initialize as root, setup as normal user

Rexfile

use Rex -base;

user 'deployer';
password 'userpass';
sudo_password 'userpass';
sudo TRUE;

auth for   => initialize =>
  user     => 'root',
  password => 'rootpass';

task 'initialize', sub {
    #create user
    account 'deployer',
      ensure   => 'present',
      groups   => [qw(wheel)],
      password => 'userpass',

      #crypt_password => '*',
      #create_home => TRUE,

      #ssh_key        => "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChUw...";
      ;

    #setup sudo
    pkg 'sudo', ensure => 'present';
    append_or_amend_line '/etc/sudoers',
      line => '%wheel ALL=(ALL) ALL';

    #configure SSH
    append_or_amend_line '/etc/ssh/sshd_config',
      line      => 'PermitRootLogin no',
      regexp    => qr{\#?PermitRootLogin (yes|no)},
      on_change => sub { service 'sshd' => 'reload' };
};

task 'setup', sub {
    pkg 'cowsay', ensure => 'present';
};

batch provision => 'initialize', 'setup';