updated pillar top

pillars/roles/git/saltmaster.sls

@@ -1,17 +1,18 @@
+{%- set branches=salt.cmd.shell('git ls-remote https://git.actcur.com/actcur/salt.git | grep -o -P "(?<=refs/heads/).*" | grep -Pv "(^temp$)|(^history$)"').split('\n') -%}
+branches:
+  saltmaster:
+{%- for branch in branches %}
+    - {{branch}}
+{%- endfor %}
+
 git:
-  salt:
+{%- for branch in branches %}
+  salt_{{branch}}:
     repo: "ssh://gitea@git.actcur.com:5022/actcur/salt.git"
-    path: "/srv/salt/prod"
+    path: "/srv/salt/{{branch}}"
-    branch: "master"
+    branch: "{{branch}}"
     key: "git_actcur"
-    force: true
+    force: {{ "True" if (branch == "prod" or branch == "qual") else "false" }}
-    email: "actcur@actcur.com"
-    name: "Actaeus Curabitur"
-  salt_dev:
-    repo: "ssh://gitea@git.actcur.com:5022/actcur/salt.git"
-    path: "/srv/salt/dev"
-    branch: "dev"
-    key: "git_actcur"
-    force: true
     email: "actcur@actcur.com"
     name: "Actaeus Curabitur"
+{%- endfor %}

pillars/roles/nginx/nextcloud.sls

@@ -4,11 +4,6 @@ nginx:
     https:
       port: 8080
       prot: http
-  office:
-    auth: none
-    https:
-      port: 8000
-      prot: http
 
 portal:
   Misc:

pillars/roles/nginx/pass.sls

@@ -1,8 +1,8 @@
 nginx:
   pass:
-    auth: 2fa
+    auth: none
     https:
-      port: 8080
+      port: 8000
       prot: http
 
 portal:

pillars/top.sls

@@ -1,8 +1,7 @@
-prod:
+{%- set branches=salt.cmd.shell('git ls-remote https://git.actcur.com/actcur/salt.git | grep -o -P "(?<=refs/heads/).*" | grep -Pv "(^temp$)|(^history$)"').split('\n') -%}
-  '*':
+{%- for branch in branches %}
-    - roles
+{{branch}}:
-    - servers
-dev:
   '*':
     - roles
     - servers
+{%- endfor %}

squash.sh

@@ -3,17 +3,17 @@ git fetch --all;
 
 #copy dev to history to ensure we don't lose changes if something goes wrong
 git checkout history;
-git reset --hard dev;
+git reset --hard qual;
 git push --force;
 
 #merge to master
-git checkout -B master origin/master;
+git checkout -B prod origin/master;
-git merge --squash dev;
+git merge --squash qual;
 git commit -am "$cm";
 git push;
 
 #clean dev
-git checkout dev;
+git checkout qual;
-git reset --hard master;
+git reset --hard prod;
 git push --force;
-git reset --hard origin/dev;
+git reset --hard origin/qual;

states/roles/maintain/nginx-proxy/local.conf

@@ -22,8 +22,8 @@ server {
   listen 443;
   server_name {{server}}.actcur.com {{wildcard}};
 
-  resolver {{ resolver }};
+#  resolver {{ resolver }};
-  set $backend "{{prot}}://$server_name{%- if port is defined -%}:{{port}}{%- endif -%}";
+  set $backend "{{prot}}://127.0.0.1{%- if port is defined -%}:{{port}}{%- endif -%}";
 
   ssl on;
   ssl_certificate /etc/nginx/certs/{{server}}.actcur.com/fullchain.pem;

