---
- name: "Install OS-specific packages"
  ansible.builtin.include_tasks: "install-{{ ansible_os_family | lower }}.yml"
  tags: [required_for_boot]

- name: "Set sudo group fact"
  ansible.builtin.set_fact:
    sudo_group: "sudo"
  tags: [required_for_boot]

- name: "Set user groups fact"
  ansible.builtin.set_fact:
    user_groups: "{{ ([username, sudo_group] + user_groups) | unique }}"

- name: "Configure permissions for group: {{ sudo_group }}"
  become: true
  community.general.sudoers:
    name: "enable-sudo-group"
    group: "{{ sudo_group }}"
    commands: "ALL"
    nopassword: false
    sudoers_path: "/etc/sudoers.d"
    state: present
  tags: [required_for_boot]

- name: "Ensure user groups are created"
  become: true
  ansible.builtin.group:
    name: "{{ item }}"
    state: "present"
  with_items: "{{ user_groups }}"
  tags: [required_for_boot]

- name: "Create user: {{ username }}"
  become: true
  ansible.builtin.user:
    name: "{{ username }}"
    append: false
    create_home: true
    generate_ssh_key: false
    groups: "{{  user_groups }}"
    password: "{{ user_password }}"
    state: "present"
    update_password: "on_create"
  register: user
  notify: "Require password change"
  tags: [required_for_boot]

- name: "Create user ssh directory"
  ansible.builtin.file:
    path: "/home/{{ username }}/.ssh/"
    mode: "0700"
    owner: "{{ username }}"
    state: "directory"
  tags: [required_for_boot]

- name: "Add user ssh authorized_keys"
  ansible.builtin.copy:
    dest: "/home/{{ username }}/.ssh/authorized_keys"
    mode: "0600"
    owner: "{{ username }}"
    content: |
      {{ user_public_keys | join('\n') }}
  tags: [required_for_boot]