omni-ansible/playbooks/configure-auth.yml

---
- name: Configure local users
  hosts: all:!network
  tags:
    - auth
    - ssh
    - users
  roles:
    - role: sshd
  tasks:
    - import_tasks: tasks/preprocess-local-users.yml

    - name: Create local user accounts
      tags: users_create
      become: true
      block:
        - name: Create groups
          group:
            name: "{{ item }}"
            state: present
          loop: "{{ local_targets + ['omni'] }}"

        - name: Load user passwords
          include_vars:
            file: secrets/passwords.yml

        - name: Create users
          user:
            name: "{{ item.name }}"
            comment: "{{ item.fullname | default('') }}"
            shell: /bin/bash
            groups: "{{ item.targets | intersect(local_targets) + ['omni'] }}"
            system: "{{ item.svc | default(False) }}"
            state: present
            generate_ssh_key: false
            password: "{{ users_secrets[item.name] }}"
          loop: "{{ users_local }}"

    - name: Delete removed user accounts
      become: true
      user:
        name: "{{ item }}"
        state: absent
      loop: "{{ users_local_removed | default([]) | difference(protected_users) }}"

    - name: Grant sudo permissions to admin user accounts
      become: true
      user:
        name: "{{ item.name }}"
        groups: "{{ 'wheel' if ansible_os_family | lower == 'redhat' else 'sudo' }}"
        state: present
      loop: "{{ users_local_admin }}"

    - name: Disable sudo password for ansible
      become: true
      lineinfile:
        create: true
        path: /etc/sudoers.d/30-ansible
        line: "ansible ALL=(ALL) NOPASSWD:ALL"
        mode: 0644

    - name: Disable sudo password for admin users
      become: true
      lineinfile:
        create: true
        path: /etc/sudoers.d/40-admin
        line: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
        mode: 0644
        state: "{{ 'present' if disable_sudo_password | bool == true else 'absent' }}"
      loop: "{{ users_local_admin }}"

    - name: Ensure proper ownership of user home directories
      become: true
      file:
        group: "{{ item.name }}"
        owner: "{{ item.name }}"
        path: /home/{{ item.name }}
        recurse: true
        state: directory
      loop: "{{ users_local }}"