---

- name: Include OS-specific variables
  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
  vars:
    params:
      files:
      - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yml"
      - "{{ ansible_facts['distribution'] }}.yml"
      - "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yml"
      - "{{ ansible_facts['os_family'] }}.yml"
      - main.yml
      paths:
      - vars

- name: Verify variables
  ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
  vars:
    params:
      files:
      - "{{ ansible_facts['distribution'] }}_verify_vars.yml"
      - "{{ ansible_facts['os_family'] }}_verify_vars.yml"
      - verify_vars.yml
      paths:
      - tasks

- name: Install sudo
  ansible.builtin.package:
    name: "{{ item }}"
    state: present
  with_items: "{{ sudo_users_package_names }}"

- name: Enable includedir directive
  ansible.builtin.lineinfile:
    dest: /etc/sudoers
    state: present
    # sudo >= 1.9.1 ships the directive as @includedir, older releases as #includedir
    regexp: "^[#@]+(\\s)*includedir(\\s)*/etc/sudoers\\.d"
    line: "#includedir /etc/sudoers.d"
    validate: 'visudo --check --file %s'
    mode: "0440"
    owner: "root"
    group: "root"

- name: Create drop-in directory of sudoers
  ansible.builtin.file:
    state: directory
    path: "/etc/sudoers.d"
    owner: "root"
    group: "root"
    mode: "0750"

- name: "Create sudoers drop-in file to execute commands for specific unix users"
  community.general.sudoers:
    name: "{{ item.filename | default(item.user, true) }}"
    state: "{{ item.state | default('present') }}"
    user: "{{ item.user }}"
    nopassword: "{{ item.nopassword | default(false) }}"
    commands: "{{ item.commands | default('ALL') }}"
  with_items:
  - "{{ sudo_users_sudoers }}"
  when: item.user | default('') | length > 0 and
        item.group | default('') | length == 0 and
        item.runas | default('') | length == 0

- name: "Create sudoers drop-in file to execute commands for specific unix users as specific unix user"
  community.general.sudoers:
    name: "{{ item.filename | default(item.user, true) }}"
    state: "{{ item.state | default('present') }}"
    user: "{{ item.user }}"
    runas: "{{ item.runas }}"
    nopassword: "{{ item.nopassword | default(false) }}"
    commands: "{{ item.commands | default('ALL') }}"
  with_items:
  - "{{ sudo_users_sudoers }}"
  when: item.user | default('') | length > 0 and
        item.group | default('') | length == 0 and
        item.runas | default('') | length > 0

- name: "Create sudoers drop-in file to execute commands for specific unix groups"
  community.general.sudoers:
    name: "{{ item.filename | default(item.group, true) }}"
    state: "{{ item.state | default('present') }}"
    group: "{{ item.group }}"
    nopassword: "{{ item.nopassword | default(false) }}"
    commands: "{{ item.commands | default('ALL') }}"
  with_items:
  - "{{ sudo_users_sudoers }}"
  when: item.user | default('') | length == 0 and
        item.group | default('') | length > 0 and
        item.runas | default('') | length == 0

- name: "Create sudoers drop-in file to execute commands for specific unix groups as specifix unix user"
  community.general.sudoers:
    name: "{{ item.filename | default(item.group, true) }}"
    state: "{{ item.state | default('present') }}"
    group: "{{ item.group }}"
    runas: "{{ item.runas }}"
    nopassword: "{{ item.nopassword | default(false) }}"
    commands: "{{ item.commands | default('ALL') }}"
  with_items:
  - "{{ sudo_users_sudoers }}"
  when: item.user | default('') | length == 0 and
        item.group | default('') | length > 0 and
        item.runas | default('') | length > 0