Added users role to manage the playbook as root and remove admin privileges from deck

roles/users/tasks/main.yml

@@ -0,0 +1,65 @@
+# Runs as the installer's desktop user until root is reachable with a key,
+# then switches over and strips that user of its admin rights.
+- name: Authorize the SSH key for root
+  become: true
+  ansible.posix.authorized_key:
+    user: root
+    key: "{{ lookup('ansible.builtin.file', install_ssh_keys__ssh_pubkey_path | expanduser) }}"
+
+# Empty passwords make Ansible skip sshpass and fall back to the key.
+- name: Switch the connection to root
+  ansible.builtin.set_fact:
+    ansible_user: root
+    ansible_ssh_pass: ''
+    ansible_become_password: ''
+
+- name: Drop the desktop user connection
+  ansible.builtin.meta: reset_connection
+
+# Arch already allows root logins with a key. Stop here, with sshd and the
+# desktop user untouched, if root can't get in.
+- name: Check root login
+  ansible.builtin.ping:
+
+- name: Deploy the sshd configuration
+  ansible.builtin.template:
+    src: sshd.conf.j2
+    dest: /etc/ssh/sshd_config.d/01-bc250.conf
+    mode: '0644'
+  notify: Reload sshd
+
+- name: Validate the sshd configuration
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -t
+  changed_when: false
+
+- name: Apply the sshd configuration
+  ansible.builtin.meta: flush_handlers
+
+- name: Grant the desktop user the udisks actions Steam needs
+  ansible.builtin.template:
+    src: deck.rules.j2
+    dest: /etc/polkit-1/rules.d/50-bc250-{{ users__desktop_user }}.rules
+    mode: '0644'
+
+- name: Read the group database
+  ansible.builtin.getent:
+    database: group
+
+- name: Remove the desktop user from the admin groups
+  ansible.builtin.user:
+    name: "{{ users__desktop_user }}"
+    groups: >-
+      {{ ansible_facts.getent_group | dict2items
+         | selectattr('value.2', 'search', '(^|,)' ~ users__desktop_user ~ '(,|$)')
+         | map(attribute='key')
+         | difference(users__admin_groups) }}
+    append: false
+
+# '!' with no hash: password logins are impossible, SDDM autologin still works.
+- name: Remove and lock the desktop user password
+  ansible.builtin.user:
+    name: "{{ users__desktop_user }}"
+    password: '!'