---
- name: Ensure group "admins" exists
# include_tasks: create_groups.yml
  ansible.builtin.group:
    name: admins
    state: present

- name: Grant sudo without PW to admins group
  ansible.builtin.template:
    src: roles/users/files/sudo_group_admins
    path: /etc/sudoers.d/admins
    owner: root
    group: root
    mode: '0440'

- name: Enable sudoers.d subdir
  lineinfile:
    dest: /etc/sudoers
    state: present
    regexp: '^#includedir /etc/sudoers.d'
    line: 'includedir /etc/sudoers.d'
    validate: 'visudo -cf %s'

- name: Ensure user "rulrich" exists
  ansible.builtin.user:
    name: rulrich
    shell: /bin/bash
    groups: admins
    append: yes
    ssh_public_key: "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEecPevXnWu9Rs7QhDFAdeKl/E6cBPwUno+nEd4qoUAK rulrich@rabbit'\n"