Sudoers config and hostname config working

roles/sudoers/tasks/main.yml

@@ -0,0 +1,76 @@
+# code: language=ansible
+
+- name: Ensure sudo is installed
+  community.general.pacman:
+    name:
+      - sudo
+    state: present
+    update_cache: true
+
+- name: Create the sudo group
+  ansible.builtin.group:
+    local: false
+    name: sudo
+    state: present
+    system: true
+
+- name: Get target users current groups
+  ansible.builtin.getent:
+    database: group
+    split: ':'
+  register: sudoers_user_groups_result
+
+- name: Set empty sudoers_user_target_groups
+  ansible.builtin.set_fact:
+    sudoers_user_target_groups: []
+
+- name: Loop group list and select groups containing sudoer user
+  when:
+    - sudoers_user in sudoers_user_groups_result.ansible_facts.getent_group[item]
+  ansible.builtin.set_fact:
+    sudoers_user_target_groups: "{{ sudoers_user_target_groups + [item] }}"
+  loop: "{{ sudoers_user_groups_result.ansible_facts.getent_group.keys() | list }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Filter sudoers_user_target_groups for wheel and users groups, and ensure it contains sudo group
+  ansible.builtin.set_fact:
+    sudoers_user_target_groups: "{{ ((sudoers_user_target_groups | difference(['wheel', 'users'])) + ['sudo']) | unique }}"
+
+- name: Add user to sudo group and remove from wheel/users
+  ansible.builtin.user:
+    append: false
+    comment: "{{ sudoers_user_comment }}"
+    groups: "{{ sudoers_user_target_groups }}"
+    local: false
+    name: "{{ sudoers_user }}"
+    state: present
+
+- name: Add sudoers entry
+  community.general.sudoers:
+    commands:
+      - ALL
+    defaults:
+      - '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
+    group: sudo
+    host: "{{ inventory_hostname_short }}"
+    name: sudo_group
+    nopassword: false
+    runas: root
+    state: present
+    sudoers_path: "/etc/sudoers.d"
+    validation: required
+
+- name: Remove default sudoers file
+  ansible.builtin.file:
+    path: /etc/sudoers.d/90-cloud-init-users
+    state: absent
+
+- name: Disable root login
+  ansible.builtin.user:
+    expires: 0
+    name: root
+    password: '!'
+    password_lock: true
+    shell: /usr/bin/nologin
+    state: present

roles/sudoers/vars/main.yml

@@ -0,0 +1,4 @@
+# code: language=ansible
+
+sudoers_user: ladmin
+sudoers_user_comment: "Local Administrator"