---
- name: Users | User Management
  user:
    name: "{{ item.key }}"
    state: "{{ item.value.state | default('present') }}"
    password: "{{ item.value.password | default('')}}"
    shell: "{{ item.value.shell | default('/bin/bash') }}"
    update_password: always
  with_dict: "{{ users }}"

# Playbook now uses 'exclusive'
# This will clobber any missing keys on the target host
- name: Users | Public authorized_keys
  authorized_key:
    exclusive: yes
    user: "{{ item.key }}"
    key: "{{ lookup('file', 'files/keys/' + item.key) }}"
  with_dict: "{{ users }}"
  ignore_errors: true
  tags: [ 'keys' ]

- name: Users | Sudoers
  lineinfile:
    dest: /etc/sudoers
    regexp: "^{{ item.key }} ALL="
    line: "{{ item.key }} ALL=(ALL) NOPASSWD:ALL"
    validate: "visudo -cf %s"
  with_dict: "{{ users }}"
  tags: [ 'sudo' ]

- name: Users | PermitRootLogin without-password
  lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: "^\\#?PermitRootLogin"
    line: "PermitRootLogin without-password"
  notify: restart sshd
  tags: [ 'sudo', 'root' ]