states/roles/maintain/pass.old/init.sls

@@ -0,0 +1,63 @@
+#install teampass - needs to be changed to being built in the aurrepo as soon as Marcin updates the dependencies to not include mysql
+teampass_/etc/pacman.conf:
+  file.append:
+    - name: /etc/pacman.conf
+    - source: salt://roles/maintain/pass/temp-repo.conf
+
+install_teampass:
+  pkg.installed:
+    - name: teampass
+
+teampass_php-gd:
+  pkg.installed:
+    - name: php-gd
+
+teampass_php-fpm:
+  pkg.installed:
+    - name: php-fpm
+  service.running:
+    - name: php-fpm
+    - enable: true
+    - watch:
+      - file: /etc/php/php.ini
+
+/etc/php/php.ini:
+  file.managed:
+    - source: salt://roles/maintain/pass/php.ini
+
+/etc/nginx/conf.d/teampass.conf:
+  file.managed:
+    - source: salt://roles/maintain/pass/nginx.conf
+
+#change ownership on directories
+"/usr/share/webapps/teampass/includes/config/":
+  file.directory:
+    - user: http
+    - group: http
+"/usr/share/webapps/teampass/includes/avatars/":
+  file.directory:
+    - user: http
+    - group: http
+"/usr/share/webapps/teampass/includes/libraries/csrfp/libs/":
+  file.directory:
+    - user: http
+    - group: http
+"/usr/share/webapps/teampass/includes/libraries/csrfp/js/":
+  file.directory:
+    - user: http
+    - group: http
+"/usr/share/webapps/teampass/includes/libraries/csrfp/log/":
+  file.directory:
+    - user: http
+    - group: http
+
+"/teampass":
+  file.directory:
+    - user: http
+    - group: http
+    - dir_mode: 700
+    - file_mode: 600
+    - recurse:
+      - user
+      - group
+      - mode

states/roles/maintain/pass/init.sls

@@ -1,63 +1,18 @@
-#install teampass - needs to be changed to being built in the aurrepo as soon as Marcin updates the dependencies to not include mysql
+vaultwarden-pkgs:
-teampass_/etc/pacman.conf:
-  file.append:
-    - name: /etc/pacman.conf
-    - source: salt://roles/maintain/pass/temp-repo.conf
-
-install_teampass:
   pkg.installed:
-    - name: teampass
+    - pkgs:
+      - vaultwarden
+      - vaultwarden-web
 
-teampass_php-gd:
+/etc/vaultwarden.env:
-  pkg.installed:
+  file.managed:
-    - name: php-gd
+    - source: salt://roles/maintain/pass/vaultwarden.env
+    - user: root
+    - group: root
+    - mode: 644
 
-teampass_php-fpm:
+vaultwarden-service:
-  pkg.installed:
-    - name: php-fpm
   service.running:
-    - name: php-fpm
+    - name: vaultwarden
-    - enable: true
     - watch:
-      - file: /etc/php/php.ini
+      - file: /etc/vaultwarden.env
-
-/etc/php/php.ini:
-  file.managed:
-    - source: salt://roles/maintain/pass/php.ini
-
-/etc/nginx/conf.d/teampass.conf:
-  file.managed:
-    - source: salt://roles/maintain/pass/nginx.conf
-
-#change ownership on directories
-"/usr/share/webapps/teampass/includes/config/":
-  file.directory:
-    - user: http
-    - group: http
-"/usr/share/webapps/teampass/includes/avatars/":
-  file.directory:
-    - user: http
-    - group: http
-"/usr/share/webapps/teampass/includes/libraries/csrfp/libs/":
-  file.directory:
-    - user: http
-    - group: http
-"/usr/share/webapps/teampass/includes/libraries/csrfp/js/":
-  file.directory:
-    - user: http
-    - group: http
-"/usr/share/webapps/teampass/includes/libraries/csrfp/log/":
-  file.directory:
-    - user: http
-    - group: http
-
-"/teampass":
-  file.directory:
-    - user: http
-    - group: http
-    - dir_mode: 700
-    - file_mode: 600
-    - recurse:
-      - user
-      - group
-      - mode

