auth.yml

# SPDX-FileCopyrightText: 2025 Friedrich von Never <friedrich@fornever.me>
#
# SPDX-License-Identifier: MIT

---
- name: Set up the users and authentication
  hosts: xmpp2
  become: true

  vars_files:
    - secrets.yml
    - vars.yml

  handlers:
    - name: Reload sshd
      ansible.builtin.service:
        name: ssh
        state: reloaded

  tasks:
    - name: Ensure a group exists for those who can connect with SSH
      ansible.builtin.group:
        name: sshuser

    - name: Ensure a user exists and can SSH into the machine
      ansible.builtin.user:
        name: '{{ user.name }}'
        shell: /bin/bash
        groups: ['sudo', 'sshuser']
        append: true
        home: '/home/{{ user.name }}'
        password_lock: false
        password: '{{ user_secrets.password_hash }}'

    - name: Ensure the user can use SSH
      ansible.posix.authorized_key:
        user: '{{ user.name }}'
        key: '{{ user.ssh_public_key }}'

    - name: Ensure only members of sshuser group can connect via SSH
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        line: 'AllowGroups sshuser'
        validate: 'sshd -f %s -t'
      notify: Reload sshd