---
- name: give users password-protected sudo
  become: yes
  template:
    src: sudoers-users
    dest: /etc/sudoers.d/users
    owner: root
    group: root
    mode: u=r,g=r,o=
    validate: visudo --check --file=%s

- name: give groups password-protected sudo
  become: yes
  template:
    src: sudoers-groups
    dest: /etc/sudoers.d/groups
    owner: root
    group: root
    mode: u=r,g=r,o=
    validate: visudo --check --file=%s

- name: install /etc/sudoers configuration
  become: yes
  template:
    src: sudoers
    dest: /etc/sudoers
    owner: root
    group: root
    mode: u=r,g=r,o=
    validate: visudo --check --file=%s
