---
- name: User | Create the group
  ansible.builtin.group:
    name: "{{ obsidian_headless_group }}"
    system: true
    state: present

# nologin: nobody needs a shell as this user. `sudo -u obsync -H ob ...` runs
# the command directly and does not consult the login shell.
- name: User | Create the user
  ansible.builtin.user:
    name: "{{ obsidian_headless_user }}"
    group: "{{ obsidian_headless_group }}"
    home: "{{ obsidian_headless_home }}"
    shell: /usr/sbin/nologin
    system: true
    create_home: true
    state: present

- name: User | Keep the home private (holds the Obsidian account token)
  ansible.builtin.file:
    path: "{{ obsidian_headless_home }}"
    state: directory
    owner: "{{ obsidian_headless_user }}"
    group: "{{ obsidian_headless_group }}"
    mode: "0700"