vn-ansible/roles/debian-base/tasks/root.yml

- name: Generate a random root password
  set_fact:
    root_password: "{{ lookup('password', '/dev/null length=18 chars=ascii_letters,digits') }}"
- name: Save root password into Passbolt
  set_fact:
    msg: >
      {{
        lookup(passbolt, inventory_hostname_short,
          username='root',
          password=root_password,
          uri='ssh://'+hostname_fqdn
        )
      }}
  environment:
    PASSBOLT_CREATE_NEW_RESOURCE: true
  when: vn_witness
- name: Save the root password to file
  copy:
    content: "{{ root_password }}\n"
    dest: /root/root_password.txt
    owner: root
    group: root
    mode: '0600'
  when: vn_witness
  register: local
- name: Change root password
  user:
    name: root
    password: "{{ root_password | password_hash('sha512') }}"
  when: local.changed