{%- set fqdn    = grains['fqdn']        -%}

{%- set address = grains['fqdn_ip6'][0] -%}

{%- set ssldir  = '/etc/ssl/services/' ~ fqdn ~ '/' -%}

{%- set crt     =  ssldir ~ 'fullchain.pem'         -%}

{%- set key     =  ssldir ~ 'privkey.pem'           -%}

include:

  - infra.nodegroups

{% if salt['grains.get']('include_secrets', True) %}

  - secrets.role.saltmaster

{% endif %}

salt:

  master_remove_config: True

  master:

    auth.ldap.accountattributename: spn

    auth.ldap.basedn: o=heroes

    auth.ldap.binddn: uid=salt,o=heroes

    auth.ldap.filter:

      {%- raw %}

      '(&(spn={{ username }})(objectClass=person)(memberOf=spn=idm_all_persons@infra.opensuse.org,o=heroes))'

      {%- endraw %}

    auth.ldap.groupattribute: memberof

    auth.ldap.groupclass: account

    auth.ldap.groupou: null

    auth.ldap.port: 636

    auth.ldap.scope: 1

    auth.ldap.server: ldap.infra.opensuse.org

    auth.ldap.tls: True

    cache: redis

    cache.redis.unix_socket_path: /run/redis/salt.sock

    cli_summary: True

    default_top: production

    ext_pillar_first: True

    external_auth:

      ldap:

        salt-deploy@infra.opensuse.org:

          - mine.update

          - saltutil.refresh_pillar

          - state.highstate

          - state.sls

          - test.ping

        wheel@infra.opensuse.org%:

          - .*

          - '@jobs'

          - '@runner'

          - '@wheel'

    fileserver_backend:

      - git

      - roots

    file_roots:

      # consider changing back to __env__ after a solution for https://github.com/saltstack/salt/issues/62967

      production:

        - /srv/salt

        - /usr/share/salt-formulas/states

        - /srv/formulas

    gather_job_timeout: 10

    ipc_write_buffer: dynamic

    timeout: 15

    gitfs_ssl_verify: True

    hash_type: sha512

    {%- if grains.get('country') == 'cz' %}

    {#- _needs_ to align with the "ipv6" setting in pillar.common! #}

    interface: '::'

    {%- endif %}

    key_cache: sched

    netapi_enable_clients:

      - local

    ping_on_rotate: True

    pillar_cache: True

    pillar_cache_backend: memory

    pillar_cache_ttl: 1800

    pillar_gitfs_ssl_verify: True

    pillar_merge_lists: True

    pillar_roots:

      __env__:

        - /srv/pillar

    pillar_source_merging_strategy: smart

    rest_cherrypy:

      host: {{ address }}

      port: 4550

      ssl_crt: {{ crt }}

      ssl_key: {{ key }}

    show_jid: True

    sock_pool_size: 30

    state_aggregate: True

    state_compress_ids: True

    state_output: changes

    state_verbose: False

    top_file_merging_strategy: same

    user: salt

    worker_threads: {{ grains['num_cpus'] }}

    zmq_backlog: 10000

    pub_hwm: 10000

infrastructure:

  salt:

    formulas:

      {%- for formula in [

            'backupscript',

            'bootloader',

            'grains',

            'infrastructure',

            'juniper_junos',

            'libvirt',

            'lock',

            'lunmap',

            'mtail',

            'multipath',

            'network',

            'os_update',

            'rebootmgr',

            'redis',

            'redmine',

            'rsync',

            'suse_ha',

            'sysconfig',

            'zypper',

          ]

      %}

      - {{ formula }}-formula

      {%- endfor %}

    git:

      formulas:

        repository: https://gitlab.infra.opensuse.org/infra/salt-formulas-git.git

profile:

  salt:

    saline:

      restapi:

        host: {{ address }}

        ssl_crt: {{ crt }}

        ssl_key: {{ key }}

        log_access_file: /var/log/salt/saline-api-access.log

        log_error_file: /var/log/salt/saline-api-error.log

redis:

  salt:

    acllog-max-len: 64

    databases: 1

    port: 0

    tcp-backlog: 511

    timeout: 0

rsync:

  modules:

    salt-push:

      path: /srv/salt-git/

      comment: /srv/salt-git/

      list: 'false'

      uid: root

      gid: salt

      auth users: saltpush

      read only: false

      hosts allow:

        {%- if grains.get('country') == 'cz' %}

        - 2a07:de40:b27e:1203::126 # gitlab-runner1

        - 2a07:de40:b27e:1203::127 # gitlab-runner2

        {%- else %}

        - 172.16.164.126

        - 172.16.164.127

        {%- endif %}

groups:

  redis:

    system: true

    members:

      - salt

zypper:

  packages:

    python3-ldap: {}

    python3-redis: {}

    saline: {}