- name: GRUB password boot protection
  blockinfile:
    path: /etc/grub.d/40_custom
    block: |
      set superusers="{{ user_grub }}"
      password_pbkdf2 {{ user_grub }} {{ code_grub }}
  notify: grub-register
  when: secure_grub_enabled