states/roles/maintain/pass/vaultwarden.env

@@ -0,0 +1,391 @@
+## Vaultwarden Configuration File
+## Uncomment any of the following lines to change the defaults
+##
+## Be aware that most of these settings will be overridden if they were changed
+## in the admin interface. Those overrides are stored within DATA_FOLDER/config.json .
+##
+## By default, vaultwarden expects for this file to be named ".env" and located
+## in the current working directory. If this is not the case, the environment
+## variable ENV_FILE can be set to the location of this file prior to starting
+## vaultwarden.
+
+## Main data folder
+DATA_FOLDER=/var/lib/vaultwarden
+
+## Database URL
+## When using SQLite, this is the path to the DB file, default to %DATA_FOLDER%/db.sqlite3
+# DATABASE_URL=data/db.sqlite3
+## When using MySQL, specify an appropriate connection URI.
+## Details: https://docs.diesel.rs/diesel/mysql/struct.MysqlConnection.html
+# DATABASE_URL=mysql://user:password@host[:port]/database_name
+## When using PostgreSQL, specify an appropriate connection URI (recommended)
+## or keyword/value connection string.
+## Details:
+## - https://docs.diesel.rs/diesel/pg/struct.PgConnection.html
+## - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
+# DATABASE_URL=postgresql://user:password@host[:port]/database_name
+
+## Database max connections
+## Define the size of the connection pool used for connecting to the database.
+# DATABASE_MAX_CONNS=10
+
+## Database connection initialization
+## Allows SQL statements to be run whenever a new database connection is created.
+## This is mainly useful for connection-scoped pragmas.
+## If empty, a database-specific default is used:
+## - SQLite: "PRAGMA busy_timeout = 5000; PRAGMA synchronous = NORMAL;"
+## - MySQL: ""
+## - PostgreSQL: ""
+# DATABASE_CONN_INIT=""
+
+## Individual folders, these override %DATA_FOLDER%
+# RSA_KEY_FILENAME=data/rsa_key
+# ICON_CACHE_FOLDER=data/icon_cache
+# ATTACHMENTS_FOLDER=data/attachments
+# SENDS_FOLDER=data/sends
+# TMP_FOLDER=data/tmp
+
+## Templates data folder, by default uses embedded templates
+## Check source code to see the format
+# TEMPLATES_FOLDER=/path/to/templates
+## Automatically reload the templates for every request, slow, use only for development
+# RELOAD_TEMPLATES=false
+
+## Client IP Header, used to identify the IP of the client, defaults to "X-Real-IP"
+## Set to the string "none" (without quotes), to disable any headers and just use the remote IP
+# IP_HEADER=X-Real-IP
+
+## Cache time-to-live for successfully obtained icons, in seconds (0 is "forever")
+# ICON_CACHE_TTL=2592000
+## Cache time-to-live for icons which weren't available, in seconds (0 is "forever")
+# ICON_CACHE_NEGTTL=259200
+
+## Web vault settings
+WEB_VAULT_FOLDER=/usr/share/webapps/vaultwarden-web
+WEB_VAULT_ENABLED=true
+
+## Enables websocket notifications
+# WEBSOCKET_ENABLED=false
+
+## Controls the WebSocket server address and port
+ WEBSOCKET_ADDRESS=0.0.0.0
+# WEBSOCKET_PORT=3012
+
+## Controls whether users are allowed to create Bitwarden Sends.
+## This setting applies globally to all users.
+## To control this on a per-org basis instead, use the "Disable Send" org policy.
+# SENDS_ALLOWED=true
+
+## Controls whether users can enable emergency access to their accounts.
+## This setting applies globally to all users.
+# EMERGENCY_ACCESS_ALLOWED=true
+
+## Job scheduler settings
+##
+## Job schedules use a cron-like syntax (as parsed by https://crates.io/crates/cron),
+## and are always in terms of UTC time (regardless of your local time zone settings).
+##
+## How often (in ms) the job scheduler thread checks for jobs that need running.
+## Set to 0 to globally disable scheduled jobs.
