---
- name: Ensure the administrative user exists
  ansible.builtin.user:
    name: volker
    shell: /bin/bash
    groups: sudo
    append: yes
  become: yes  # Added this to prevent permission denied errors
  tags: [security, always]

- name: Allow root SSH login
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PermitRootLogin'
    line: 'PermitRootLogin yes'
  become: yes
  notify: Restart SSH
  tags: [security, ssh]

- name: Apply global user security policy
  ansible.builtin.user:
    name: "{{ item.name }}"
    password: "{{ vault_root_password | password_hash('sha512') }}"
    shell: /bin/bash
    groups: "{{ item.groups | default(omit) }}"
  become: yes  # <--- Added this for safety
  loop:
    - { name: 'root' }
    - { name: 'volker', groups: 'sudo' }

#- name: Sync passwords for administrative users
#  ansible.builtin.user:
#    name: "{{ item }}"
#    password: "{{ root_password_hash }}"
#  become: yes
#  loop:
#    - root
#    - volker
#  tags: [security]

- name: Ensure SSH keys are synchronized for both users
  ansible.posix.authorized_key:
    user: "{{ item }}"
    state: present
    key: "{{ lookup('file', 'authorized_keys_volker') }}"
  become: yes
  loop:
    - root
    - volker
  tags: [security, ssh]

- name: Passwordless sudo for volker
  ansible.builtin.copy:
    content: "volker ALL=(ALL) NOPASSWD:ALL"
    dest: /etc/sudoers.d/volker
    owner: root
    group: root
    mode: '0440'
    validate: /usr/sbin/visudo -cf %s
  become: yes