setup.yml

- hosts: localhost
  gather_facts: false

  # privilege user read from encrypted file
  vars_files: passwd.yml
  vars: 
    ansible_become: true
    ansible_become_method: sudo
    #should be root
    #ansible_become_user: "{{ root_username }}"
    ansible_become_pass: "{{ root_password }}" # from passwd.yam vault

  tasks:
  - name: Create group
    group:
      name: "{{ user_to_add }}"
      state: present

  - name: Add user
    user:
      name: "{{ user_to_add }}"
      shell: /bin/bash
      group: "{{ user_to_add }}"
      state: present
      comment: User {{ user_to_add }} Created by Jenkins+Ansible
      
  - name: Check file exists.
    stat:
      path: "{{ public_key_filepath }}"
    register: file_details
  
  - name: Add public key to authorized_hosts
    authorized_key:
      user: "{{ user_to_add }}"
      state: present
      key: "{{ lookup('file', '{{ public_key_filepath }}') }}"
    when: file_details.stat.exists

  - name: Delete public key
    file:
      state: absent
      path: "{{ public_key_filepath }}"

  - name: Change permissions for readme file
    file:
      path: readme_bob.txt
      owner: "{{ user_to_add }}"
      group: "{{ user_to_add }}"
      mode: 0440