From 1a02e37ce8959cb5a6b22ec7b33ee8655056ca10 Mon Sep 17 00:00:00 2001
From: Maxim Vershinin <im@vmn.su>
Date: Mon, 6 Jul 2026 15:23:31 +0000
Subject: [PATCH] FIX: default user is ansible now. root is specified manually
 when needed

---
 playbooks/deploy.yaml                                     | 2 +-
 roles/0_basic_postinstall/tasks/harden_ssh.yaml           | 1 +
 roles/0_basic_postinstall/tasks/install_basic_utils.yaml  | 5 +----
 roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml | 6 ++++++
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 16d5029..cb1d8fe 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -1,7 +1,7 @@
 ---
 - name: Basic Proxmox guest deployment
   hosts: all
-  remote_user: root
+  remote_user: ansible
   roles:
     - ../roles/0_basic_postinstall
   vars_files:
diff --git a/roles/0_basic_postinstall/tasks/harden_ssh.yaml b/roles/0_basic_postinstall/tasks/harden_ssh.yaml
index 0938667..c3f58a9 100644
--- a/roles/0_basic_postinstall/tasks/harden_ssh.yaml
+++ b/roles/0_basic_postinstall/tasks/harden_ssh.yaml
@@ -1,6 +1,7 @@
 ---
 
 - name: Configure ssh-server daemon
+  remote_user: root
   copy:
     src: ../files/hardened_sshd.conf
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
diff --git a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml
index 0b4c609..b0c386f 100644
--- a/roles/0_basic_postinstall/tasks/install_basic_utils.yaml
+++ b/roles/0_basic_postinstall/tasks/install_basic_utils.yaml
@@ -14,16 +14,13 @@
       - unattended-upgrades
     update-cache: yes # Run apt update before installation
   become: yes
-  remote_user: ansible
 
 
 # The same commands for Alpine
 - name: Update Alpine packages
   when: (ansible_facts['distribution'] == "Alpine")
   command: /sbin/apk update
-  remote_user: ansible
 
 - name: Install the packages on Alpine
   when: (ansible_facts['distribution'] == "Alpine")
-  command: /sbin/apk add vim ranger zsh rsync git curl kitty
-  remote_user: ansible
\ No newline at end of file
+  command: /sbin/apk add vim ranger zsh rsync git curl kitty
\ No newline at end of file
diff --git a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml b/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml
index b44f405..f89040b 100644
--- a/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml
+++ b/roles/0_basic_postinstall/tasks/prepare_ansible_user.yaml
@@ -1,6 +1,7 @@
 ---
 ## Installing packages
 - name: Install sudo on apt systems
+  remote_user: root
   when: (ansible_facts['distribution'] == "Debian") or 
         (ansible_facts['distribution'] == "Ubuntu")
   apt:
@@ -9,10 +10,12 @@
     update-cache: yes
 
 - name: Update Alpine packages
+  remote_user: root
   when: (ansible_facts['distribution'] == "Alpine")
   command: /sbin/apk update
 
 - name: Install sudo package on Alpine
+  remote_user: root
   when: (ansible_facts['distribution'] == "Alpine")
   command: /sbin/apk add sudo
 
@@ -20,12 +23,14 @@
 ## Creating and setting up the ansible user
 ## First, create sshusers group to grant ssh access
 - name: Ensure group "sshusers" exists
+  remote_user: root
   ansible.builtin.group:
     name: sshusers
     state: present
 
 ## Add the user to sshusers (for ssh access) and sudo (gain root access)
 - name: Create a new user with a password for Ansible
+  remote_user: root
   user: 
     name: ansible
     password: "{{ ansible_user_passwd_hash }}"
@@ -35,6 +40,7 @@
 
 ## Since password authentication in SSH will be disabled, we need to add an authorized key 
 - name: Set authorized key taken from file
+  remote_user: root
   ansible.posix.authorized_key:
     user: ansible
     state: present