From a6225807bbac6bb576eb582eddc8725f1ace24e5 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Thu, 22 Jan 2026 21:04:40 +0100
Subject: Configure yay user (aur_builder) with passwordless access

---
 roles/yay/tasks/main.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/roles/yay/tasks/main.yml b/roles/yay/tasks/main.yml
index b9d0ff5f..5759aa6c 100644
--- a/roles/yay/tasks/main.yml
+++ b/roles/yay/tasks/main.yml
@@ -35,3 +35,33 @@
         cmd: "pacman -U --noconfirm /tmp/yay-bin/yay-bin-*.pkg.tar.zst"
       args:
         creates: "/usr/bin/yay"
+
+- name: "Configure yay aur_builder passwordless"
+  # yay builder is the user that is allowed to execute yay wihtout password
+  # to be able to use yay automation or archlinux
+  # Ref: https://github.com/kewlfft/ansible-aur?tab=readme-ov-file#usage
+  block:
+    - name: "Create the 'aur_builder' user"
+      become: true
+      ansible.builtin.user:
+        name: aur_builder
+        create_home: true
+        group: wheel
+
+    - name: "Allow 'username' to become 'aur_builder' user without a password"
+      become: true
+      ansible.builtin.lineinfile:
+        path: "/etc/sudoers.d/10-aur_builder-become"
+        line: "{{ username }} ALL=(aur_builder) NOPASSWD: ALL"
+        create: true
+        mode: "0644"
+        validate: "visudo -cf %s"
+
+    - name: "Allow the 'aur_builder' user to run 'sudo pacman' without a password"
+      become: true
+      ansible.builtin.lineinfile:
+        path: "/etc/sudoers.d/11-aur_builder-pacman"
+        line: "aur_builder ALL=(ALL) NOPASSWD: /usr/bin/pacman"
+        create: true
+        mode: "0644"
+        validate: "visudo -cf %s"
-- 
cgit v1.2.3