---
# Add zerrtika user with same rights as asxpi (sudo + docker, key-only)
# and re-apply ssh_hardening so AllowUsers includes the new user.
# Cloud-init only creates users at first boot; this covers live servers.

- name: Create zerrtika user
  hosts: asxpio
  become: true
  vars:
    ansible_host: "{{ wireguard_ip }}"

  tasks:
    - name: Create user
      ansible.builtin.user:
        name: zerrtika
        groups:
          - sudo
          - docker
        append: true
        shell: /bin/bash
        password_lock: true

    - name: Authorize SSH key
      ansible.posix.authorized_key:
        user: zerrtika
        key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac

    - name: Grant passwordless sudo
      ansible.builtin.copy:
        dest: /etc/sudoers.d/zerrtika
        content: "zerrtika ALL=(ALL) NOPASSWD:ALL\n"
        owner: root
        group: root
        mode: '0440'
        validate: visudo -cf %s

- name: Re-apply SSH hardening (AllowUsers)
  hosts: asxpio
  become: true
  vars:
    ansible_host: "{{ wireguard_ip }}"
  roles:
    - ssh_hardening