From 39c786305f16d8406c7baa9a081a46b7d5caa2f0 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Sat, 21 Feb 2026 05:14:29 +0100
Subject: [PATCH] fix(configuration): handle boolean sudo values in sudoers
 deployment

---
 roles/configuration/tasks/sudo.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/roles/configuration/tasks/sudo.yml b/roles/configuration/tasks/sudo.yml
index 33f08d6..141d09d 100644
--- a/roles/configuration/tasks/sudo.yml
+++ b/roles/configuration/tasks/sudo.yml
@@ -15,9 +15,12 @@
     validate: /usr/sbin/visudo --check --file=%s
 
 - name: Deploy per-user sudoers rules
-  when: item.sudo is defined and (item.sudo | string | length) > 0
+  when: item.sudo | default(false)
+  vars:
+    configuration_sudoers_rule: >-
+      {{ item.sudo if item.sudo is string else 'ALL=(ALL) NOPASSWD: ALL' }}
   ansible.builtin.copy:
-    content: "{{ item.name }} {{ item.sudo }}\n"
+    content: "{{ item.name }} {{ configuration_sudoers_rule }}\n"
     dest: "/mnt/etc/sudoers.d/{{ item.name }}"
     mode: "0440"
     validate: /usr/sbin/visudo --check --file=%s