---
- name: Set up primary sysadmin user
  when: sysadmin_public_ssh_key is defined
  become: true
  block:
    - name: Create sysadmin user
      ansible.builtin.user:
        name: "{{ sysadmin_user }}"
        groups: sudo
        append: yes
        shell: /bin/bash
        create_home: yes

    - name: Add SSH public key
      ansible.posix.authorized_key:
        user: "{{ sysadmin_user }}"
        state: present
        key: "{{ sysadmin_public_ssh_key }}"

    - name: Allow passwordless sudo
      ansible.builtin.copy:
        dest: /etc/sudoers.d/sudo-nopasswd
        content: "%sudo ALL=(ALL) NOPASSWD: ALL"
        mode: "0440"
        validate: /usr/sbin/visudo -cf %s


- name: Set up deployment user for CI/CD
  when: deployment_public_ssh_key is defined
  become: true
  block:
    - name: Create deployment user
      ansible.builtin.user:
        name: deployment
        shell: /bin/bash
        create_home: yes

    - name: Add SSH public key
      ansible.posix.authorized_key:
        user: deployment
        state: present
        key: "{{ deployment_public_ssh_key }}"