feat(bundle): initial commit

roles/users/tasks/main.yml

@@ -0,0 +1,66 @@
+---
+- name: Validate pubkey configuration
+  ansible.builtin.fail:
+    msg: "Only one of pubkey, pubkey_file, or pubkey_url can be defined"
+  when: >
+    (user_pubkey is defined and (user_pubkey_file is defined or user_pubkey_url is defined)) or
+    (user_pubkey_file is defined and user_pubkey_url is defined)
+
+- name: Validate at least one pubkey source is defined
+  ansible.builtin.fail:
+    msg: "At least one of pubkey, pubkey_file, or pubkey_url must be defined"
+  when:
+    - user_pubkey is not defined
+    - user_pubkey_file is not defined
+    - user_pubkey_url is not defined
+
+- name: Create user account
+  ansible.builtin.user:
+    name: "{{ user_name }}"
+    state: present
+    shell: "{{ user_shell }}"
+    createhome: yes
+    home: "{{ user_home | default('/home/' + user_name) }}"
+    uid: "{{ user_uid | default(omit) }}"
+    groups: "{{ user_groups | default(omit) }}"
+    append: "{{ user_groups_append | default(true) }}"
+    password: "{{ user_password | password_hash('sha512') if user_password is defined else omit }}"
+    update_password: "{{ 'always' if user_password is defined else 'on_create' }}"
+  become: yes
+
+- name: Configure sudoers for user
+  ansible.builtin.lineinfile:
+    dest: /etc/sudoers.d/{{ user_name }}
+    line: "{{ user_name }} ALL=(ALL) {{ 'NOPASSWD: ' if user_sudo_nopasswd else '' }}ALL"
+    create: yes
+    mode: "0440"
+    validate: 'visudo -cf %s'
+  become: yes
+  when: user_sudo_enabled | bool
+
+- name: Add SSH public key (direct)
+  ansible.builtin.authorized_key:
+    user: "{{ user_name }}"
+    key: "{{ user_pubkey }}"
+    state: present
+    exclusive: "{{ user_pubkey_exclusive | bool }}"
+  become: yes
+  when: user_pubkey is defined
+
+- name: Add SSH public key (from file)
+  ansible.builtin.authorized_key:
+    user: "{{ user_name }}"
+    key: "{{ lookup('file', user_pubkey_file) }}"
+    state: present
+    exclusive: "{{ user_pubkey_exclusive | bool }}"
+  become: yes
+  when: user_pubkey_file is defined
+
+- name: Add SSH public key (from URL)
+  ansible.builtin.authorized_key:
+    user: "{{ user_name }}"
+    key: "{{ lookup('url', user_pubkey_url) }}"
+    state: present
+    exclusive: "{{ user_pubkey_exclusive | bool }}"
+  become: yes
+  when: user_pubkey_url is defined