+# JOB_POLL_INTERVAL_MS=30000
+##
+## Cron schedule of the job that checks for Sends past their deletion date.
+## Defaults to hourly (5 minutes after the hour). Set blank to disable this job.
+# SEND_PURGE_SCHEDULE="0 5 * * * *"
+##
+## Cron schedule of the job that checks for trashed items to delete permanently.
+## Defaults to daily (5 minutes after midnight). Set blank to disable this job.
+# TRASH_PURGE_SCHEDULE="0 5 0 * * *"
+##
+## Cron schedule of the job that checks for incomplete 2FA logins.
+## Defaults to once every minute. Set blank to disable this job.
+# INCOMPLETE_2FA_SCHEDULE="30 * * * * *"
+##
+## Cron schedule of the job that sends expiration reminders to emergency access grantors.
+## Defaults to hourly (5 minutes after the hour). Set blank to disable this job.
+# EMERGENCY_NOTIFICATION_REMINDER_SCHEDULE="0 5 * * * *"
+##
+## Cron schedule of the job that grants emergency access requests that have met the required wait time.
+## Defaults to hourly (5 minutes after the hour). Set blank to disable this job.
+# EMERGENCY_REQUEST_TIMEOUT_SCHEDULE="0 5 * * * *"
+
+## Enable extended logging, which shows timestamps and targets in the logs
+# EXTENDED_LOGGING=true
+
+## Timestamp format used in extended logging.
+## Format specifiers: https://docs.rs/chrono/latest/chrono/format/strftime
+# LOG_TIMESTAMP_FORMAT="%Y-%m-%d %H:%M:%S.%3f"
+
+## Logging to file
+# LOG_FILE=/var/log/vaultwarden.log
+
+## Logging to Syslog
+## This requires extended logging
+# USE_SYSLOG=false
+
+## Log level
+## Change the verbosity of the log output
+## Valid values are "trace", "debug", "info", "warn", "error" and "off"
+## Setting it to "trace" or "debug" would also show logs for mounted
+## routes and static file, websocket and alive requests
+# LOG_LEVEL=Info
+
+## Enable WAL for the DB
+## Set to false to avoid enabling WAL during startup.
+## Note that if the DB already has WAL enabled, you will also need to disable WAL in the DB,
+## this setting only prevents vaultwarden from automatically enabling it on start.
+## Please read project wiki page about this setting first before changing the value as it can
+## cause performance degradation or might render the service unable to start.
+# ENABLE_DB_WAL=true
+
+## Database connection retries
+## Number of times to retry the database connection during startup, with 1 second delay between each retry, set to 0 to retry indefinitely
+# DB_CONNECTION_RETRIES=15
+
+## Icon service
+## The predefined icon services are: internal, bitwarden, duckduckgo, google.
+## To specify a custom icon service, set a URL template with exactly one instance of `{}`,
+## which is replaced with the domain. For example: `https://icon.example.com/domain/{}`.
+##
+## `internal` refers to Vaultwarden's built-in icon fetching implementation.
+## If an external service is set, an icon request to Vaultwarden will return an HTTP
+## redirect to the corresponding icon at the external service. An external service may
+## be useful if your Vaultwarden instance has no external network connectivity, or if
+## you are concerned that someone may probe your instance to try to detect whether icons
+## for certain sites have been cached.
+# ICON_SERVICE=internal
+
+## Icon redirect code
+## The HTTP status code to use for redirects to an external icon service.
+## The supported codes are 301 (legacy permanent), 302 (legacy temporary), 307 (temporary), and 308 (permanent).
+## Temporary redirects are useful while testing different icon services, but once a service
+## has been decided on, consider using permanent redirects for cacheability. The legacy codes
+## are currently better supported by the Bitwarden clients.
+# ICON_REDIRECT_CODE=302
+
+## Disable icon downloading
