From 1cc253f2da07ca33baf1ba6cac789cdb92923f36 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Fri, 12 Dec 2025 16:23:27 +0100
Subject: Update user role to allow configure a password instead of default

If no user_password is provided, the behavior remains the same, it uses
the default changeme password and requires to be changed for using sudo

If a user_password is provided, this hashed password will be used
instead of the default and doesn't require changing on first usage of
sudo
---
 group_vars/all.yml                 | Bin 4241 -> 4439 bytes
 roles/user/README.md               |   6 ++++--
 roles/user/defaults/main.yml       |   8 ++++++--
 roles/user/meta/argument_specs.yml |   5 +++++
 roles/user/tasks/main.yml          |  20 ++++++++++++++++++--
 5 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/group_vars/all.yml b/group_vars/all.yml
index 1d208bfa..ec7549d1 100644
Binary files a/group_vars/all.yml and b/group_vars/all.yml differ
diff --git a/roles/user/README.md b/roles/user/README.md
index a1c66f12..e3f5360f 100644
--- a/roles/user/README.md
+++ b/roles/user/README.md
@@ -5,7 +5,8 @@ This role creates the user and configures the `sudo` group for the user
 ## Role Variables
 
 - `username` **Required** name of the user to be created.
-- `user_password` created user default password (default: `changeme`).
+- `user_default_password` default password (`changeme`) if used required to be changed on first `sudo` usage.
+- `user_password` if provided, it will be used instead of the default password (and doesn't require change).
 - `user_login_shell` the path to default user login shell (default: `/bin/bash`)
 - `user_public_keys` the list of ssh public keys to be added to user authorized_keys
 - `user_groups` extra groups to be created and user added to them (default: [])
@@ -15,7 +16,8 @@ This role creates the user and configures the `sudo` group for the user
 - ensure `sudo` installed.
 - configure `sudoers` file to grant `%sudo ALL=(ALL:ALL) ALL` for `sudo` group.
 - create user and add to the `username`, `sudo`, extra `user_groups` groups.
-- require user password change on first use of `sudo` command.
+- if `user_password` is provided, it's used as user password otherwise `user_default_password` is used.
+- if `user_default_password` is used, it requires to be changed on first `sudo` usage.
 - configure the user authorized keys to allow public key authentication (if configured).
 
 ### Caveats
diff --git a/roles/user/defaults/main.yml b/roles/user/defaults/main.yml
index 55fa2869..a104d44a 100644
--- a/roles/user/defaults/main.yml
+++ b/roles/user/defaults/main.yml
@@ -1,7 +1,11 @@
 ---
 # Default user password: changeme
-# Password will be required to change after first usage
-user_password:
+# Default Password will be required to change after first usage
+user_default_password:
   '$6$jF4YTa1r2tKMH4b3$9KdWeEXJ0RfaS0EfTE6CPFmJFxPABXa455U0Wc47iGxqvsgchkcuRAha/hus//mG7mxWdfEFkLkCKeBsdyLcX/'
 
+# If provided, the user_password will be used instead of the default password and won't require change on first login
+# user_password:
+#   '$6$jF4YTa1r2tKMH4b3$9KdWeEXJ0RfaS0EfTE6CPFmJFxPABXa455U0Wc47iGxqvsgchkcuRAha/hus//mG7mxWdfEFkLkCKeBsdyLcX/'
+
 user_groups: []
diff --git a/roles/user/meta/argument_specs.yml b/roles/user/meta/argument_specs.yml
index 5d2e4b9b..74bb4b8a 100644
--- a/roles/user/meta/argument_specs.yml
+++ b/roles/user/meta/argument_specs.yml
@@ -8,6 +8,11 @@ argument_specs:
         type: "str"
         required: true
         description: "The username of the created account."
+      user_password:
+        type: "str"
+        required: false
+        description: "If provided, the password will be used for the user account."
+        no_log: true
       user_public_keys:
         type: "list"
         required: true
diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml
index 1177b707..bebedfcb 100644
--- a/roles/user/tasks/main.yml
+++ b/roles/user/tasks/main.yml
@@ -10,7 +10,7 @@
     state: "present"
   loop: "{{ user_groups }}"
 
-- name: "Create user: {{ username }}"
+- name: "Create user with user_default_password"
   # noqa var-naming[no-role-prefix] username is more understandable than user_name
   become: true
   ansible.builtin.user:
@@ -19,13 +19,29 @@
     create_home: true
     generate_ssh_key: false
     groups: "{{  user_groups }}"
-    password: "{{ user_password }}"
+    password: "{{ user_default_password }}"
     shell: "/bin/bash"
     state: "present"
     update_password: "on_create"
   register: user
   notify: "Require password change"
+  when: not user_password is defined
+
+- name: "Create user with user_password"
+  # noqa var-naming[no-role-prefix] username is more understandable than user_name
+  become: true
+  ansible.builtin.user:
+    name: "{{ username }}"
+    append: true
+    create_home: true
+    generate_ssh_key: false
+    groups: "{{  user_groups }}"
+    password: "{{ user_password }}"
+    shell: "/bin/bash"
+    state: "present"
+    update_password: "on_create"
   no_log: true
+  when: user_password is defined
 
 - name: "Create user ssh directory"
   ansible.builtin.file:
-- 
cgit v1.2.3