From c3f714a7c6141e26b2feab9db047cd6edd0acfcb Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Thu, 10 Sep 2026 21:05:00 +0200
Subject: [PATCH] fix(tasks)!: stop flushing /etc/sudoers.d

Recreating /etc/sudoers.d on every run deleted every drop-in file on the host, not only the ones managed by this role.
That removes files shipped by packages or other tooling, such as 90-cloud-init-users on cloud instances, which can lock
out the remaining login paths. The task also reported changed on every run and therefore made check mode and CI runs
useless for detecting real drift.

The directory is now only ensured with its owner, group and permissions. To keep entries removable, each item of
sudo_users_sudoers accepts an optional state, which is passed to community.general.sudoers and defaults to present.

BREAKING CHANGE: Entries dropped from sudo_users_sudoers are no longer deleted implicitly. Set state: absent on the
entry to remove its drop-in file.

Co-authored-by: Copilot <copilot@github.com>
---
 defaults/main.yaml |  1 +
 tasks/main.yaml    | 15 ++++++---------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/defaults/main.yaml b/defaults/main.yaml
index 9751544..6cc89fa 100644
--- a/defaults/main.yaml
+++ b/defaults/main.yaml
@@ -7,4 +7,5 @@ sudo_users_sudoers: []
 #   group: "" # Group or User, not booth!
 #   nopassword: true
 #   runas: "" # Optional
+#   state: present # Optional: present or absent. Default to present
 #   user: "markus": # Group or User, not booth!
diff --git a/tasks/main.yaml b/tasks/main.yaml
index e9b3554..cf55eca 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -41,21 +41,18 @@
     owner: "root"
     group: "root"
 
-- name: Flush drop-in files of sudoers.d
+- name: Create drop-in directory of sudoers
   ansible.builtin.file:
-    state: "{{ item }}"
+    state: directory
     path: "/etc/sudoers.d"
     owner: "root"
     group: "root"
     mode: "0750"
-  with_items:
-  - absent
-  - directory
 
 - name: "Create sudoers drop-in file to execute commands for specific unix users"
   community.general.sudoers:
     name: "{{ item.filename | default(item.user) }}"
-    state: present
+    state: "{{ item.state | default('present') }}"
     user: "{{ item.user }}"
     nopassword: "{{ item.nopassword | default(false) }}"
     commands: "{{ item.commands | default('ALL') }}"
@@ -68,7 +65,7 @@
 - name: "Create sudoers drop-in file to execute commands for specific unix users as specific unix user"
   community.general.sudoers:
     name: "{{ item.filename | default(item.user) }}"
-    state: present
+    state: "{{ item.state | default('present') }}"
     user: "{{ item.user }}"
     runas: "{{ item.runas }}"
     nopassword: "{{ item.nopassword | default(false) }}"
@@ -82,7 +79,7 @@
 - name: "Create sudoers drop-in file to execute commands for specific unix groups"
   community.general.sudoers:
     name: "{{ item.filename | default(item.group) }}"
-    state: present
+    state: "{{ item.state | default('present') }}"
     group: "{{ item.group }}"
     nopassword: "{{ item.nopassword | default(false) }}"
     commands: "{{ item.commands | default('ALL') }}"
@@ -95,7 +92,7 @@
 - name: "Create sudoers drop-in file to execute commands for specific unix groups as specifix unix user"
   community.general.sudoers:
     name: "{{ item.filename | default(item.group) }}"
-    state: present
+    state: "{{ item.state | default('present') }}"
     group: "{{ item.group }}"
     runas: "{{ item.runas }}"
     nopassword: "{{ item.nopassword | default(false) }}"