- name: Create Kolibri automation user
  hosts: all
  become: true
  tasks:
    - name: Ensure Kolibri user exists
      ansible.builtin.user:
        name: kolibri
        comment: Hummingbird
        create_home: true
        groups:
          - sudo
        shell: /bin/bash

    - name: Ensure authorised keys for Kolibri
      ansible.posix.authorized_key:
        user: kolibri
        key: "{{ lookup('proton_pass', vault_name='Home Lab', item_title='Kolibri Automation', field='Public key') }}"

    - name: Allow passwordless sudo for Kolibri
      ansible.builtin.copy:
        content: "kolibri ALL=(ALL) NOPASSWD: ALL\n"
        dest: /etc/sudoers.d/kolibri
        mode: "0440"
        validate: visudo -cf %s