create separate role for setting up unix users

plays/base_server_setup.yml

@@ -5,5 +5,6 @@
     - role: roles/base-packages         # - Basic server setup and configuration
     - role: roles/fail2ban              # - SSH Brute force protection
     - role: roles/firewall              # - Firewall, if firewall_enable is true
+    - role: roles/users
     - role: roles/oh-my-zsh
     - role: roles/motd

roles/users/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+- name: Ensure required packages for user management are present
+  ansible.builtin.apt:
+    name:
+      - sudo
+      - acl
+    state: present
+    update_cache: true
+  become: true
+
+- name: Create primary group for each user
+  ansible.builtin.group:
+    name: "{{ item.username }}"
+    state: present
+  loop: "{{ users }}"
+  loop_control:
+    label: "{{ item.username }}"
+  become: true
+
+- name: Create user accounts
+  ansible.builtin.user:
+    name: "{{ item.username }}"
+    group: "{{ item.username }}"
+    groups: "{{ item.groups | default([]) }}"
+    append: true
+    shell: "{{ item.shell | default('/bin/bash') }}"
+    create_home: true
+    password: "{{ item.password | default(omit) }}"
+    update_password: on_create
+    state: present
+  loop: "{{ users }}"
+  loop_control:
+    label: "{{ item.username }}"
+  become: true
+
+- name: Ensure .ssh directory exists for each user
+  ansible.builtin.file:
+    path: "/home/{{ item.username }}/.ssh"
+    state: directory
+    owner: "{{ item.username }}"
+    group: "{{ item.username }}"
+    mode: "0700"
+  loop: "{{ users }}"
+  loop_control:
+    label: "{{ item.username }}"
+  become: true
+  when: item.ssh_key is defined