ansible/roles/sudoers/tasks/main.yml

# code: language=ansible

- name: Ensure sudo is installed
  community.general.pacman:
    name:
      - sudo
    state: present
    update_cache: true

- name: Create the sudo group
  ansible.builtin.group:
    local: false
    name: sudo
    state: present
    system: true

- name: Get target users current groups
  ansible.builtin.getent:
    database: group
    split: ':'
  register: sudoers_user_groups_result

- name: Set empty sudoers_user_target_groups
  ansible.builtin.set_fact:
    sudoers_user_target_groups: []

- name: Loop group list and select groups containing sudoer user
  when:
    - sudoers_user in sudoers_user_groups_result.ansible_facts.getent_group[item]
  ansible.builtin.set_fact:
    sudoers_user_target_groups: "{{ sudoers_user_target_groups + [item] }}"
  loop: "{{ sudoers_user_groups_result.ansible_facts.getent_group.keys() | list }}"
  loop_control:
    label: "{{ item }}"

- name: Filter sudoers_user_target_groups for wheel and users groups, and ensure it contains sudo group
  ansible.builtin.set_fact:
    sudoers_user_target_groups: "{{ ((sudoers_user_target_groups | difference(['wheel', 'users'])) + ['sudo']) | unique }}"

- name: Add user to sudo group and remove from wheel/users
  ansible.builtin.user:
    append: false
    comment: "{{ sudoers_user_comment }}"
    groups: "{{ sudoers_user_target_groups }}"
    local: false
    name: "{{ sudoers_user }}"
    state: present

- name: Add main root sudoers entry
  community.general.sudoers:
    commands:
      - ALL
    defaults:
      - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
    group: sudo
    host: "{{ inventory_hostname_short }}"
    name: sudo_root
    nopassword: false
    runas: root
    state: present
    sudoers_path: "/etc/sudoers.d"
    validation: required

- name: Add become unpriviligeed users sudoers entries
  community.general.sudoers:
    commands:
      - ALL
    defaults:
      - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
    group: sudo
    host: "{{ inventory_hostname_short }}"
    name: sudo_{{ item }}
    nopassword: true
    runas: "{{ item }}"
    state: present
    sudoers_path: "/etc/sudoers.d"
    validation: required
  loop: "{{ unprivileged_users }}"

- name: Remove default sudoers file
  ansible.builtin.file:
    path: /etc/sudoers.d/90-cloud-init-users
    state: absent

- name: Disable root login
  ansible.builtin.user:
    expires: 0
    name: root
    password: '!'
    password_lock: true
    shell: /usr/bin/nologin
    state: present