---
# ============================================================================
# Baseline users
# ============================================================================
# Creates each user defined in baseline_users with their primary group,
# SSH key(s), and optional passwordless sudo.
# ============================================================================

- name: Create primary group for baseline users
  ansible.builtin.group:
    name: "{{ item.name }}"
    state: present
  loop: "{{ baseline_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Create baseline users
  ansible.builtin.user:
    name: "{{ item.name }}"
    comment: "{{ item.comment | default('') }}"
    group: "{{ item.name }}"
    groups: "{{ item.groups | default(omit) }}"
    append: true
    shell: "{{ item.shell | default('/bin/bash') }}"
    create_home: true
    state: present
  loop: "{{ baseline_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Deploy SSH authorized keys for baseline users
  ansible.posix.authorized_key:
    user: "{{ item.0.name }}"
    key: "{{ item.1 }}"
    state: present
  loop: "{{ baseline_users | subelements('ssh_authorized_keys', skip_missing=True) }}"
  loop_control:
    label: "{{ item.0.name }}"

- name: Grant passwordless sudo to baseline users
  ansible.builtin.copy:
    dest: "/etc/sudoers.d/{{ item.name }}"
    content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL\n"
    owner: root
    group: root
    mode: "0440"
    validate: "visudo -cf %s"
  loop: "{{ baseline_users }}"
  loop_control:
    label: "{{ item.name }}"
  when: item.sudo_nopasswd | default(false) | bool