host-setup.yml

- hosts: all
  user: root
  gather_facts: true

  vars:
    user: neil
    packages:
      - git
      - wget
      - curl
      - htop
      - haveged
  tasks:
    - name: update all RedHat things
      yum: name=* state=latest
      when: ansible_os_family == "RedHat"

    - name: update all Ubuntu things
      apt: name=* state=latest
      when: ansible_os_family == "Debian"

    - name: Make sure we have a 'wheel' group
      group:
        name: wheel
        state: present

    - name: Allow 'wheel' group to have passwordless sudo
      lineinfile:
        dest: /etc/sudoers
        state: present
        regexp: '^%wheel'
        line: '%wheel ALL=(ALL) NOPASSWD: ALL'
        validate: 'visudo -cf %s'

    - name: Add sudoers users to wheel group
      user:
        user="{{ user }}"
        groups=wheel
        append=yes
        state=present
        createhome=yes
        shell=/bin/bash

    - name: Set up authorized keys for the deployer user
      authorized_key: user="{{ user }}" key="{{item}}"
      with_file:
        - /home/{{ user }}/.ssh/id_rsa.pub

    - name: Ensure packages are installed
      apt:
        name: "{{ packages }}"
        state: present
      when: ansible_os_family == "Debian"

- name: Log in as the new user to disable root
  hosts: all
  user: neil
  gather_facts: false
  become: yes

  tasks:
    - name: Disable root login over SSH
      lineinfile:
        dest: /etc/ssh/sshd_config
        regexp: "^PermitRootLogin"
        line: "PermitRootLogin no"
        state: present
      notify:
        - restart sshd

    - name: Disable password login
      lineinfile: dest=/etc/ssh/sshd_config regexp="^PasswordAuthentication" line="PasswordAuthentication no" state=present
      notify:
        - restart sshd

  handlers:
  - name: restart ssh daemon
    service:
      name: ssh
      state: reloaded