---
- name: "Set user groups fact"
  ansible.builtin.set_fact:
    user_groups: "{{ ([username, 'sudo'] + user_groups) | unique }}"

- name: "Ensure user groups are created"
  become: true
  ansible.builtin.group:
    name: "{{ item }}"
    state: "present"
  loop: "{{ user_groups }}"

- name: "Create user: {{ username }}"
  # noqa var-naming[no-role-prefix] username is more understandable than user_name
  become: true
  ansible.builtin.user:
    name: "{{ username }}"
    append: true
    create_home: true
    generate_ssh_key: false
    groups: "{{  user_groups }}"
    password: "{{ user_password }}"
    shell: "/bin/bash"
    state: "present"
    update_password: "on_create"
  register: user
  notify: "Require password change"

- name: "Create user ssh directory"
  ansible.builtin.file:
    path: "/home/{{ username }}/.ssh/"
    mode: "0700"
    owner: "{{ username }}"
    state: "directory"

- name: "Add user ssh authorized_keys"
  ansible.builtin.copy:
    dest: "/home/{{ username }}/.ssh/authorized_keys"
    mode: "0600"
    owner: "{{ username }}"
    content: |
      {{ user_public_keys | join('\n') }}