User and Permission Management

- name: Create deploy user for application deployments
  ansible.builtin.user:
    name: deploy
    comment: "Application deploy user"
    shell: /bin/bash
    groups: sudo
    append: true               # add to sudo — do not replace existing groups
    create_home: true
    state: present

- name: Create nginx service account (no shell, no home)
  ansible.builtin.user:
    name: nginx
    system: true               # system account — low UID, not listed in users
    shell: /usr/sbin/nologin   # no interactive login
    create_home: false
    state: present

- name: Remove a decommissioned user and their home directory
  ansible.builtin.user:
    name: oldemployee
    state: absent
    remove: true               # delete home dir and mail spool

# Loop over a list of users to provision multiple accounts
- name: Provision all application team members
  ansible.builtin.user:
    name: "{{ item.name }}"
    shell: "{{ item.shell | default('/bin/bash') }}"
    groups: "{{ item.groups | default('') }}"
    append: true
    state: present
  loop: "{{ app_users }}"      # defined in group_vars

# Create application groups before creating users that belong to them
- name: Create application groups
  ansible.builtin.group:
    name: "{{ item.name }}"
    gid: "{{ item.gid | default(omit) }}"  # omit = let the OS assign a GID
    system: "{{ item.system | default(false) }}"
    state: present
  loop:
    - { name: appusers,  gid: 2000 }
    - { name: deployers, gid: 2001 }
    - { name: monitors,  system: true }   # system group for monitoring agent

- name: Remove a decommissioned group
  ansible.builtin.group:
    name: oldteam
    state: absent

# Add a single key from a string variable
- name: Authorise deploy user SSH key
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ deploy_ssh_public_key }}"   # stored in group_vars or Vault
    state: present

# Add a key from a file on the control node
- name: Authorise ops team SSH key
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ lookup('file', 'files/keys/ops_team.pub') }}"
    state: present

# Provision multiple team members' keys in one task
- name: Authorise all developer SSH keys
  ansible.posix.authorized_key:
    user: "{{ item.username }}"
    key: "{{ item.public_key }}"
    state: present
  loop: "{{ developer_accounts }}"      # list of {username, public_key} dicts

# Remove a key — e.g. when an employee leaves
- name: Revoke access for departed team member
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ departed_employee_public_key }}"
    state: absent                        # removes the key from authorized_keys

# Exclusive mode — replace ALL keys with exactly this set
# Use with extreme caution — removes any key not in the list
- name: Set authorised keys exclusively (replaces all existing)
  ansible.posix.authorized_key:
    user: deploy
    key: "{{ item }}"
    state: present
    exclusive: true
  loop: "{{ authorised_keys }}"

# Recursive permission fix — set all files in a directory tree
- name: Fix permissions on application directory
  ansible.builtin.file:
    path: /var/www/app
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: "0755"
    recurse: true              # apply to all files and subdirectories recursively

# Set ACL to give the web server read access to the app's shared files
- name: Grant www-data read access to shared config via ACL
  ansible.posix.acl:
    path: /var/www/app/shared/config
    entity: www-data
    etype: user
    permissions: rx
    state: present
    recursive: true

# Best practice: deploy a validated drop-in file to /etc/sudoers.d/
# Safer than editing /etc/sudoers directly — one bad file does not break all of sudo
- name: Deploy deploy-user sudoers policy
  ansible.builtin.copy:
    content: |
      # Managed by Ansible — do not edit manually
      # Allows deploy user to restart application services without a password
      deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp, \
                                  /usr/bin/systemctl reload nginx, \
                                  /usr/bin/systemctl status *
    dest: /etc/sudoers.d/deploy
    owner: root
    group: root
    mode: "0440"               # sudoers files must be 0440 — world-unreadable
    validate: "visudo -cf %s"  # validate BEFORE writing — prevents lockout

# Remove a sudoers policy when access is revoked
- name: Remove departed team member sudoers file
  ansible.builtin.file:
    path: /etc/sudoers.d/oldemployee
    state: absent

---
engineering_users:
  - name: alice
    public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJx... alice@laptop"
    groups: sudo            # senior engineer — gets sudo
    state: present

  - name: bob
    public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKq... bob@laptop"
    groups: ""              # junior engineer — no sudo
    state: present

  - name: charlie
    public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn... charlie@laptop"
    groups: ""
    state: absent           # left the company — revoke access

---
- name: Manage engineering user accounts across the fleet
  hosts: all
  become: true

  tasks:
    - name: Create or remove user accounts
      ansible.builtin.user:
        name: "{{ item.name }}"
        shell: /bin/bash
        groups: "{{ item.groups }}"
        append: true
        state: "{{ item.state }}"
        remove: "{{ item.state == 'absent' }}"  # delete home dir when removing
      loop: "{{ engineering_users }}"
      loop_control:
        label: "{{ item.name }} ({{ item.state }})"

    - name: Manage SSH authorised keys
      ansible.posix.authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.public_key }}"
        state: "{{ item.state }}"
      loop: "{{ engineering_users }}"
      loop_control:
        label: "{{ item.name }}"
      # When state=absent, this removes the key from authorized_keys
      # even if the user account still briefly exists during teardown