Write a play that changes the root password hash and encrypts the file it is stored in

				
					--- 
- name: Cycle root password and store it using ansible-vault
  hosts: all 
  become: false 
  
  # Generate and store root password in password file (secret.yaml) 
  vars: 
    rootPass: "{{ lookup('password', '{{ passwdDir }}/secret.yaml chars=ascii_letters,digits,punctuation') }}" 
    newPass: "{{ lookup('password', '{{ passwdDir }}/secret1.yaml chars=ascii_letters,digits,punctuation') }}" 
    passwdDir: ~/.secret-yaml-files 
    vaultPass: ~/.vault_key 
    runningfromHost: localhost 
    
  tasks: 
  # Check if password file exists 
  - name: Check if secret.yaml file exists 
    stat: 
      path: "{{ passwdDir }}/secret.yaml" 
    register: stat_secrets
    
  # Encrypt password file 
  - name: Encrypt password file using ansible-vault on {{ runningfromHost }} 
    shell: ansible-vault encrypt {{ passwdDir }}/secret.yaml --vault-password-file {{ vaultPass }} 
    when: 
      - stat_secrets.stat.exists|bool == true 
    run_once: true 
    delegate_to: "{{ runningfromHost }}" 
    
  # View decrypted password file 
  - name: Allow temporary password file decryption for password hashing on {{ runningfromHost }} 
    shell: ansible-vault view {{ passwdDir }}/secret.yaml --vault-password-file {{ vaultPass }} > {{ passwdDir }}/secret1.yaml 
    when: 
      - stat_secrets.stat.exists|bool == true 
    run_once: true 
    delegate_to: "{{ runningfromHost }}" 
  
  # Update root password hash 
  - name: Update root password hash 
    user: 
      name: root 
      #update_password: always 
      password: "{{ newPass | password_hash('sha512') }}"
    become: yes 
    
  - debug: msg: "{{ newPass }}" 
  
  # Get Timestamp from the OS 
  - name: Get timestamp from the system 
    shell: "date +%Y-%m-%d-%H.%M.%S" 
    register: tstamp 
    run_once: true 
    delegate_to: "{{ runningfromHost }}" 
    
  # Backup the password file 
  - name: Save password file to backup using timestamp
    command: mv {{ passwdDir }}/secret.yaml {{ passwdDir }}/secret.yaml-{{ tstamp.stdout }} 
    when: 
      - stat_secrets.stat.exists|bool == true 
    run_once: true 
    delegate_to: "{{ runningfromHost }}" 
    
  # Clean up the password dir contents 
  - name: Clean up the contents of the password file directory 
    file: 
      state: absent 
      path: "{{ passwdDir }}/secret1.yaml" 
    run_once: true 
    delegate_to: "{{ runningfromHost }}"