ssh: add user zerrtika

ansible/playbooks/04-add-user-zerrtika.yaml

@@ -0,0 +1,43 @@
+---
+# Add zerrtika user with same rights as asxpi (sudo + docker, key-only)
+# and re-apply ssh_hardening so AllowUsers includes the new user.
+# Cloud-init only creates users at first boot; this covers live servers.
+
+- name: Create zerrtika user
+  hosts: asxpio
+  become: true
+  vars:
+    ansible_host: "{{ wireguard_ip }}"
+
+  tasks:
+    - name: Create user
+      ansible.builtin.user:
+        name: zerrtika
+        groups:
+          - sudo
+          - docker
+        append: true
+        shell: /bin/bash
+        password_lock: true
+
+    - name: Authorize SSH key
+      ansible.posix.authorized_key:
+        user: zerrtika
+        key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
+
+    - name: Grant passwordless sudo
+      ansible.builtin.copy:
+        dest: /etc/sudoers.d/zerrtika
+        content: "zerrtika ALL=(ALL) NOPASSWD:ALL\n"
+        owner: root
+        group: root
+        mode: '0440'
+        validate: visudo -cf %s
+
+- name: Re-apply SSH hardening (AllowUsers)
+  hosts: asxpio
+  become: true
+  vars:
+    ansible_host: "{{ wireguard_ip }}"
+  roles:
+    - ssh_hardening

ansible/roles/ssh_hardening/defaults/main.yaml

@@ -14,6 +14,7 @@ ssh_allow_public_git: false
 # Shell users that require network restrictions
 ssh_shell_users:
   - asxpi
+  - zerrtika
   - deploy
   - root