fix(users): accept plaintext or pre-hashed passwords uniformly

roles/configuration/tasks/users.yml

@@ -3,7 +3,8 @@
   when: (system_cfg.root.password | default('') | string | length) > 0
   ansible.builtin.shell: >-
     set -o pipefail &&
-    echo 'root:{{ system_cfg.root.password | password_hash("sha512") }}' | {{ chroot_command }} /usr/sbin/chpasswd -e
+    echo 'root:{{ system_cfg.root.password if (system_cfg.root.password | string)[:1] == "$" else system_cfg.root.password | password_hash("sha512") }}'
+    | {{ chroot_command }} /usr/sbin/chpasswd -e
   args:
     executable: /bin/bash
   register: configuration_root_result
@@ -26,11 +27,15 @@
 - name: Create user accounts
   vars:
     configuration_user_group: "{{ _configuration_platform.user_group }}"
+    # plaintext is hashed; a pre-computed crypt hash ($6$/$y$/...) passes through.
+    configuration_user_pw: >-
+      {{ item.value.password if (item.value.password | string)[:1] == '$'
+         else item.value.password | password_hash('sha512') }}
     configuration_useradd_cmd: >-
       {{ chroot_command }} /usr/sbin/useradd --create-home --user-group
       --uid {{ 1000 + _idx }}
       --groups {{ configuration_user_group }} {{ item.key }}
-      {{ ('--password ' ~ (item.value.password | password_hash('sha512'))) if (item.value.password | default('') | string | length > 0) else '' }}
+      {{ ('--password ' ~ configuration_user_pw) if (item.value.password | default('') | string | length > 0) else '' }}
       --shell {{ item.value.shell | default('/bin/bash') }}
   ansible.builtin.command: "{{ configuration_useradd_cmd }}"
   loop: "{{ system_cfg.users | dict2items }}"

roles/virtualization/templates/cloud-user-data.yml.j2

@@ -8,7 +8,10 @@ users:
   - name: "{{ username }}"
     primary_group: "{{ username }}"
     groups: users
-{% if attrs.sudo | default(false) | bool %}
+{% set _sudo = attrs.sudo | default(false) %}
+{% if _sudo is string %}
+    sudo: "{{ _sudo }}"
+{% elif _sudo | bool %}
     sudo: "ALL=(ALL) NOPASSWD:ALL"
 {% endif %}
 {% if attrs.password | default('') | length > 0 %}