Add reusable Debian and Ubuntu hardening playbooks

roles/admin_user/tasks/main.yml

@@ -0,0 +1,44 @@
+---
+- name: Install sudo before creating the admin account
+  ansible.builtin.apt:
+    name: sudo
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Ensure the sudo group exists
+  ansible.builtin.group:
+    name: "{{ admin_sudo_group }}"
+    state: present
+
+- name: Create the admin account with a password for sudo
+  ansible.builtin.user:
+    name: "{{ admin_user }}"
+    comment: Server administrator
+    shell: "{{ admin_user_shell }}"
+    groups: "{{ admin_sudo_group }}"
+    append: true
+    create_home: true
+    password: "{{ admin_user_password_hash }}"
+    password_lock: false
+    update_password: always
+    state: present
+  no_log: true
+
+- name: Require the admin account to enter its password for sudo
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/90-{{ admin_user }}-password-required"
+    owner: root
+    group: root
+    mode: "0440"
+    content: "{{ admin_user }} ALL=(ALL:ALL) PASSWD: ALL\n"
+    validate: /usr/sbin/visudo -cf %s
+
+- name: Install the admin account's authorized SSH keys
+  ansible.posix.authorized_key:
+    user: "{{ admin_user }}"
+    key: "{{ item }}"
+    state: present
+    manage_dir: true
+    exclusive: false
+  loop: "{{ admin_user_authorized_keys }}"