feat: incremental user passwords and export on update

Preserve passwords from server-info.yml and vault; generate only for new users; remove deleted users from output; re-export URL/QR only when password, domain, port, obfs or files changed.

roles/hysteria2/tasks/users.yml

@@ -10,6 +10,16 @@
     - update
     - export
 
+- name: Initialize empty saved export metadata
+  ansible.builtin.set_fact:
+    _hysteria2_saved_passwords: {}
+    _hysteria2_saved_server_info: {}
+  when: not _hysteria2_saved_info.stat.exists
+  tags:
+    - install
+    - update
+    - export
+
 - name: Load saved user passwords from local export
   when: _hysteria2_saved_info.stat.exists
   block:
@@ -20,8 +30,9 @@
       delegate_to: localhost
       become: false
 
-    - name: Parse saved passwords into lookup dict
+    - name: Parse saved export metadata
       ansible.builtin.set_fact:
+        _hysteria2_saved_server_info: "{{ _hysteria2_saved_info_raw.content | b64decode | from_yaml }}"
         _hysteria2_saved_passwords: >-
           {{
             dict(
@@ -33,12 +44,14 @@
                 )
             )
           }}
+      delegate_to: localhost
+      become: false
   tags:
     - install
     - update
     - export
 
-- name: Resolve user list with optional fixed passwords
+- name: Resolve user list with passwords from inventory, vault and previous export
   ansible.builtin.set_fact:
     hysteria2_resolved_users: "{{ hysteria2_resolved_users | default([]) + [ _entry ] }}"
   vars:
@@ -46,8 +59,26 @@
     _password: >-
       {{
         (
-          item.password if item is mapping
-        ) | default('', true)
+          item.password
+          if item is mapping and (item.password | default('') | length > 0)
+          else none
+        )
+        | default(
+            hysteria2_user_passwords[_username]
+            if (
+              hysteria2_user_passwords is defined
+              and (hysteria2_user_passwords[_username] | default('') | length > 0)
+            )
+            else none,
+            true
+          )
+        | default(
+            _hysteria2_saved_passwords[_username]
+            if (_hysteria2_saved_passwords[_username] | default('') | length > 0)
+            else none,
+            true
+          )
+        | default('', true)
       }}
     _entry:
       name: "{{ _username }}"