- name: GRUB boot password protection
  blockinfile:
    path: /etc/grub.d/40_custom
    block: |
      set superusers="{{ grub_user }}"
      password_pbkdf2 {{ grub_user }} {{ grub_code }}
  notify: grub-register