[root] split root play and deploy root password

group_vars/all/root.yml

+---
+glob_root:
+  passwd_hash: '{{ vault.root_passwd_hash }}'

plays/baie.yml

+#!/usr/bin/env ansible-playbook
+---
+- hosts: baie
+  roles:
+    - baie

plays/root.yml

@@ -20,35 +20,16 @@
         insertafter: '127.0.0.1 localhost'
       when: check_mirror.found == 0
 
-- hosts: baie
-  roles:
-    - baie
-
 - hosts: virtu
   roles:
     - proxmox-apt-sources
 
 - hosts: server
-  vars:
-    # # Will be in /usr/scripts/
-    # crans_scripts_git: "http://gitlab.adm.crans.org/nounous/scripts.git"
-
-    ntp_client: '{{ glob_ntp_client | combine(loc_ntp_client | default({})) }}'
-    # crans_scripts: '{{ glob_crans_scripts | combine(loc_crans_scripts | default({})) }}'
   roles:
     - debian-apt-sources
-    - common-tools
-    - sudo
-    - ntp-client
-    # - crans-scripts
-    - root-config
-    - ssh_known_hosts
-
-- hosts: crans_vm
-  roles:
-    - qemu-guest-agent
-    - serial-tty
 
+- import_playbook: baie.yml
+- import_playbook: utilities.yml
 - import_playbook: slapd.yml
 
 - hosts: server
@@ -61,21 +42,8 @@
   roles:
     - home-nounous
 
-- hosts: server,!virtu
-  roles:
-    - openssh
-
-- hosts: crans_vm
-  tasks:
-    - name: Remove cloud-init
-      apt:
-        name: cloud-init
-        state: absent
-        purge: true
-      register: apt_result
-      retries: 3
-      until: apt_result is succeeded
-
+- import_playbook: scripts.yml
+- import_playbook: vm-setup.yml
 - import_playbook: borgbackup_client.yml
 - import_playbook: monitoring.yml
 - import_playbook: network_interfaces.yml

plays/scripts.yml

+#!/usr/bin/env ansible-playbook
+---
+- hosts: server
+  vars:
+    crans_scripts: '{{ glob_crans_scripts | combine(loc_crans_scripts | default({})) }}'
+  roles:
+    - crans-scripts

plays/utilities.yml

+#!/usr/bin/env ansible-playbook
+---
+- hosts: server
+  vars:
+    root: '{{ glob_root | default({}) | combine(loc_root | default({})) }}'
+    ntp_client: '{{ glob_ntp_client | combine(loc_ntp_client | default({})) }}'
+  roles:
+    - root
+    - common-tools
+    - sudo
+    - ntp-client
+    - root-config
+    - ssh_known_hosts
+
+- hosts: server,!virtu
+  roles:
+    - openssh

plays/vm_setup

+#!/usr/bin/env ansible-playbook
+---
+- hosts: crans_vm
+  roles:
+    - qemu-guest-agent
+    - serial-tty
+
+- hosts: crans_vm
+  tasks:
+    - name: Remove cloud-init
+      apt:
+        name: cloud-init
+        state: absent
+        purge: true
+      register: apt_result
+      retries: 3
+      until: apt_result is succeeded

roles/root/tasks/main.yml

+---
+- name: Deploys root password hash
+  replace:
+    path: /etc/shadow
+    regexp: '^root:[^:]*:'
+    replace: 'root:{{ root.passwd_hash }}:'