From 1cc253f2da07ca33baf1ba6cac789cdb92923f36 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Fri, 12 Dec 2025 16:23:27 +0100
Subject: Update user role to allow configure a password instead of default

If no user_password is provided, the behavior remains the same, it uses
the default changeme password and requires to be changed for using sudo

If a user_password is provided, this hashed password will be used
instead of the default and doesn't require changing on first usage of
sudo
---
 roles/user/tasks/main.yml | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

(limited to 'roles/user/tasks')

diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml
index 1177b707..bebedfcb 100644
--- a/roles/user/tasks/main.yml
+++ b/roles/user/tasks/main.yml
@@ -10,7 +10,7 @@
     state: "present"
   loop: "{{ user_groups }}"
 
-- name: "Create user: {{ username }}"
+- name: "Create user with user_default_password"
   # noqa var-naming[no-role-prefix] username is more understandable than user_name
   become: true
   ansible.builtin.user:
@@ -19,13 +19,29 @@
     create_home: true
     generate_ssh_key: false
     groups: "{{  user_groups }}"
-    password: "{{ user_password }}"
+    password: "{{ user_default_password }}"
     shell: "/bin/bash"
     state: "present"
     update_password: "on_create"
   register: user
   notify: "Require password change"
+  when: not user_password is defined
+
+- name: "Create user with user_password"
+  # noqa var-naming[no-role-prefix] username is more understandable than user_name
+  become: true
+  ansible.builtin.user:
+    name: "{{ username }}"
+    append: true
+    create_home: true
+    generate_ssh_key: false
+    groups: "{{  user_groups }}"
+    password: "{{ user_password }}"
+    shell: "/bin/bash"
+    state: "present"
+    update_password: "on_create"
   no_log: true
+  when: user_password is defined
 
 - name: "Create user ssh directory"
   ansible.builtin.file:
-- 
cgit v1.2.3