---
- name: add groups
  group:
    state: present
    gid: "{{ item.uid }}"
    name: "{{ item.name }}"
  with_items: "{{ user_users }}"
  when: item.state | default("present") == "present"

- name: add and remove users
  user:
    state: "{{ item.state | default('present') }}"
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    group: "{{ item.name }}"
    groups: "{{ item.groups | default() }}"
    comment: "{{ item.comment }}"
    home: "{{ item.home | default('/home/' + item.name) }}"
    shell: "{{ item.shell | default(user_default_shell) }}"
    login_class: "{{ item.class | default(omit) }}"
    createhome: no
  with_items: "{{ user_users }}"
  notify: create home directories

- name: remove groups
  group:
    state: absent
    name: "{{ item.name }}"
    gid: "{{ item.uid }}"
  with_items: "{{ user_users }}"
  when: item.state | default("present") == "absent"

---
- name: add groups
  group:
    state: present
    gid: "{{ item.uid }}"
    name: "{{ item.name }}"
  with_items: "{{ user_users }}"
  when: item.state | default("present") == "present"

- name: add and remove users
  user:
    state: "{{ item.state | default('present') }}"
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    group: "{{ item.name }}"
    groups: "{{ item.groups | default() }}"
    comment: "{{ item.comment }}"
    home: "{{ item.home | default('/home/' + item.name) }}"
    shell: "{{ item.shell | default(user_default_shell) }}"
    password: "{{ item.password | default('*************') }}"
    login_class: "{{ item.class | default(omit) }}"
    createhome: no
  with_items: "{{ user_users }}"
  notify: create home directories

- name: remove groups
  group:
    state: absent
    name: "{{ item.name }}"
    gid: "{{ item.uid }}"
  with_items: "{{ user_users }}"
  when: item.state | default("present") == "absent"

Set default password hash to 13 asterisks
user: Set default password hash to 13 asterisks

From OpenBSD's passwd(5):

"Similarly, login accounts not allowing password authentication but
allowing other authentication methods, for example public key
authentication, conventionally have 13 asterisks in the password field."
