- name: Bootstrap Ansible service account
  hosts: shell_hosts
  gather_facts: true
  become: true
  vars:
    ansible_service_user: ansible
    ansible_service_public_key_file: ~/.ssh/id_ed25519_homelab_ansible.pub
    ansible_service_sudoers_file: /etc/sudoers.d/99-ansible-service-user

  tasks:
    - name: Read local Ansible service public key
      ansible.builtin.set_fact:
        ansible_service_public_key: "{{ lookup('file', ansible_service_public_key_file) }}"
      delegate_to: localhost
      become: false

    - name: Ensure Ansible service user exists
      ansible.builtin.user:
        name: "{{ ansible_service_user }}"
        shell: /bin/bash
        create_home: true
        state: present

    - name: Install Ansible service SSH key
      ansible.posix.authorized_key:
        user: "{{ ansible_service_user }}"
        key: "{{ ansible_service_public_key }}"
        state: present
        exclusive: true

    - name: Allow passwordless sudo for Ansible service user
      ansible.builtin.copy:
        dest: "{{ ansible_service_sudoers_file }}"
        owner: root
        group: root
        mode: "0440"
        content: "{{ ansible_service_user }} ALL=(ALL) NOPASSWD: ALL\n"
        validate: /usr/sbin/visudo -cf %s