Refactor: move password policy to its own role

1 files changed, 25 insertions, 0 deletions

diff --git a/roles/password_policy/tasks/main.yml b/roles/password_policy/tasks/main.yml
new file mode 100644
index 00000000..10aa3837
--- /dev/null
+++ b/roles/password_policy/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+
+- name: "Ensure password_policy package is installed"
+  become: true
+  ansible.builtin.package:
+    name: "{{ password_policy_pkg }}"
+    state: "present"
+
+- name: "Configure archlinux password policy"
+  become: true
+  ansible.builtin.template:
+    src: "archlinux-pam-pw.j2"
+    dest: "/etc/pam.d/system-auth"
+    mode: "0644"
+  when: ansible_os_family == "Archlinux"
+
+- name: "Configure debian password policy"
+  become: true
+  ansible.builtin.template:
+    src: "debian-pam-pw.j2"
+    dest: "/etc/pam.d/common-password"
+    mode: "0644"
+  when: ansible_os_family == "Debian"