xoxys.mosquitto/tasks/config.yml

---
- name: Check if password file '{{ mosquitto_password_auth_file }}' exists
  stat:
    path: "{{ mosquitto_password_auth_file }}"
  register: __mosquitto_passwd
  become: True
  become_user: root

- name: Create password file if not exist
  file:
    path: "{{ mosquitto_password_auth_file }}"
    mode: 0600
    state: touch
  become: True
  become_user: root
  when: not __mosquitto_passwd.stat.exists

# TODO: ugly workaround, move this to a custom module
- name: Add users to password file
  shell: "mosquitto_passwd -b {{ mosquitto_password_auth_file }} {{ item.key }} {{ item.value.password }}"
  with_dict: "{{ mosquitto_password_auth_users | default('{}') }}"
  when: item.value.state == "present"
  changed_when: False
  no_log: True
  become: True
  become_user: root

- name: Remove unnecessary users from password file
  shell: "mosquitto_passwd -D {{ mosquitto_password_auth_file }} {{ item.key }}"
  with_dict: "{{ mosquitto_password_auth_users | default('{}') }}"
  when: item.value.state == "absent"
  changed_when: False
  no_log: True
  become: True
  become_user: root