bootstrap.yml

- name: Bootstrap debian minimal for ansible usage.
  hosts: all
  remote_user: root

  pre_tasks:
    - name: Pre-Tasks | Update apt package cache.
      ansible.builtin.apt:
        update_cache: true
      changed_when: false

    - name: Pre-Tasks | Install sudo apt package.
      ansible.builtin.apt:
        name: sudo
        state: present

  tasks:
    - name: Create the ansible user group.
      ansible.builtin.group:
        name: "{{ ansible_system_user }}"
        state: present

    - name: Create the ansible user.
      ansible.builtin.user:
        name: "{{ ansible_system_user }}"
        group: "{{ ansible_system_user }}"
        shell: /bin/bash
        create_home: true
        state: present

    - name: Enable passwordless sudo for the ansible user.
      ansible.builtin.copy:
        dest: "/etc/sudoers.d/{{ ansible_system_user }}"
        content: "{{ ansible_system_user }} ALL=(ALL) NOPASSWD:ALL\n"
        owner: root
        group: root
        mode: "0440"
        validate: "visudo -cf %s"

    - name: Copy public ssh key for the ansible user.
      ansible.posix.authorized_key:
        user: "{{ ansible_system_user }}"
        key: "{{ ansible_pubkey }}"
        state: present

- name: Verify ansible user can access host via SSH.
  hosts: all
  remote_user: "{{ ansible_system_user }}"
  become: true

  tasks:
    - name: Confirm we are not logged in as root.
      ansible.builtin.assert:
        that: ansible_user != 'root'
        fail_msg: "Still running as root - bootstrap failed."
        success_msg: "Running as {{ ansible_user }} with sudo. Bootstrap succeeded."