ansible-role-debian_common/tasks/unpriv-user.yml

---
- name: Ensure that unprivileged user is present
  ansible.builtin.user:
    name: "{{ interactive_user }}"
    shell: /bin/bash
    home: "{{ interactive_home }}"
    password: "{{ interactive_password }}"
    groups: sudo
    create_home: true
    skeleton: /etc/skel
    append: true

# - name: Check the primary key for the unprivileged user
#   ansible.posix.authorized_key:
#     user: "{{ interactive_user }}"
#     key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
#     state: present
#     exclusive: false
#   register: setkey

# - name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
#   when: setkey.changed
#   ansible.posix.authorized_key:
#     user: "{{ interactive_user }}"
#     key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
#     state: present
#     exclusive: true

# - name: Set the secondary key for the unprivileged user
#   ansible.posix.authorized_key:
#     user: "{{ interactive_user }}"
#     key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
#     state: present
#     exclusive: false

- name: Install required package to become unprivileged users
  ansible.builtin.apt:
    name: acl
    state: present