#################################################
# Prepare the server
#################################################
---
# A freshly provisioned host only has the provider's bootstrap account
# ({{ bootstrap_user }}). That account is used once, to create the real user
# and make it reachable and able to escalate. Everything after this play runs
# as {{ user }} instead.
- name: Bootstrap the new user
  hosts: all
  become: true
  remote_user: "{{ bootstrap_user }}"
  vars:
    ansible_ssh_private_key_file: "{{ bootstrap_key }}"
  vars_files:
    - vars/default.yml

  roles:
    # Creates {{ user }} and installs its authorized_keys, so that the next
    # play can log in as it.
    - user
    # Has to happen in this play too: the next play runs as {{ user }} with
    # become, which needs the NOPASSWD sudoers entry this role writes.
    - wheel

- name: Configure the server as the new user
  hosts: all
  become: true
  remote_user: "{{ user }}"
  vars:
    ansible_ssh_private_key_file: "{{ user_key }}"
  vars_files:
    - vars/default.yml

  roles:
    - common
    - zsh