---
- name: Create the password-protected sudo admin account
  hosts: debian_servers
  become: true
  gather_facts: true
  serial: 1

  pre_tasks:
    - name: Check that this host is a supported Debian-family system
      ansible.builtin.assert:
        that:
          - ansible_distribution in ["Debian", "Ubuntu"]
          - ansible_service_mgr == "systemd"
          - admin_user != "root"
          - admin_user_password_hash is match('^\\$6\\$')
          - admin_user_authorized_keys is defined
          - admin_user_authorized_keys | length > 0
        fail_msg: >-
          Set an admin username, a SHA-512 crypt password hash in Ansible Vault,
          and at least one authorized public key before bootstrapping.

  roles:
    - role: admin_user