---
- name: "Ensure sudo installed"
  become: true
  ansible.builtin.package:
    name:
      - "sudo"
      - "bash"
    state: "present"

- name: "Set sudo group fact"
  ansible.builtin.set_fact:
    # noqa var-naming[no-role-prefix] the sudo group is global and better named this way than user_sudo_group
    sudo_group: "sudo"

- name: "Set user groups fact"
  ansible.builtin.set_fact:
    user_groups: "{{ ([username, sudo_group] + user_groups) | unique }}"

- name: "Configure permissions for group: {{ sudo_group }}"
  become: true
  community.general.sudoers:
    name: "enable-sudo-group"
    group: "{{ sudo_group }}"
    commands: "ALL"
    nopassword: false
    sudoers_path: "/etc/sudoers.d"
    state: present

- name: "Ensure user groups are created"
  become: true
  ansible.builtin.group:
    name: "{{ item }}"
    state: "present"
  with_items: "{{ user_groups }}"

- name: "Create user: {{ username }}"
  # noqa var-naming[no-role-prefix] username is more understandable than user_name
  become: true
  ansible.builtin.user:
    name: "{{ username }}"
    append: false
    create_home: true
    generate_ssh_key: false
    groups: "{{  user_groups }}"
    password: "{{ user_password }}"
    shell: "/bin/bash"
    state: "present"
    update_password: "on_create"
  register: user
  notify: "Require password change"

- name: "Create user ssh directory"
  ansible.builtin.file:
    path: "/home/{{ username }}/.ssh/"
    mode: "0700"
    owner: "{{ username }}"
    state: "directory"

- name: "Add user ssh authorized_keys"
  ansible.builtin.copy:
    dest: "/home/{{ username }}/.ssh/authorized_keys"
    mode: "0600"
    owner: "{{ username }}"
    content: |
      {{ user_public_keys | join('\n') }}