Add preprocessing tasks and auth playbook

Update secrets submodule

playbooks/configure-auth.yml

@@ -1 +1,80 @@
 ---
+- name: Configure local users
+  hosts: all:!network
+  tags:
+    - auth
+    - ssh
+    - users
+  roles:
+    - role: sshd
+  tasks:
+    - import_tasks: tasks/preprocess-local-users.yml
+
+    - name: Create local user accounts
+      tags: users_create
+      become: true
+      block:
+        - name: Create groups
+          group:
+            name: "{{ item }}"
+            state: present
+          loop: "{{ local_targets + ['omni'] }}"
+
+        - name: Load user passwords
+          include_vars:
+            file: secrets/passwords.yml
+
+        - name: Create users
+          user:
+            name: "{{ item.name }}"
+            comment: "{{ item.fullname | default('') }}"
+            shell: /bin/bash
+            groups: "{{ item.targets | intersect(local_targets) + ['omni'] }}"
+            system: "{{ item.svc | default(False) }}"
+            state: present
+            generate_ssh_key: false
+            password: "{{ users_secrets[item.name] }}"
+          loop: "{{ users_local }}"
+
+    - name: Delete removed user accounts
+      become: true
+      user:
+        name: "{{ item }}"
+        state: absent
+      loop: "{{ users_local_removed | default([]) | difference(protected_users) }}"
+
+    - name: Grant sudo permissions to admin user accounts
+      become: true
+      user:
+        name: "{{ item.name }}"
+        groups: "{{ 'wheel' if ansible_os_family | lower == 'redhat' else 'sudo' }}"
+        state: present
+      loop: "{{ users_local_admin }}"
+
+    - name: Disable sudo password for ansible
+      become: true
+      lineinfile:
+        create: true
+        path: /etc/sudoers.d/30-ansible
+        line: "ansible ALL=(ALL) NOPASSWD:ALL"
+        mode: 0644
+
+    - name: Disable sudo password for admin users
+      become: true
+      lineinfile:
+        create: true
+        path: /etc/sudoers.d/40-admin
+        line: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
+        mode: 0644
+        state: "{{ 'present' if disable_sudo_password | bool == true else 'absent' }}"
+      loop: "{{ users_local_admin }}"
+
+    - name: Ensure proper ownership of user home directories
+      become: true
+      file:
+        group: "{{ item.name }}"
+        owner: "{{ item.name }}"
+        path: /home/{{ item.name }}
+        recurse: true
+        state: directory
+      loop: "{{ users_local }}"