- name: Ensure we have a deploy group with gid 4243
  group:
    name: deploy
    gid: 4243

- name: Ensure we have a deploy user with uid 4243
  user:
    name: deploy
    comment: "Deploy user"
    shell: /bin/bash
    uid: 4243
    group: deploy

- name: download pubkey from GitHub and placed as authorized_keys
  get_url:
    url: "https://github.com/{{ item }}.keys"
    dest: "/tmp/{{ item }}.github_authorized_keys"
  delegate_to: localhost
  become: false
  with_items: "{{ github_users }}"

- name: Create authorized_keys for deploy from the file that just downloaded
  authorized_key:
    user: deploy
    key: "{{ lookup('file', item) }}"
  with_fileglob:
    - /tmp/*.github_authorized_keys

- name: Create authorized_keys for root from the file that just downloaded
  authorized_key:
    user: root
    key: "{{ lookup('file', item) }}"
  with_fileglob:
    - /tmp/*.github_authorized_keys
  register: add_authorized_keys

- name: Only allow ssh access with keys
  lineinfile:
    dest: /etc/ssh/sshd_config
    state: present
    regexp: "^#?PasswordAuthentication"
    line: "PasswordAuthentication no"
  when: add_authorized_keys|success
  notify: sshd restart

- name: Ensure we have a deploy group with gid 4243
  group:
    name: deploy
    gid: 4243

- name: Ensure we have a deploy user with uid 4243
  user:
    name: deploy
    comment: "Deploy user"
    shell: /bin/bash
    uid: 4243
    group: deploy

- name: download pubkey from GitHub and placed as authorized_keys
  get_url:
    url: "https://github.com/{{ item }}.keys"
    dest: "/tmp/{{ item }}.github_authorized_keys"
  delegate_to: localhost
  become: false
  with_items: "{{ github_users }}"

- name: Create authorized_keys for deploy from the file that just downloaded
  authorized_key:
    user: deploy
    key: "{{ lookup('file', '/tmp/{{ item }}.github_authorized_keys') }}"
    comment: "{{ item }}"
  with_items: "{{ github_users }}"

- name: Create authorized_keys for root from the file that just downloaded
  authorized_key:
    user: root
    key: "{{ lookup('file', '/tmp/{{ item }}.github_authorized_keys') }}"
    comment: "{{ item }}"
  with_items: "{{ github_users }}"
  register: add_authorized_keys

- name: Only allow ssh access with keys
  lineinfile:
    dest: /etc/ssh/sshd_config
    state: present
    regexp: "^#?PasswordAuthentication"
    line: "PasswordAuthentication no"
  when: add_authorized_keys|success
  notify: sshd restart

Make sure we're only picking up keys that we actually want and add a comment
Make sure we're only picking up keys that we actually want and add a comment
