Change Root Password using Ansible

				
					---
- name: Cycle root password and store it using ansible-vault
  hosts: all
  become: false
 
  # Generate and store root password in password file (secret.yaml)
  vars:
    rootPass: "{{ lookup('password', '{{ passwdDir }}/secret.yaml chars=ascii_letters,digits,punctuation') }}"
    newPass: "{{ lookup('password', '{{ passwdDir }}/secret1.yaml chars=ascii_letters,digits,punctuation') }}"
    passwdDir: ~/.secret-yaml-files
    vaultPass: ~/.vault_key
    runningfromHost: localhost

  tasks:
  # Check if password file exists
  - name: Check if secret.yaml file exists
    stat:
      path: "{{ passwdDir }}/secret.yaml"
    register: stat_secrets
 
  # Encrypt password file
  - name: Encrypt password file using ansible-vault on {{ runningfromHost }}    
    shell: ansible-vault encrypt {{ passwdDir }}/secret.yaml --vault-password-file {{ vaultPass }}
    when:
      - stat_secrets.stat.exists|bool == true
    run_once: true
    delegate_to: "{{ runningfromHost }}"

  # View decrypted password file
  - name: Allow temporary password file decryption for password hashing on {{ runningfromHost }}
    shell: ansible-vault view {{ passwdDir }}/secret.yaml --vault-password-file {{ vaultPass }} > {{ passwdDir }}/secret1.yaml
    when:
      - stat_secrets.stat.exists|bool == true
    run_once: true
    delegate_to: "{{ runningfromHost }}"

  # Update root password hash
  - name: Update root password hash
    user:
      name: root
      #update_password: always
      password: "{{ newPass | password_hash('sha512') }}"
    become: yes
 
  - debug:
      msg: "{{ newPass }}"
           
  # Get Timestamp from the OS
  - name: Get timestamp from the system
    shell: "date +%Y-%m-%d-%H.%M.%S"
    register: tstamp
    run_once: true
    delegate_to: "{{ runningfromHost }}"

  # Backup the password file
  - name: Save password file to backup using timestamp
    command: mv {{ passwdDir }}/secret.yaml {{ passwdDir }}/secret.yaml-{{ tstamp.stdout }}      
    when:
      - stat_secrets.stat.exists|bool == true
    run_once: true
    delegate_to: "{{ runningfromHost }}"

  # Clean up the password dir contents
  - name: Clean up the contents of the password file directory
    file:
      state: absent
      path: "{{ passwdDir }}/secret1.yaml"
    run_once: true