---
- name: Allow user to set their own password
  hosts: all
  become: true
  gather_facts: false

  vars:
    username: "{{ username }}"

  tasks:
    - name: Unlock password so user can run passwd
      ansible.builtin.command: "passwd -d {{ username }}"
      when: not ansible_check_mode

    - name: Ensure user is not locked
      ansible.builtin.user:
        name: "{{ username }}"
        password_lock: false