From 815240983f81056c5416597f1e1e7314cf17bdee Mon Sep 17 00:00:00 2001
From: "Dustin C. Hatch" <dustin@hatch.name>
Date: Sat, 16 Oct 2021 15:20:49 -0500
Subject: [PATCH] r/base: Set root password

The *base* role will now set the password for the *root* user, if the
`root_password_hash` variable is defined.  This ensures that there is a
way to log into machines directly, even if other authentication
mechanisms like Active Directory are unavailable.
---
 roles/base/tasks/main.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index 737dd3c..89446ec 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -8,5 +8,16 @@
 
 - name: ensure selinux python bindings are installed
   package:
-    name={{ selinux_python_libs|join(',') }}
-    state=present
+    name: '{{ selinux_python_libs }}'
+    state: present
+  tags:
+  - install
+
+- name: ensure root password is set
+  user:
+    name: root
+    password: '{{ root_password_hash }}'
+  when: root_password_hash is defined
+  tags:
+  - root-user
+  - user