vn-ansible/roles/debian-base/tasks/root.yml

- name: Generate root password
  when: vn_first_time
  block:
    - name: Search root password into Passbolt
      set_fact:
        qst: >
          {{
            lookup(passbolt, inventory_hostname_short,
              username='root',
              uri='ssh://'+hostname_fqdn
            )
          }}
      ignore_errors: true
- name: Generate and save root password if not found in Passbolt
  when: qst is not defined
  block:
    - name: Generate a random root password
      set_fact:
        root_password: "{{ lookup('password', '/dev/null length=18 chars=ascii_letters,digits') }}"
    - name: Save root password into Passbolt
      set_fact:
        msg: >
          {{
            lookup(passbolt, inventory_hostname_short,
              username='root',
              password=root_password,
              uri='ssh://'+hostname_fqdn
            )
          }}
      environment:
        PASSBOLT_CREATE_NEW_RESOURCE: true
    - name: Change root password
      user:
        name: root
        password: "{{ root_password | password_hash('sha512') }}"