omni-ansible/tasks/deploy-ssh-keys.yml

---
- name: Create SSH directory
  become: true
  file:
    path: /home/{{ item.name }}/.ssh
    state: directory
    owner: "{{ item.name }}"
    group: "{{ item.name }}"
    mode: 0755
  loop: "{{ _users_local }}"

- name: Update authorized keys
  become: true
  authorized_key:
    user: "{{ item.name }}"
    key: "{{ item.sshkeys | join('\n') }}"
    state: present
    exclusive: true
  loop: "{{ _users_local }}"

- name: Enforce ownership of authorized keys
  become: true
  file:
    path: /home/{{ item.name }}/.ssh/authorized_keys
    state: touch
    owner: "{{ item.name }}"
    group: "{{ item.name }}"
    mode: 0444
  loop: "{{ _users_local }}"