+## Set to true to disable icon downloading in the internal icon service.
+## This still serves existing icons from $ICON_CACHE_FOLDER, without generating any external
+## network requests. $ICON_CACHE_TTL must also be set to 0; otherwise, the existing icons
+## will be deleted eventually, but won't be downloaded again.
+# DISABLE_ICON_DOWNLOAD=false
+
+## Icon download timeout
+## Configure the timeout value when downloading the favicons.
+## The default is 10 seconds, but this could be to low on slower network connections
+# ICON_DOWNLOAD_TIMEOUT=10
+
+## Icon blacklist Regex
+## Any domains or IPs that match this regex won't be fetched by the icon service.
+## Useful to hide other servers in the local network. Check the WIKI for more details
+## NOTE: Always enclose this regex withing single quotes!
+# ICON_BLACKLIST_REGEX='^(192\.168\.0\.[0-9]+|192\.168\.1\.[0-9]+)$'
+
+## Any IP which is not defined as a global IP will be blacklisted.
+## Useful to secure your internal environment: See https://en.wikipedia.org/wiki/Reserved_IP_addresses for a list of IPs which it will block
+# ICON_BLACKLIST_NON_GLOBAL_IPS=true
+
+## Disable 2FA remember
+## Enabling this would force the users to use a second factor to login every time.
+## Note that the checkbox would still be present, but ignored.
+# DISABLE_2FA_REMEMBER=false
+
+## Maximum attempts before an email token is reset and a new email will need to be sent.
+# EMAIL_ATTEMPTS_LIMIT=3
+
+## Token expiration time
+## Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
+# EMAIL_EXPIRATION_TIME=600
+
+## Email token size
+## Number of digits in an email 2FA token (min: 6, max: 255).
+## Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting!
+# EMAIL_TOKEN_SIZE=6
+
+## Controls if new users can register
+# SIGNUPS_ALLOWED=true
+
+## Controls if new users need to verify their email address upon registration
+## Note that setting this option to true prevents logins until the email address has been verified!
+## The welcome email will include a verification link, and login attempts will periodically
+## trigger another verification email to be sent.
+# SIGNUPS_VERIFY=false
+
+## If SIGNUPS_VERIFY is set to true, this limits how many seconds after the last time
+## an email verification link has been sent another verification email will be sent
+# SIGNUPS_VERIFY_RESEND_TIME=3600
+
+## If SIGNUPS_VERIFY is set to true, this limits how many times an email verification
+## email will be re-sent upon an attempted login.
+# SIGNUPS_VERIFY_RESEND_LIMIT=6
+
+## Controls if new users from a list of comma-separated domains can register
+## even if SIGNUPS_ALLOWED is set to false
+# SIGNUPS_DOMAINS_WHITELIST=example.com,example.net,example.org
+
+## Controls which users can create new orgs.
+## Blank or 'all' means all users can create orgs (this is the default):
+# ORG_CREATION_USERS=
+## 'none' means no users can create orgs:
+# ORG_CREATION_USERS=none
+## A comma-separated list means only those users can create orgs:
+# ORG_CREATION_USERS=admin1@example.com,admin2@example.com
+
+## Token for the admin interface, preferably use a long random string
+## One option is to use 'openssl rand -base64 48'
+## If not set, the admin panel is disabled
+# ADMIN_TOKEN=Vy2VyYTTsKPv8W5aEOWUbB/Bt3DEKePbHmI4m9VcemUMS2rEviDowNAFqYi1xjmp
+
+## Enable this to bypass the admin panel security. This option is only
+## meant to be used with the use of a separate auth layer in front
+# DISABLE_ADMIN_TOKEN=false
+
+## Invitations org admins to invite users, even when signups are disabled
+# INVITATIONS_ALLOWED=true
+## Name shown in the invitation emails that don't come from a specific organization
+# INVITATION_ORG_NAME=Vaultwarden
+
