From 96d2970dc36284945374a5044d5c01d97d929bf8 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Mon, 5 Oct 2026 16:54:28 +0200
Subject: [PATCH] fix(virtualization): pass a pre-hashed user password through
 cloud-init unchanged

---
 roles/virtualization/templates/cloud-user-data.yml.j2 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/roles/virtualization/templates/cloud-user-data.yml.j2 b/roles/virtualization/templates/cloud-user-data.yml.j2
index a736b2c..0031cb1 100644
--- a/roles/virtualization/templates/cloud-user-data.yml.j2
+++ b/roles/virtualization/templates/cloud-user-data.yml.j2
@@ -14,8 +14,9 @@ users:
 {% elif _sudo | bool %}
     sudo: "ALL=(ALL) NOPASSWD:ALL"
 {% endif %}
-{% if attrs.password | default('') | length > 0 %}
-    passwd: "{{ attrs.password | password_hash('sha512') }}"
+{% set _pw = attrs.password | default('') %}
+{% if _pw | length > 0 %}
+    passwd: "{{ _pw if (_pw | string)[:1] == '$' else _pw | password_hash('sha512') }}"
     lock_passwd: false
 {% else %}
     lock_passwd: true