---
  - name: Create admin group
    group: "name={{admingroup}}"

  - name: Add admin group to sudoers
    lineinfile: dest=/etc/sudoers state=present regexp='^%admin ALL\=' line='%admin ALL=(ALL) NOPASSWD:ALL' validate='visudo -cf %s'
    register: admingroupsudoers

  - name: Remove wheel group in sudoers if admin group was added
    lineinfile: dest=/etc/sudoers state=absent regexp="^%wheel" validate='visudo -cf %s'
    when: admingroupsudoers.changed

  - name: Add or remove admin users
    user: >
      name={{item.name}}
      state={{item.state | default('present')}}
      uid={{item.uid}}
      group={{item.groups}}
      shell={{item.shell | default('/bin/bash')}}
    with_items: adminusers

    # No password. Required for sshd PasswordAuthentication no
  - name: Remove passwords from admins if remove_passwords is true
    user: >
      name={{item.name}}
      password='*'
    with_items: adminusers
    when: adminremove_passwords

  - name: Add ssh keys to admin users
    authorized_key: user="{{item.name}}" key="{{item.pubkey}}"
    when: item.state == 'present' and item.pubkey is defined
    with_items: adminusers

---
  - name: Create admin group
    group: "name={{admingroup}}"

  - name: Create sudoers file for admin group
    copy: dest=/etc/sudoers.d/{{ admingroup }} owner=root group=root mode=0600
          content='%{{ admingroup }} ALL=(ALL) NOPASSWD:ALL'
          validate='visudo -cf %s'

  - name: Ensure /etc/sudoers.d is scanned by sudo
    lineinfile: dest=/etc/sudoers regexp="#includedir\s+/etc/sudoers.d" line="#includedir /etc/sudoers.d"

  - name: Remove wheel group in sudoers if admin group was added
    lineinfile: dest=/etc/sudoers state=absent regexp="^%wheel" validate='visudo -cf %s'

  - name: Add or remove admin users
    user: >
      name={{item.name}}
      state={{item.state | default('present')}}
      uid={{item.uid}}
      group={{item.groups}}
      shell={{item.shell | default('/bin/bash')}}
    with_items: adminusers

    # No password. Required for sshd PasswordAuthentication no
  - name: Remove passwords from admins if remove_passwords is true
    user: >
      name={{item.name}}
      password='*'
    with_items: adminusers
    when: adminremove_passwords

  - name: Add ssh keys to admin users
    authorized_key: user="{{item.name}}" key="{{item.pubkey}}"
    when: item.state == 'present' and item.pubkey is defined
    with_items: adminusers

Use sudoers file instead of lines in /etc/sudoers
Use sudoers file instead of lines in /etc/sudoers

Use a file in /etc/sudoers.d to define sudo rights for admin group.
