inf-aux/roles/rpi-base/tasks/user.yml

- name: USER | change password
  user:
    name: pi
    password: "{{ lookup('passwordstore', 'infra/machine/pi@' + ansible_hostname + ' create=true length=20')
                    | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) }}"

- name: USER | add authorized SSH key(s)
  authorized_key:
    user: pi
    state: present
    key: "{{ lookup('file', item) }}"
  with_fileglob:
    - "keys/*.pub"