My goal was to ensure that hammer was working immediately after using the installer, though I could accept this being set to false and having it prompt for the password interactively instead.  We'd need to make foreman-bats set this parameter to true though, that's the only minor change.

The reason it's in /root specifically is so the admin password isn't written out to /etc as a world-readable file.

Another thing I could do is set replace => false on the file { }.