vn-ansible/roles/debian-base/tasks/root.yml

- name: Search root password in Passbolt
  when: vn_first_time
  ignore_errors: true
  set_fact:
    pb_password: >
      {{
        lookup(passbolt, inventory_hostname_short,
          username='root',
          uri='ssh://'+hostname_fqdn
        )
      }}
- when: vn_first_time and pb_password is not defined
  block:
    - name: Generate a random root password
      set_fact:
        root_password: "{{ lookup('password', '/dev/null length=18 chars=ascii_letters,digits') }}"
    - name: Save root password into Passbolt
      set_fact:
        msg: >
          {{
            lookup(passbolt, inventory_hostname_short,
              username='root',
              password=root_password,
              uri='ssh://'+hostname_fqdn
            )
          }}
      environment:
        PASSBOLT_CREATE_NEW_RESOURCE: true
    - name: Change root password
      user:
        name: root
        password: "{{ root_password | password_hash('sha512') }}"