- name: Create cast group
  ansible.builtin.group:
    name: cast
    state: present
    system: true

- name: Create cast user
  ansible.builtin.user:
    name: cast
    group: cast
    shell: /bin/bash
    create_home: true
    state: present

- name: Ensure cast user has passwordless sudo
  ansible.builtin.lineinfile:
    path: /etc/sudoers.d/cast
    line: "cast ALL=(ALL) NOPASSWD:ALL"
    create: yes
    mode: '0440'
    validate: 'visudo -cf %s'