efivar | Tools and libraries to work with EFI variables

grub-redhat.j2 has some typos.

Line 11: set supperusers="{{ grub_user }}"

Change to: set superusers="{{ grub_user }}"

Line 12: password_pbkdf2 {{ grub_user }} {{ grub_password_v2_passwd }}

Change to:password_pbkdf2 {{ grub_user }} {{ grub_password_v2_passwd }}

If you're going to use the same grub password on multiple machines, you might want to consider using ansible-vault encrypt_string to encrypt the raw password, then create an additional task which runs grub2-mkpasswd-pbkdf2 (part of grub2-tools-minimal) with the command module and pass it the vaulted variable. Registering the output of that task (e.g. as grub_password_v2_passwd) would result in every target that you run the playbook against receiving a unique hash even though the underlying password would be the same. The expect module works great for this: