From 5ef53ee45f2c75d58e72119976b59fe9ba7f0c77 Mon Sep 17 00:00:00 2001
From: alessandrovitali <mail@alessandrovitali.net>
Date: Mon, 20 Jul 2026 18:33:31 +0200
Subject: [PATCH 1/3] feat: enable sysadmin creation

---
 roles/users/tasks/main.yml | 42 +++++++++++++++++++-------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
index 6628891..65980f9 100644
--- a/roles/users/tasks/main.yml
+++ b/roles/users/tasks/main.yml
@@ -1,27 +1,27 @@
 ---
-# - name: Create primary admin user
-#   ansible.builtin.user:
-#     name: sysadmin
-#     groups: sudo
-#     append: yes
-#     shell: /bin/bash
-#     create_home: yes
-#   become: true
+- name: Create primary sysadmin user
+  ansible.builtin.user:
+    name: "{{ sysadmin_user }}"
+    groups: sudo
+    append: yes
+    shell: /bin/bash
+    create_home: yes
+  become: true
 
-# - name: Add SSH public key for sysadmin
-#   ansible.posix.authorized_key:
-#     user: sysadmin
-#     state: present
-#     key: "{{ sysadmin_public_ssh_key }}"
-#   become: true
+- name: Add SSH public key for sysadmin
+  ansible.posix.authorized_key:
+    user: "{{ sysadmin_user }}"
+    state: present
+    key: "{{ sysadmin_public_ssh_key }}"
+  become: true
 
-# - name: Allow passwordless sudo to sysadmin user
-#   ansible.builtin.copy:
-#     dest: /etc/sudoers.d/sysadmin
-#     content: "sysadmin ALL=(ALL) NOPASSWD: ALL"
-#     mode: "0440"
-#     validate: /usr/sbin/visudo -cf %s
-#   become: true
+- name: Allow passwordless sudo to sysadmin user
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/{{ sysadmin_user }}
+    content: "{{ sysadmin_user }} ALL=(ALL) NOPASSWD: ALL"
+    mode: "0440"
+    validate: /usr/sbin/visudo -cf %s
+  become: true
 
 - name: Create deployment user for CI/CD
   ansible.builtin.user:
-- 
2.54.0


From 0123b208cd0ecba8fbb1aab09965ef2c2bcd2753 Mon Sep 17 00:00:00 2001
From: alessandrovitali <mail@alessandrovitali.net>
Date: Mon, 20 Jul 2026 18:37:57 +0200
Subject: [PATCH 2/3] refactor: configure passwordless sudo on group-level

---
 roles/users/tasks/main.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
index 65980f9..e356963 100644
--- a/roles/users/tasks/main.yml
+++ b/roles/users/tasks/main.yml
@@ -15,10 +15,10 @@
     key: "{{ sysadmin_public_ssh_key }}"
   become: true
 
-- name: Allow passwordless sudo to sysadmin user
+- name: Allow passwordless sudo for the sudo group
   ansible.builtin.copy:
-    dest: /etc/sudoers.d/{{ sysadmin_user }}
-    content: "{{ sysadmin_user }} ALL=(ALL) NOPASSWD: ALL"
+    dest: /etc/sudoers.d/sudo-nopasswd
+    content: "%sudo ALL=(ALL) NOPASSWD: ALL"
     mode: "0440"
     validate: /usr/sbin/visudo -cf %s
   become: true
-- 
2.54.0


From e39a2dcf82ffb8ef9b26796e1971e2d64216bd3d Mon Sep 17 00:00:00 2001
From: alessandrovitali <mail@alessandrovitali.net>
Date: Mon, 20 Jul 2026 18:38:48 +0200
Subject: [PATCH 3/3] style: clean up comment

---
 roles/users/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
index e356963..b5cffaa 100644
--- a/roles/users/tasks/main.yml
+++ b/roles/users/tasks/main.yml
@@ -15,7 +15,7 @@
     key: "{{ sysadmin_public_ssh_key }}"
   become: true
 
-- name: Allow passwordless sudo for the sudo group
+- name: Allow passwordless sudo for sudo group
   ansible.builtin.copy:
     dest: /etc/sudoers.d/sudo-nopasswd
     content: "%sudo ALL=(ALL) NOPASSWD: ALL"
-- 
2.54.0