+## Per-organization attachment storage limit (KB)
+## Max kilobytes of attachment storage allowed per organization.
+## When this limit is reached, organization members will not be allowed to upload further attachments for ciphers owned by that organization.
+# ORG_ATTACHMENT_LIMIT=
+## Per-user attachment storage limit (KB)
+## Max kilobytes of attachment storage allowed per user.
+## When this limit is reached, the user will not be allowed to upload further attachments.
+# USER_ATTACHMENT_LIMIT=
+
+## Number of days to wait before auto-deleting a trashed item.
+## If unset (the default), trashed items are not auto-deleted.
+## This setting applies globally, so make sure to inform all users of any changes to this setting.
+# TRASH_AUTO_DELETE_DAYS=
+
+## Number of minutes to wait before a 2FA-enabled login is considered incomplete,
+## resulting in an email notification. An incomplete 2FA login is one where the correct
+## master password was provided but the required 2FA step was not completed, which
+## potentially indicates a master password compromise. Set to 0 to disable this check.
+## This setting applies globally to all users.
+# INCOMPLETE_2FA_TIME_LIMIT=3
+
+## Controls the PBBKDF password iterations to apply on the server
+## The change only applies when the password is changed
+# PASSWORD_ITERATIONS=100000
+
+## Controls whether users can set password hints. This setting applies globally to all users.
+# PASSWORD_HINTS_ALLOWED=true
+
+## Controls whether a password hint should be shown directly in the web page if
+## SMTP service is not configured. Not recommended for publicly-accessible instances
+## as this provides unauthenticated access to potentially sensitive data.
+# SHOW_PASSWORD_HINT=false
+
+## Domain settings
+## The domain must match the address from where you access the server
+## It's recommended to configure this value, otherwise certain functionality might not work,
+## like attachment downloads, email links and U2F.
+## For U2F to work, the server must use HTTPS, you can use Let's Encrypt for free certs
+# DOMAIN=https://vw.domain.tld:8443
+
+## Allowed iframe ancestors (Know the risks!)
+## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
+## Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
+## This adds the configured value to the 'Content-Security-Policy' headers 'frame-ancestors' value.
+## Multiple values must be separated with a whitespace.
+# ALLOWED_IFRAME_ANCESTORS=
+
+## Number of seconds, on average, between login requests from the same IP address before rate limiting kicks in.
+# LOGIN_RATELIMIT_SECONDS=60
+## Allow a burst of requests of up to this size, while maintaining the average indicated by `LOGIN_RATELIMIT_SECONDS`.
+## Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2.
+# LOGIN_RATELIMIT_MAX_BURST=10
+
+## Number of seconds, on average, between admin requests from the same IP address before rate limiting kicks in.
+# ADMIN_RATELIMIT_SECONDS=300
+## Allow a burst of requests of up to this size, while maintaining the average indicated by `ADMIN_RATELIMIT_SECONDS`.
+# ADMIN_RATELIMIT_MAX_BURST=3
+
+## Yubico (Yubikey) Settings
+## Set your Client ID and Secret Key for Yubikey OTP
+## You can generate it here: https://upgrade.yubico.com/getapikey/
+## You can optionally specify a custom OTP server
+# YUBICO_CLIENT_ID=11111
+# YUBICO_SECRET_KEY=AAAAAAAAAAAAAAAAAAAAAAAA
+# YUBICO_SERVER=http://yourdomain.com/wsapi/2.0/verify
+
+## Duo Settings
+## You need to configure all options to enable global Duo support, otherwise users would need to configure it themselves
+## Create an account and protect an application as mentioned in this link (only the first step, not the rest):
