{% set osrelease = salt['grains.get']('osrelease') %}

locale:
  present:
    - en_US.UTF-8 UTF-8
  default:
    name: en_US.UTF-8
    requires: en_US.UTF-8 UTF-8
ntp:
  ng:
    settings:
      ntpd: true
      ntp_conf:
        controlkey:
          - 1
        disable:
          - monitor
        driftfile:
          - /var/lib/ntp/drift/ntp.drift
        logfile:
          - /var/log/ntp
        keys:
          - /etc/ntp.keys
        requestkey:
          - 1
        restrict:
          - -4 default kod notrap nomodify nopeer
          - -6 default kod notrap nomodify nopeer
          - 127.0.0.1
          - ::1
        trustedkey:
          - 1
salt:
  gitfs:
    libgit2:
      install_from_source: False
    pygit2:
      install_from_source: False
  master:
    cli_summary: True
    default_top: production
    env_order:
      - production
    ext_pillar:
      - git:
          - production gitlab@mickey.opensuse.org:infra/salt.git:
              - env: production
              - root: pillar
              - privkey: /srv/salt/.ssh/salt_gitlab_oo_infra_salt
              - pubkey: /srv/salt/.ssh/salt_gitlab_oo_infra_salt.pub
    ext_pillar_first: True
    fileserver_backend:
      - git
    gitfs_provider: pygit2
    gitfs_remotes:
      - gitlab@mickey.opensuse.org:infra/salt.git:
          - root: salt
          - privkey: /srv/salt/.ssh/salt_gitlab_oo_infra_salt
          - pubkey: /srv/salt/.ssh/salt_gitlab_oo_infra_salt.pub
      - https://gitlab.opensuse.org/saltstack-formulas/dhcpd-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/grains-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/keepalived-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/locale-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/ntp-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/openssh-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/salt-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/sudoers-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/users-formula.git
      - https://gitlab.opensuse.org/saltstack-formulas/timezone-formula.git
    gitfs_ssl_verify: True
    hash_type: sha512
    pillar_gitfs_ssl_verify: True
    pillar_merge_lists: True
    pillar_source_merging_strategy: smart
    state_output: changes
    state_verbose: False
    top_file_merging_strategy: same
    user: salt
  minion:
    backup_mode: minion
    environment: production
    hash_type: sha512
sshd_config:
  HostKey:
    - /etc/ssh/ssh_host_rsa_key
    - /etc/ssh/ssh_host_dsa_key
    - /etc/ssh/ssh_host_ecdsa_key
    {% if osrelease != '11.3' %}
    - /etc/ssh/ssh_host_ed25519_key
    {% endif %}
  PermitRootLogin: without-password
  PrintMotd: yes
  {% if osrelease.startswith('11') and (salt['grains.get']('cpuarch') == 'x86_64') %}
  # TODO: support more 64bit archs https://progress.opensuse.org/issues/15794
  Subsystem: sftp /usr/lib64/ssh/sftp-server
  {% else %}
  # TODO: upstream fix is not sufficient https://github.com/saltstack-formulas/openssh-formula/pull/57
  Subsystem: sftp /usr/lib/ssh/sftp-server
  {% endif %}
  UseDNS: yes
  matches:
    root:
      type:
        User: root
      options:
        Banner: /etc/ssh/banner
timezone:
  name: UTC
  utc: True
sudoers:
  defaults:
    generic:
      - always_set_home
      - secure_path="/usr/sbin:/usr/bin:/sbin:/bin"
      - env_reset
      - env_keep="LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE"
      - '!insults'
      - targetpw
  users:
    ALL:
      - 'ALL=(ALL) ALL'
    root:
      - 'ALL=(ALL) ALL'
  includedir: /etc/sudoers.d
  included_files:
    /etc/sudoers.d/nagios_nopasswd_zypper:
      users:
        nagios:
          - 'ALL=(ALL) NOPASSWD: /usr/sbin/zypp-refresh,/usr/bin/zypper ref,/usr/bin/zypper sl,/usr/bin/zypper --xmlout --non-interactive list-updates -t package -t patch'
zypper:
  config:
    zypp_conf:
      main:
        download.use_deltarpm: 'false'
        solver.onlyRequires: 'true'
  packages:
    aaa_base-extras: {}
    abuild-online-update: {}
    ca-certificates-freeipa-opensuse: {}