2 files changed, 44 insertions, 0 deletions
diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
new file mode 100644
index 0000000..0a0e259
--- /dev/null
+++ b/roles/users/tasks/main.yml
@@ -0,0 +1,38 @@
+
+# users ~~ roles/users/tasks/main.yml
+# Manage default users
+
+---
+
+- name: retrieve available users
+  shell: awk -F ":" '{ if($3 == 0 || $3 > 999 && $3 < 16000) { print $1 }}' /etc/passwd
+  register: valid_users_shell
+
+- name: change shell to zsh for all valid users
+  user: name="{{ item }}" shell="{{ path_zsh }}"
+  loop: "{{ valid_users_shell.stdout_lines }}"
+
+- name: add operator user
+  user:
+    name: "{{ user_op }}"
+    comment: Operator user
+    group: "{{ group_root }}"
+
+- name: remove default users
+  user:
+    name: "{{ item }}"
+    state: absent
+    remove: true
+  loop:
+    - toor
+    - pi
+
+- name: generate doas configuration
+  template:
+    src: doas.conf.j2
+    dest: "{{ path_doasconfig }}"
+    owner: root
+    group: "{{ group_root }}"
+    mode: 0644
+  when: ansible_become_method == "doas"
+
diff --git a/roles/users/templates/doas.conf.j2 b/roles/users/templates/doas.conf.j2
new file mode 100644
index 0000000..51ee4cf
--- /dev/null
+++ b/roles/users/templates/doas.conf.j2
@@ -0,0 +1,6 @@
+
+# doas ~~ /etc/doas.conf
+# managed by Ansible
+
+permit keepenv nopass root
+permit keepenv nopass {{ user_op }} as root