin/bash
+    groups:
+      - sudo
+      - wheel
+- name: Add local user key
+  ansible.posix.authorized_key:
+    user: nerevar
+    state: present
+    key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
+- name: >-
+    Allow ansible user to passwordless sudo all commands.
+  community.general.sudoers:
+    name: nerevar-sudo
+    state: present
+    user: nerevar
+    commands: ALL
+- name: Lock root password
+  ansible.builtin.user:
+    name: root
+    password_lock: true
+- name: Disable root SSH login
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^PermitRootLogin"
+    line: "PermitRootLogin no"
+    validate: "/usr/sbin/sshd -t -f %s"
+  notify: restart sshd