+## https://help.bitwarden.com/article/setup-two-step-login-duo/#create-a-duo-security-account
+## Then set the following options, based on the values obtained from the last step:
+# DUO_IKEY=<Integration Key>
+# DUO_SKEY=<Secret Key>
+# DUO_HOST=<API Hostname>
+## After that, you should be able to follow the rest of the guide linked above,
+## ignoring the fields that ask for the values that you already configured beforehand.
+
+## Authenticator Settings
+## Disable authenticator time drifted codes to be valid.
+## TOTP codes of the previous and next 30 seconds will be invalid
+##
+## According to the RFC6238 (https://tools.ietf.org/html/rfc6238),
+## we allow by default the TOTP code which was valid one step back and one in the future.
+## This can however allow attackers to be a bit more lucky with there attempts because there are 3 valid codes.
+## You can disable this, so that only the current TOTP Code is allowed.
+## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid.
+## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
+# AUTHENTICATOR_DISABLE_TIME_DRIFT=false
+
+## Rocket specific settings
+## See https://rocket.rs/v0.4/guide/configuration/ for more details.
+# ROCKET_ADDRESS=0.0.0.0
+# ROCKET_PORT=80  # Defaults to 80 in the Docker images, or 8000 otherwise.
+# ROCKET_WORKERS=10
+# ROCKET_TLS={certs="/path/to/certs.pem",key="/path/to/key.pem"}
+ROCKET_LIMITS={json=10485760}
+
+## Mail specific settings, set SMTP_HOST and SMTP_FROM to enable the mail service.
+## To make sure the email links are pointing to the correct host, set the DOMAIN variable.
+## Note: if SMTP_USERNAME is specified, SMTP_PASSWORD is mandatory
+# SMTP_HOST=smtp.domain.tld
+# SMTP_FROM=vaultwarden@domain.tld
+# SMTP_FROM_NAME=Vaultwarden
+# SMTP_SECURITY=starttls # ("starttls", "force_tls", "off") Enable a secure connection. Default is "starttls" (Explicit - ports 587 or 25), "force_tls" (Implicit - port 465) or "off", no encryption (port 25)
+# SMTP_PORT=587          # Ports 587 (submission) and 25 (smtp) are standard without encryption and with encryption via STARTTLS (Explicit TLS). Port 465 is outdated and used with Implicit TLS.
+# SMTP_USERNAME=username
+# SMTP_PASSWORD=password
+# SMTP_TIMEOUT=15
+
+## Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections.
+## Possible values: ["Plain", "Login", "Xoauth2"].
+## Multiple options need to be separated by a comma ','.
+# SMTP_AUTH_MECHANISM="Plain"
+
+## Server name sent during the SMTP HELO
+## By default this value should be is on the machine's hostname,
+## but might need to be changed in case it trips some anti-spam filters
+# HELO_NAME=
+
+## SMTP debugging
+## When set to true this will output very detailed SMTP messages.
+## WARNING: This could contain sensitive information like passwords and usernames! Only enable this during troubleshooting!
+# SMTP_DEBUG=false
+
+## Accept Invalid Hostnames
+## DANGEROUS: This option introduces significant vulnerabilities to man-in-the-middle attacks!
+## Only use this as a last resort if you are not able to use a valid certificate.
+# SMTP_ACCEPT_INVALID_HOSTNAMES=false
+
+## Accept Invalid Certificates
+## DANGEROUS: This option introduces significant vulnerabilities to man-in-the-middle attacks!
+## Only use this as a last resort if you are not able to use a valid certificate.
+## If the Certificate is valid but the hostname doesn't match, please use SMTP_ACCEPT_INVALID_HOSTNAMES instead.
+# SMTP_ACCEPT_INVALID_CERTS=false
+
+## Require new device emails. When a user logs in an email is required to be sent.
+## If sending the email fails the login attempt will fail!!
+# REQUIRE_DEVICE_EMAIL=false
+
+## HIBP Api Key
+## HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
+# HIBP_API_KEY=
+
+# vim: syntax=ini

