Automate Users, Groups, Vault Passwords and sudo

HR sent `~/ansible/user_list.yml` (developers and managers). Developers get accounts on dev and test, managers on prod, all with passwords kept in an Ansible Vault file. Anika's public key is in `~/ansible/files/anika.pub`. Managers need sudo, and the old `olduser` account must disappear everywhere.

Tasks

  1. Create the vault password file ~/ansible/secret.txt (content webasha, mode 0600) and a vault-encrypted ~/ansible/secret.yml defining devpass: Dev2026! and mgrpass: Mgr2026!.
  2. Write ~/ansible/users.yml: every developer from userlist.yml exists on dev and test with its uid, supplementary group webdev and password devpass (SHA-512); every manager exists on prod with group opsmgr and password mgrpass. Nobody is created on the wrong environment. Run it with --vault-password-file secret.txt.
  3. Write ~/ansible/keys.yml: on dev, authorize files/anika.pub for SSH logins as anika.
  4. Write ~/ansible/sudo.yml: on prod, members of opsmgr may run any command with sudo without a password, via /etc/sudoers.d/opsmgr (mode 0440) validated with visudo -cf %s before it is saved.
  5. Write ~/ansible/olduser.yml: remove user olduser and its home directory from all nodes.