From 1c00ec9370ccc56a1c7f1d41c43f41b67b354e45 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Tue, 14 Jul 2026 01:48:26 +0200
Subject: [PATCH] fix(configuration): grant the platform sudo group only when
 sudo is set

---
 roles/configuration/tasks/users.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/roles/configuration/tasks/users.yml b/roles/configuration/tasks/users.yml
index 73b2bfb..e66df1a 100644
--- a/roles/configuration/tasks/users.yml
+++ b/roles/configuration/tasks/users.yml
@@ -26,17 +26,22 @@
 
 - name: Create user accounts
   vars:
-    configuration_user_group: "{{ _configuration_platform.user_group }}"
     # plaintext is hashed; a pre-computed crypt hash ($6$/$y$/...) passes through.
     configuration_user_pw: >-
       {{ item.value.password if (item.value.password | string)[:1] == '$'
          else item.value.password | password_hash('sha512') }}
+    configuration_user_groups: >-
+      {{ item.value.groups | default(
+           [_configuration_platform.user_group]
+           if (item.value.sudo | default(false)) not in [false, '', none]
+           else []) }}
     configuration_useradd_cmd: >-
       {{ chroot_command }} /usr/sbin/useradd --create-home --user-group
       --uid {{ 1000 + _idx }}
-      --groups {{ configuration_user_group }} {{ item.key }}
+      {{ ('--groups ' ~ (configuration_user_groups | join(','))) if (configuration_user_groups | length) > 0 else '' }}
       {{ ('--password ' ~ configuration_user_pw) if (item.value.password | default('') | string | length > 0) else '' }}
       --shell {{ item.value.shell | default('/bin/bash') }}
+      {{ item.key }}
   ansible.builtin.command: "{{ configuration_useradd_cmd }}"
   loop: "{{ system_cfg.users | dict2items }}"
   loop_control: