---
- name: Bootstrap local ansible user + key + sudo
  hosts: all
  become: true
  tasks:
    - name: Ensure local ansible user exists
      ansible.builtin.user:
        name: ansible
        shell: /bin/bash
        create_home: true

    - name: Install authorized key for local ansible user
      ansible.posix.authorized_key:
        user: ansible
        state: present
        key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_ed25519_ansible.pub') }}"

    - name: Allow passwordless sudo for local ansible
      ansible.builtin.copy:
        dest: /etc/sudoers.d/90-ansible
        content: "ansible ALL=(ALL) NOPASSWD:ALL\n"
        owner: root
        group: root
        mode: "0440"