From 9c2c274d1bf18a73a35649e3a8b64bca874988ab Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Sat, 4 Jan 2020 11:39:24 +0100
Subject: [PATCH] Allow passwordless sudo for ssh login user

---
 initial-setup.yml                   | 11 +++++++++--
 templates/etc/sudoers.d/ssh_user.j2 |  1 +
 2 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 templates/etc/sudoers.d/ssh_user.j2

diff --git a/initial-setup.yml b/initial-setup.yml
index 32edad1..0bb1c31 100644
--- a/initial-setup.yml
+++ b/initial-setup.yml
@@ -26,6 +26,13 @@
         append: yes
         groups:
           - sudo
+    - name: allow passwordless sudo for new user
+      template:
+        src: etc/sudoers.d/ssh_user.j2
+        dest: /etc/sudoers.d/{{ ssh_user }}
+        owner: root
+        group: root
+        mode: 0440
     - name: add authorized key to SSH login user
       authorized_key:
         key: "{{ item }}"
@@ -41,13 +48,13 @@
             path: /etc/ssh/sshd_config
             line: 'PermitRootLogin no'
             state: present
-            insertafter: EOF            
+            insertafter: EOF
         - name: disable password authentication
           lineinfile:
             path: /etc/ssh/sshd_config
             line: 'PasswordAuthentication no'
             state: present
-            insertafter: EOF            
+            insertafter: EOF
         - name: set modern host key
           lineinfile:
             dest: /etc/ssh/sshd_config
diff --git a/templates/etc/sudoers.d/ssh_user.j2 b/templates/etc/sudoers.d/ssh_user.j2
new file mode 100644
index 0000000..bb5f18a
--- /dev/null
+++ b/templates/etc/sudoers.d/ssh_user.j2
@@ -0,0 +1 @@
+{{ ssh_user }} ALL=(ALL) NOPASSWD:ALL