set strong password for root

roles/bastionhost/tasks/users.yml

@@ -1,4 +1,7 @@
 # Configure users for the bastion host
+- name: users | root | Set strong password
+  include_tasks: users/root.yml
+
 - name: users | rene | Ensure admin user is absent from bastion
   include_tasks: users/rene.yml
 

roles/bastionhost/tasks/users/root.yml

@@ -0,0 +1,6 @@
+# in z.B. roles/bastionhost/tasks/system_setup/user_hardening.yml
+- name: Bastionhost | User Hardening | Set a strong root password from vault
+  ansible.builtin.user:
+    name: root
+    password: "{{ root_password_hash }}"
+  when: root_password_hash is defined