Fixes #12

.gitignore

@@ -1,3 +1,5 @@
 *~
 *swp
 .~lock*
+# security
+root-passwd.yml

infrastructure/acer30/ansible/apb-root-passwd.yml

@@ -0,0 +1,17 @@
+---
+
+- name: update root password in target hosts
+  #hosts: all
+  hosts: test
+  # use additional yml file for a special variable (password) -> src https://stackoverflow.com/questions/39805949/how-to-use-include-vars-in-ansible
+  vars_files:
+    # create a file with name 'root-passwd.yml' and content 'passwd: new_passwd'
+    # after you completed the task remove that file
+    - root-passwd.yml
+  tasks:
+  # pipe password to hash just in time -> src https://stackoverflow.com/questions/37828299/ansible-update-user-password
+  - name: change root passwd
+    user:
+      name: root
+      update_password: always
+      password: '{{ passwd | password_hash("sha512") }}'