create-user-playbook.yml

---
# create new user playbook
- name: Create user on a linux server
  hosts: "{{ target_hosts | default('labservers') }}"
  become: true
  strategy: linear
  gather_facts: false
  vars_files:
    - vars/main.yml
    - vars/secrets.yml
  vars:
    - ansible_ssh_pass: "{{ ansible_become_password }}"

  tasks:
    - name: Print out username and password # noqa: run-once[task]
      ansible.builtin.debug:
        msg: "user:{{ user }} password:{{ password }} groups:{{ user_groups }}"
      delegate_to: localhost
      run_once: true

    - name: Reassurance
      ansible.builtin.pause:
        prompt: "Just making sure you have the correct user and password \
        because this is not easy to be undone. Ctrl+C then A to abort"

    - name: Ensure group "misl" exists
      ansible.builtin.group:
        name: misl
        state: present

    - name: Create a login user
      ansible.builtin.user:
        name: "{{ user }}"
        password: "{{ password | password_hash('sha512') }}"
        shell: "/bin/zsh"
        groups: "{{ user_groups }}"
        state: present

    - name: Add public key to authorized_keys
      ansible.posix.authorized_key:
        user: "{{ user }}"
        state: present
        key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
      when: user == _ansbl_username

    - name: Collect only facts returned by facter
      ansible.builtin.setup:
        gather_subset:
          - all

    - name: Include the role_oh_my_zsh
      ansible.builtin.include_role:
        name: role_oh_my_zsh
      vars: # noqa: var-naming[no-role-prefix]
        users:
          - username: "{{ user }}"
            oh_my_zsh:
              theme: ys
              plugins:
                - git
              update_mode: reminder
              write_zshrc: true