- name: Add sudo group
  ansible.builtin.group:
    name: sudo
    state: present
- name: Add wheel group
  ansible.builtin.group:
    name: wheel
    state: present
- name: Add ansible user
  ansible.builtin.user:
    name: nerevar
    append: true
    generate_ssh_key: true
    shell: /bin/bash
    groups:
      - sudo
      - wheel
- name: Add local user key
  ansible.posix.authorized_key:
    user: nerevar
    state: present
    key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
- name: >-
    Allow ansible user to passwordless sudo all commands.
  community.general.sudoers:
    name: nerevar-sudo
    state: present
    user: nerevar
    commands: ALL
- name: Lock root password
  ansible.builtin.user:
    name: root
    password_lock: true
- name: Disable root SSH login
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^PermitRootLogin"
    line: "PermitRootLogin no"
    validate: "/usr/sbin/sshd -t -f %s"
  notify: restart sshd