From ad056c97dc78644e7c0728b5562b7ac832cf1a39 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 13 Aug 2026 07:04:04 +0400
Subject: [PATCH] ssh: add user zerrtika

---
 ansible/playbooks/04-add-user-zerrtika.yaml   | 43 +++++++++++++++++++
 .../roles/ssh_hardening/defaults/main.yaml    |  1 +
 2 files changed, 44 insertions(+)
 create mode 100644 ansible/playbooks/04-add-user-zerrtika.yaml

diff --git a/ansible/playbooks/04-add-user-zerrtika.yaml b/ansible/playbooks/04-add-user-zerrtika.yaml
new file mode 100644
index 0000000..3df339c
--- /dev/null
+++ b/ansible/playbooks/04-add-user-zerrtika.yaml
@@ -0,0 +1,43 @@
+---
+# Add zerrtika user with same rights as asxpi (sudo + docker, key-only)
+# and re-apply ssh_hardening so AllowUsers includes the new user.
+# Cloud-init only creates users at first boot; this covers live servers.
+
+- name: Create zerrtika user
+  hosts: asxpio
+  become: true
+  vars:
+    ansible_host: "{{ wireguard_ip }}"
+
+  tasks:
+    - name: Create user
+      ansible.builtin.user:
+        name: zerrtika
+        groups:
+          - sudo
+          - docker
+        append: true
+        shell: /bin/bash
+        password_lock: true
+
+    - name: Authorize SSH key
+      ansible.posix.authorized_key:
+        user: zerrtika
+        key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
+
+    - name: Grant passwordless sudo
+      ansible.builtin.copy:
+        dest: /etc/sudoers.d/zerrtika
+        content: "zerrtika ALL=(ALL) NOPASSWD:ALL\n"
+        owner: root
+        group: root
+        mode: '0440'
+        validate: visudo -cf %s
+
+- name: Re-apply SSH hardening (AllowUsers)
+  hosts: asxpio
+  become: true
+  vars:
+    ansible_host: "{{ wireguard_ip }}"
+  roles:
+    - ssh_hardening
diff --git a/ansible/roles/ssh_hardening/defaults/main.yaml b/ansible/roles/ssh_hardening/defaults/main.yaml
index 3378144..b3bb26c 100644
--- a/ansible/roles/ssh_hardening/defaults/main.yaml
+++ b/ansible/roles/ssh_hardening/defaults/main.yaml
@@ -14,6 +14,7 @@ ssh_allow_public_git: false
 # Shell users that require network restrictions
 ssh_shell_users:
   - asxpi
+  - zerrtika
   - deploy
   - root