1 files changed, 64 insertions, 0 deletions
diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml
new file mode 100644
index 00000000..4bc5fe4f
--- /dev/null
+++ b/roles/user/tasks/main.yml
@@ -0,0 +1,64 @@
+---
+- name: "Install OS-specific packages"
+  ansible.builtin.include_tasks: "install-{{ ansible_os_family | lower }}.yml"
+  tags: [required_for_boot]
+
+- name: "Set sudo group fact"
+  ansible.builtin.set_fact:
+    sudo_group: "sudo"
+  tags: [required_for_boot]
+
+- name: "Set user groups fact"
+  ansible.builtin.set_fact:
+    user_groups: "{{ ([username, sudo_group] + user_groups) | unique }}"
+
+- name: "Configure permissions for group: {{ sudo_group }}"
+  become: true
+  community.general.sudoers:
+    name: "enable-sudo-group"
+    group: "{{ sudo_group }}"
+    commands: "ALL"
+    nopassword: false
+    sudoers_path: "/etc/sudoers.d"
+    state: present
+  tags: [required_for_boot]
+
+- name: "Ensure user groups are created"
+  become: true
+  ansible.builtin.group:
+    name: "{{ item }}"
+    state: "present"
+  with_items: "{{ user_groups }}"
+  tags: [required_for_boot]
+
+- name: "Create user: {{ username }}"
+  become: true
+  ansible.builtin.user:
+    name: "{{ username }}"
+    append: false
+    create_home: true
+    generate_ssh_key: false
+    groups: "{{  user_groups }}"
+    password: "{{ user_password }}"
+    state: "present"
+    update_password: "on_create"
+  register: user
+  notify: "Require password change"
+  tags: [required_for_boot]
+
+- name: "Create user ssh directory"
+  ansible.builtin.file:
+    path: "/home/{{ username }}/.ssh/"
+    mode: "0700"
+    owner: "{{ username }}"
+    state: "directory"
+  tags: [required_for_boot]
+
+- name: "Add user ssh authorized_keys"
+  ansible.builtin.copy:
+    dest: "/home/{{ username }}/.ssh/authorized_keys"
+    mode: "0600"
+    owner: "{{ username }}"
+    content: |
+      {{ user_public_keys | join('\n') }}
+  tags: [required_for_boot]