Add users and ssh service

Signed-off-by: Joe Groocock <me@frebib.net>

pillar/top.sls

@@ -1,3 +0,0 @@
-{{ saltenv }}:
-  '*':
-    []

stack/stack.cfg

@@ -1 +0,0 @@
-[]

states/salt/minion/init.sls

@@ -1,40 +0,0 @@
-{%- set masters = ['salt.nerdhouse.io'] %}
-
-salt-minion:
-  pkg.installed:
-  - version: latest
-  service.running:
-  - enable: true
-  - require:
-    - pkg: salt-minion
-    - file: /etc/salt/minion
-
-restart-salt-minion:
-  cmd.run:
-  - name: sleep 10 && systemctl restart salt-minion
-  - bg: true
-  - order: last
-  - onchanges:
-    - pkg: salt-minion
-    - file: /etc/salt/minion
-  - require:
-    - cmd: check-minion-config
-
-/etc/salt/minion:
-  file.managed:
-  - source: salt://{{ slspath }}/templates/minion.jinja
-  - template: jinja
-  - user: root
-  - group: root
-  - mode: 644
-  - context:
-      masters: {{ masters|json }}
-  - require:
-    - pkg: salt-minion
-
-check-minion-config:
-  cmd.run:
-  - name: sudo salt-call --local --skip-grains test.true
-  - onchanges:
-    - pkg: salt-minion
-    - file: /etc/salt/minion

states/salt/minion/templates/minion.jinja

@@ -1,26 +0,0 @@
-id: {{ grains.id|lower }}
-log_level: info
-ipv6: true
-ssl: true
-transport: tcp
-
-# https://github.com/saltstack/salt/blob/b95213ec903402f25c1e0aeb3990fe8452ab63ce/conf/minion#L39-L47
-# str, failover or disable
-master_type: str
-{% if masters is defined %}
-master:
-  {%- for master in masters %}
-- {{ master }}
-  {%- endfor %}
-{%- endif %}
-
-# set the default saltenv for highstate
-# otherwise it tries to run all of them 🤔
-saltenv: base
-# useful for influencing git_pillar and gitfs at the same time
-pillarenv_from_saltenv: true
-
-enable_fqdns_grains: false
-enable_gpu_grains: false
-
-# vim: ft=yaml

states/top.sls

@@ -2,4 +2,3 @@
   '*':
   - users
   - sshd
-  - salt.minion

states/users/init.sls

@@ -1,24 +1,19 @@
-{%- import_yaml 'users/users.jinja' as users %}
+{%- import 'users/users.jinja' as users %}
 
 {%- if users is not mapping %}
-  {%- do raise('users/users.jinja is malformed') %}
+  {%- raise('users/users.jinja is malformed') %}
 {%- endif %}
 
-{%- for name, user in users.items() %}
+{%- for name, user in users %}
 {{ name|json }}:
   user.present:
-  - usergroup: true
+    usergroup: true
-  - createhome: true
+    createhome: true
-  - groups: {{ user.get('groups', [])|json }}
+    groups: {{ user.get('groups', [])|json }}
   {%- if user.password is defined %}
-  - password: {{ user.password|json }}
+    password: {{ user.password|json }}
   {%- endif %}
   {%- if user.shell is defined %}
-  - shell: {{ user.shell }}
+    shell: {{ user.shell }}
-  {%- endif %}
-  ssh_auth.manage:
-  - user: {{ name }}
-  {%- if user['ssh-keys'] is defined %}
-  - ssh_keys: {{ user['ssh-keys']|json }}
   {%- endif %}
 {%- endfor %}

states/users/users.jinja

@@ -1,27 +1,15 @@
 {%- set sudo_group = 'sudo' if grains.os|lower == 'debian' else 'wheel' %}
-{%- set admin_groups = [sudo_group] %}
-{%- if grains.init == 'systemd' %}
-  {%- do admin_groups.append('systemd-journal') %}
-{%- endif %}
-
-{# FIXME(frebib): manage Docker group instead of blindly adding it #}
-{%- do admin_groups.append('docker') %}
 
 frebib:
   groups:
-{%- for group in admin_groups %}
+  - {{ sudo_group }}
-  - {{ group }}
-{%- endfor %}
   ssh-keys:
   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINk+sOUEXKsGqITyMhna9v77ADGagkr3YMpgZFkrvqcd frebib@frebib-PC
   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBIGxhZPQM/3Ck+DNNM0CoIZTsvKqQLKq8fqQoO6fXzX frebib@frebib-OnePlus3
-  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+T8ChEU9YmpE2BY77oEtKzedB8HWDSM5bErDN9gcvj frebib@frebib-Cf
 
 adam:
   groups:
-{%- for group in admin_groups %}
+  - {{ sudo_group }}
-  - {{ group }}
-{%- endfor %}
   ssh-keys:
   - ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAiF/WxxMOOE/r8I/anF8gKarjNFmeoPuXNMYE0Hwo/NMqbJ9qKVONn+4fa5T99yhhAnYy92PBPxjmSsOqex28XZFh4I4GBGKh+Su1tJKLXsts1rbJmB1gSpKGbbjsiZcta4FqbiLKyUGL1wiV6GWucKdkC9lfTfocmH20tLbqSTryTAfy62oaEyEUSSATcwnl6ITF6BaQVGT8e78O4DpMYvYXFDa0nre0GlBigI0bAIHknmo+5JuL9i6RbnLr/zHMBiT3lnqQ8IO0JLNJD3ML/X/vgo3Htd6ovKe28YBi+LV+olpcFlQGSpNj+gE67UYb+Hw4mMTjzG4RhNHfQZCrNw== adampc
   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDYo04d3a7J22F0NlAM1MeqmZrbF7iaF9p9whLQmq/gYgZnFKtW7G/rQCUUG5X8yEn5LXkc9SYdRceyaleNDAe0/uEJIbbm+VPgkShV+pyA8AbP4+OF95JKgCS6/B59IStF8GrVnX9krjYLYVwS3FqwvYt/ZkYriX4hkaTkf3FslLU7eEwrDec3RuGXhTDTdLdFyq6wXsI/bITX2C0b8D5obNNkyPJFVV1zshy9mQ5/5wjHYLyZhUSRzcY6xDOlxWmTSHseYG1U5espgba7t6ZaL/n44IrXzFsuXRIA74rx3ESAtCEesM3TaPI/Q8dHOYsCdDquTyccP/nEkDCxxhl3 adam-laptop