states/roles/maintain/saltmaster/init.sls

@@ -1,5 +1,4 @@
 {%- set os=grains['os'] -%}
-
 salt-master:
 {%- if os=="CentOS" or os=="RedHat" %}
   pkg.installed: []
@@ -19,6 +18,7 @@ salt-master:
     - user: root
     - group: root
     - mode: 644
+    - template: jinja
 
 /srv/salt/prod/states/pillars:
   file.symlink:

states/roles/maintain/saltmaster/master

@@ -422,12 +422,14 @@ state_output: terse
 #     - /srv/salt/prod/states
 #
 file_roots:
-  base:
+{%- if pillar['branches'] is defined -%}
-    - /srv/salt/prod/states
+{%- if pillar['branches']['saltmaster'] is defined -%}
-  prod:
+{%- for branch in pillar['branches']['saltmaster'] %}
-    - /srv/salt/prod/states
+  {{branch}}:
-  dev:
+    - /srv/salt/{{branch}}/states
-    - /srv/salt/dev/states
+{%- endfor %}
+{%- endif %}
+{%- endif %}
 #
 
 # When using multiple environments, each with their own top file, the
@@ -439,7 +441,15 @@ file_roots:
 # To specify the order in which environments are merged, set the ordering
 # in the env_order option. Given a conflict, the last matching value will
 # win.
-env_order: ['base', 'dev', 'prod']
+{% if pillar['branches'] is defined -%}
+{%- if pillar['branches']['saltmaster'] is defined -%}
+env_order: [
+{%- for branch in pillar['branches']['saltmaster'] -%}
+  '{{-branch}}',
+{%- endfor -%}
+'null']
+{%- endif %}
+{%- endif %}
 
 # If top_file_merging_strategy is set to 'same' and an environment does not
 # contain a top file, the top file in the environment specified by default_top
@@ -560,12 +570,14 @@ hash_type: sha256
 #    - /srv/pillar
 #
 pillar_roots:
-  base:
+{%- if pillar['branches'] is defined -%}
-    - /srv/salt/prod/pillars
+{%- if pillar['branches']['saltmaster'] is defined -%}
-  prod:
+{%- for branch in pillar['branches']['saltmaster'] %}
-    - /srv/salt/prod/pillars
+  {{branch}}:
-  dev:
+    - /srv/salt/{{branch}}/pillars
-    - /srv/salt/dev/pillars
+{%- endfor %}
+{%- endif %}
+{%- endif %}
 #
 #ext_pillar:
 #  - hiera: /etc/hiera.yaml

states/test

@@ -0,0 +1,18 @@
+{%- set branches=salt.cmd.shell('git ls-remote https://git.actcur.com/actcur/salt.git | grep -o -P "(?<=refs/heads/).*" | grep -Pv "(^temp$)|(^history$)"').split('\n') -%}
+branches:
+  saltmaster:
+{%- for branch in branches %}
+    - {{branch}}
+{%- endfor %}
+
+git:
+{%- for branch in branches %}
+  salt_{{branch}}:
+    repo: "ssh://gitea@git.actcur.com:5022/actcur/salt.git"
+    path: "/srv/salt/{{branch}}"
+    branch: "{{branch}}"
+    key: "git_actcur"
+    force: {{ "True" if branch == "prod" else "false" }}
+    email: "actcur@actcur.com"
+    name: "Actaeus Curabitur"
+{%- endfor %}

states/test.sls

@@ -0,0 +1,4 @@
+/test:
+  file.managed:
+    - source: salt://test
+    - template: jinja

states/top.sls

@@ -1,6 +1,10 @@
 
 {%- set states = salt['cp.list_states'](saltenv) -%}
-{%- set envs = ['prod','dev'] -%}
+{%- if pillar['branches'] is defined -%}
+{%- if pillar['branches']['saltmaster'] is defined -%}
+{%- set envs = pillar['branches']['saltmaster'] -%}
+{%- endif -%}
+{%- endif -%}
 {% for env in envs %}
 {{ env }}:
   'os_family:RedHat':