---
- hosts: all
  become: True
  become_method: sudo
  roles:
    - realm-join-rhel9
    - ssh-deny-root
    - { role: add-sudoers-group, when: group_name is defined }
    - { role: add-allowed-group, when: group_name is defined }