---
- name: Install sudo before creating the admin account
  ansible.builtin.apt:
    name: sudo
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Ensure the sudo group exists
  ansible.builtin.group:
    name: "{{ admin_sudo_group }}"
    state: present

- name: Create the admin account with a password for sudo
  ansible.builtin.user:
    name: "{{ admin_user }}"
    comment: Server administrator
    shell: "{{ admin_user_shell }}"
    groups: "{{ admin_sudo_group }}"
    append: true
    create_home: true
    password: "{{ admin_user_password_hash }}"
    password_lock: false
    update_password: always
    state: present
  no_log: true

- name: Require the admin account to enter its password for sudo
  ansible.builtin.copy:
    dest: "/etc/sudoers.d/90-{{ admin_user }}-password-required"
    owner: root
    group: root
    mode: "0440"
    content: "{{ admin_user }} ALL=(ALL:ALL) PASSWD: ALL\n"
    validate: /usr/sbin/visudo -cf %s

- name: Install the admin account's authorized SSH keys
  ansible.posix.authorized_key:
    user: "{{ admin_user }}"
    key: "{{ item }}"
    state: present
    manage_dir: true
    exclusive: false
  loop: "{{ admin_user_authorized_keys }}"