Ansible user Module — Users & Groups

- name: Create deploy user
  ansible.builtin.user:
    name: deploy
    comment: "Deployment User"
    shell: /bin/bash
    create_home: true
    state: present

- name: Create user with password
  ansible.builtin.user:
    name: appuser
    password: "{{ 'mypassword' | password_hash('sha512') }}"
    shell: /bin/bash
  no_log: true

- name: Create user with vault password
  ansible.builtin.user:
    name: appuser
    password: "{{ vault_user_password | password_hash('sha512') }}"
  no_log: true

- name: Add user to sudo group
  ansible.builtin.user:
    name: deploy
    groups: sudo
    append: true  # Important! Without append, removes from other groups

- name: Add user to multiple groups
  ansible.builtin.user:
    name: deploy
    groups:
      - sudo
      - docker
      - www-data
    append: true

- name: Create application group
  ansible.builtin.group:
    name: appgroup
    gid: 1500
    state: present

- name: Add user to the group
  ansible.builtin.user:
    name: deploy
    groups: appgroup
    append: true

- name: Create user with SSH key
  ansible.builtin.user:
    name: deploy
    generate_ssh_key: true
    ssh_key_bits: 4096
    ssh_key_type: ed25519

- name: Add authorized key
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ lookup('file', 'files/deploy_id_ed25519.pub') }}"
    state: present

- name: Create team users
  ansible.builtin.user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
    shell: "{{ item.shell | default('/bin/bash') }}"
    append: true
    state: present
  loop:
    - { name: alice, groups: "sudo,docker" }
    - { name: bob, groups: "docker" }
    - { name: carol, groups: "sudo,docker,www-data" }

- name: Remove user and home directory
  ansible.builtin.user:
    name: olduser
    state: absent
    remove: true  # Removes home directory

- name: Remove user, keep home directory
  ansible.builtin.user:
    name: olduser
    state: absent
    remove: false

- name: Create system service account
  ansible.builtin.user:
    name: myapp
    system: true
    shell: /usr/sbin/nologin
    home: /opt/myapp
    create_home: true

- name: Create user with password policy
  ansible.builtin.user:
    name: contractor
    password: "{{ vault_password | password_hash('sha512') }}"
    password_expire_max: 90    # Must change every 90 days
    password_expire_min: 7     # Can't change within 7 days
  no_log: true

- name: Set account expiration date
  ansible.builtin.user:
    name: contractor
    expires: 1735689600  # Unix timestamp for expiry date

---
- name: Provision team access
  hosts: all
  become: true
  vars:
    team_users:
      - name: alice
        groups: "sudo,docker"
        key: "ssh-ed25519 AAAA... alice@company.com"
      - name: bob
        groups: "docker"
        key: "ssh-ed25519 AAAA... bob@company.com"

  tasks:
    - name: Create groups
      ansible.builtin.group:
        name: "{{ item }}"
        state: present
      loop:
        - docker
        - developers

    - name: Create users
      ansible.builtin.user:
        name: "{{ item.name }}"
        groups: "{{ item.groups }}"
        shell: /bin/bash
        append: true
      loop: "{{ team_users }}"

    - name: Add SSH keys
      ansible.posix.authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.key }}"
      loop: "{{ team_users }}"

    - name: Configure sudoers
      ansible.builtin.copy:
        content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL\n"
        dest: "/etc/sudoers.d/{{ item.name }}"
        mode: '0440'
        validate: visudo -cf %s
      loop: "{{ team_users }}"
      when: "'sudo' in item.groups"