From f3678442395babca9482e751fb93827dd6baecfd Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Sat, 21 Feb 2026 01:20:31 +0100
Subject: [PATCH] fix(virtualization): fix cloud-user-data sudo logic to
 respect sudo: false

---
 roles/virtualization/templates/cloud-user-data.yml.j2 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roles/virtualization/templates/cloud-user-data.yml.j2 b/roles/virtualization/templates/cloud-user-data.yml.j2
index cc4aab4..6e63bf4 100644
--- a/roles/virtualization/templates/cloud-user-data.yml.j2
+++ b/roles/virtualization/templates/cloud-user-data.yml.j2
@@ -8,7 +8,9 @@ users:
   - name: "{{ user.name }}"
     primary_group: "{{ user.name }}"
     groups: users
-    sudo: "{{ 'ALL=(ALL) NOPASSWD:ALL' if (user.sudo is defined and user.sudo is sameas true) else user.sudo | default('ALL=(ALL) NOPASSWD:ALL') }}"
+{% if user.sudo | default(false) %}
+    sudo: "{{ 'ALL=(ALL) NOPASSWD:ALL' if user.sudo is sameas true else user.sudo }}"
+{% endif %}
     passwd: "{{ user.password | password_hash('sha512') }}"
     lock_passwd: false
 {% set ssh_keys = user['keys'] | default([]) %}