# Creates ansible user with passwordless sudo
# Needs root ssh access
# ensures that login is possible
# disables root user.
- name: >-
    Pre-provision a bare host.
    Adds execution user.
  hosts: all
  vars:
    ansible_user: root
    # Put root password in here temporarily, just don't commit it
    ansible_password: root
    # Root password will be cleared later
  tasks:
    # - name: Print all available facts
    #   ansible.builtin.debug:
    #     var: ansible_facts
    - name: Add sudo group
      ansible.builtin.group:
        name: sudo
        state: present
    - name: Add wheel group
      ansible.builtin.group:
        name: wheel
        state: present
    - name: Add ansible user
      ansible.builtin.user:
        name: nerevar
        append: true
        generate_ssh_key: true
        groups:
          - sudo
          - wheel
    - name: Add local user key
      ansible.posix.authorized_key:
        user: nerevar
        state: present
        key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
    - name: >-
        Allow ansible user to passwordless sudo all commands.
      community.general.sudoers:
        name: nerevar-sudo
        state: present
        user: nerevar
        commands: ALL
    - name: Lock root password
      ansible.builtin.user:
        name: root
        password_lock: true
    - name: Disable root SSH login
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PermitRootLogin"
        line: "PermitRootLogin no"
        validate: "/usr/sbin/sshd -t -f %s"
      notify: Restart sshd
  handlers:
    - name: Restart sshd
      ansible.builtin.service:
        name: ssh
        state: restarted