- name: Remove SSH Empty Password from sshd_config

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PermitEmptyPasswords"

        line: "# PermitEmptyPasswords No"

      tags: network,ssh

      register: empty_pass_sshd

    - name: Disable SSH Root Login

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_root_login.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PermitRootLogin no

      tags: network,ssh

      register: root_login

    - name: Remove SSH Root Login from sshd_config

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PermitRootLogin"

        line: "# PermitRootLogin No"

      tags: network,ssh

      register: root_login_sshd

    # Create Freifunk Users

    - name: Create member users

      ansible.builtin.user:

        name: "{{ item.username }}"

        password: "{{ password | password_hash('sha512') }}"

        update_password: "on_create"

        groups:

          - sudo

        append: true

        shell: /bin/bash

        state: present

      loop: "{{ users_member }}"

      tags: users

    - name: Create system users (no password)

      ansible.builtin.user:

        name: "{{ item.username }}"

        groups:

          - sudo

        append: true

        shell: /bin/bash

        state: present

      loop: "{{ users_system }}"

      tags: users

        marker: "# {mark} ANSIBLE MANAGED BLOCK / Enhanced root bashrc"

        block: "{{ lookup('ansible.builtin.file', '{{ server_config_dir }}/bashrc_root_config') }}"

        path: /root/.bashrc

      tags: users

    - name: Add SSH key for users from vars

      ansible.posix.authorized_key:

        user: "{{ item.username }}"

        state: present

        key: "{{ lookup('file', item.key_path) }}"

      tags: users

      loop: "{{ users_member | union(users_system) }}"

    - name: Allow for password-less sudo

      # Not done via community.general.sudoders because it does not support

      # sudo-ing into users without a passsword.

      ansible.builtin.copy:

        dest: /etc/sudoers.d/passwordless-sudo

        content: '%sudo   ALL=(ALL:ALL) NOPASSWD: ALL'

        owner: root

        group: root

        mode: '0440'

      tags: users