---
  - name: Create admin group
    group: "name={{admingroup}}"

  - name: Add admin group to sudoers
    lineinfile: dest=/etc/sudoers state=present regexp='^%admin ALL\=' line='%admin ALL=(ALL) NOPASSWD:ALL' validate='visudo -cf %s'
    register: admingroupsudoers

  - name: Remove wheel group in sudoers if admin group was added
    lineinfile: dest=/etc/sudoers state=absent regexp="^%wheel" validate='visudo -cf %s'
    when: admingroupsudoers.changed

  - name: Create admin users
    user: "name={{item.name}} uid={{item.uid}} group={{item.groups}} shell={{item.shell}}"
    with_items: adminusers

  - name: Add ssh keys to admin users
    authorized_key: user="{{item.name}}" key="{{item.pubkey}}"
    with_items: adminusers

---
  - name: Create admin group
    group: "name={{admingroup}}"

  - name: Add admin group to sudoers
    lineinfile: dest=/etc/sudoers state=present regexp='^%admin ALL\=' line='%admin ALL=(ALL) NOPASSWD:ALL' validate='visudo -cf %s'
    register: admingroupsudoers

  - name: Remove wheel group in sudoers if admin group was added
    lineinfile: dest=/etc/sudoers state=absent regexp="^%wheel" validate='visudo -cf %s'
    when: admingroupsudoers.changed

  - name: Add or remove admin users
    user: "name={{item.name}} state={{item.state}} uid={{item.uid}} group={{item.groups}} shell={{item.shell}}"
    with_items: adminusers

  - name: Add ssh keys to admin users
    authorized_key: user="{{item.name}}" key="{{item.pubkey}}"
    when: item.state == 'present'
    with_items: adminusers

Remove a user if state=='absent'
Remove a user if state=='absent'

We need a way to remove admin accounts if they leave or change role.
