{"id":14965353,"url":"https://github.com/creativecommons/sre-salt-prime","last_synced_at":"2025-10-25T11:31:28.046Z","repository":{"id":38445523,"uuid":"158455678","full_name":"creativecommons/sre-salt-prime","owner":"creativecommons","description":"Site Reliability Engineering / DevOps SaltStack configuration files","archived":false,"fork":false,"pushed_at":"2025-01-28T17:54:54.000Z","size":2109,"stargazers_count":22,"open_issues_count":6,"forks_count":10,"subscribers_count":10,"default_branch":"main","last_synced_at":"2025-01-28T18:32:08.022Z","etag":null,"topics":["aws","git-crypt","saltstack"],"latest_commit_sha":null,"homepage":"","language":"SaltStack","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/creativecommons.png","metadata":{"funding":{"github":["creativecommons"],"custom":["https://creativecommons.org/donate"]},"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-11-20T21:50:33.000Z","updated_at":"2024-12-09T16:29:27.000Z","dependencies_parsed_at":"2023-12-20T07:18:30.375Z","dependency_job_id":"d5331781-ff1d-402a-b92e-7383c1204589","html_url":"https://github.com/creativecommons/sre-salt-prime","commit_stats":{"total_commits":1126,"total_committers":10,"mean_commits":112.6,"dds":"0.11545293072824159","last_synced_commit":"49ebab4acf80f415d6005f3c9941124f6e4dba60"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/creativecommons%2Fsre-salt-prime","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/creativecommons%2Fsre-salt-prime/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/creativecommons%2Fsre-salt-prime/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/creativecommons%2Fsre-salt-prime/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/creativecommons","download_url":"https://codeload.github.com/creativecommons/sre-salt-prime/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238128553,"owners_count":19421053,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","git-crypt","saltstack"],"created_at":"2024-09-24T13:34:37.966Z","updated_at":"2025-10-25T11:31:28.041Z","avatar_url":"https://github.com/creativecommons.png","language":"SaltStack","funding_links":["https://github.com/sponsors/creativecommons","https://creativecommons.org/donate"],"categories":[],"sub_categories":[],"readme":"# sre-salt-prime\n\nSite Reliability Engineering / DevOps SaltStack configuration files\n\n\n## Code of Conduct\n\n[`CODE_OF_CONDUCT.md`][org-coc]:\n\u003e The Creative Commons team is committed to fostering a welcoming community.\n\u003e This project and all other Creative Commons open source projects are governed\n\u003e by our [Code of Conduct][code_of_conduct]. Please report unacceptable\n\u003e behavior to [conduct@creativecommons.org](mailto:conduct@creativecommons.org)\n\u003e per our [reporting guidelines][reporting_guide].\n\n[org-coc]: https://github.com/creativecommons/.github/blob/main/CODE_OF_CONDUCT.md\n[code_of_conduct]: https://opensource.creativecommons.org/community/code-of-conduct/\n[reporting_guide]: https://opensource.creativecommons.org/community/code-of-conduct/enforcement/\n\n\n## Contributing\n\nSee [`CONTRIBUTING.md`][org-contrib].\n\n[org-contrib]: https://github.com/creativecommons/.github/blob/main/CONTRIBUTING.md\n\n\n## Development Notes\n\n- **Avoid insecure repository clones:** This repository includes encrypted\n  secrets. Do not run `git-crypt unlock` on clones that are not otherwise\n  secured (ex. strong login password, disk encryption).\n- **Avoid editing the base environment:** The base environment is configured to\n  prevent commit and push actions. Please use your development environment and\n  pull the changes to base.\n- **Sign your commits:**\n  - The commit signing option has been adjusted in the repository to facilitate \n   smoother collaboration. This modification is intended to ease the contribution \n   process. However, it is strongly encourged that staff members continue to \n   adhere to best practices by using GPG for all signed commits, ensuring the \n   security and integrity of the project.\n\n    - [About required commit signing - User Documentation][signing]\n\n  - Ensure you are using `RemoteForward` in your SSH configuration to forward\n    your GnuPG agent to `salt-prime` (see the example configuration, under\n    [Setup](#Setup), below).\n  - Ensure you have configured your newly cloned repository to sign commits\n    (see the `git config` command, under [Setup](#Setup), below).\n\n[signing]:https://help.github.com/articles/about-required-commit-signing/\n\n\n### Setup\n\n- **SSH connection information:** example local/laptop `~/.ssh/config`\n  configugration:\n    ```\n    Host bastion-us-east-2\n        HostName bastion-us-east-2.creativecommons.org\n        User ARTHUR\n\n    Host salt-prime\n        HostName 10.22.11.11\n        ProxyJump bastion-us-east-2\n        RemoteForward /run/user/4242/gnupg/S.gpg-agent /Users/ARTHUR/.gnupg/S.gpg-agent.extra\n        User ARTHUR\n\n    Host *\n        ServerAliveCountMax 60\n        ServerAliveInterval 30\n        TCPKeepAlive no\n    ```\n    - Assumes remote username ARTHUR and remote uid 4242. Replace these values\n      in your own local/laptop configuration.\n    - ProxyJump allows you to `ssh salt-prime` from your local/laptop.\n    - RemoteForward allows you to sign your commits.\n- **Setup your development repository** on `salt-prime`:\n  1. Clone repository to `/srv` with your username. For example:\n        ```shell\n        cd /srv\n        git clone git@github.com:creativecommons/sre-salt-prime.git ${USER}\n        ```\n  2. Setup your newly cloned repository.\n     1. Configure commit signing:\n        ```shell\n        cd /srv/${USER}\n        git config user.email YOUR_EMAIL\n        git config user.signingkey YOUR_GPG_ID\n        git config commit.gpgsign true\n        ```\n     1. Unlock encrypted secrets:\n        ```shell\n        cd /srv/${USER}\n        git-crypt unlock\n        ```\n  3. Specify the environment when you test changes. For example:\n        ```shell\n        sudo salt \\* state.highstate saltenv=${USER} test=True\n        ```\n     - use `--state-verbose=True` to see successes\n     - use `--state-output=full_id` to see full detail of successes\n     - use `--log-level=debug --log-file-level=warning` to see debug messages\n       (without logging those debug messages, which may contain secrets, to the\n       log file)\n\n\n### Goals\n\n- Use AWS well, but avoid technologies that create AWS lock-in (ex. Confidant)\n- Salt Prime must not contain any exclusive data (use Git)\n- Git repository must not contain any unencrypted secrets\n- Git repository commits must be signed and applied to the main branch via\n  Pull Requests\n- A compromised minion must not be able to escalate access\n  - SysAdmins must not forward their SSH agent\n  - Must not reuse application passwords (ex. Prod and Dev databases must have\n    different passwords)\n  - Pillar data must be restricted by Minion ID based classification\n    - *The only grain which can be safely used is `grains['id']` which contains\n      the Minion ID.* ([FAQ Q.21][FAQ21])\n\n[FAQ21]: https://docs.saltstack.com/en/latest/faq.html#is-targeting-using-grain-data-secure\n\n\n### Decisions\n\n- Amazon Web Services (AWS)\n  - Creative Commons is already using it and staff are familiar with it\n  - Features allow security (ex. screened subnets, security groups policies)\n  - Features allows Infrastructure as Code\n  - `us-east-2`\n    - cost effective\n    - avoid conflict/collision over region limited resources (ex. ElasticIPs)\n- Debian 11 (Bullseye), Debian 10 (Buster), and Debian 9 (Stretch)\n  - Free/Open Source\n  - Debian Stable\n  - Creative Commons is already using it and staff are familiar with it\n- [git-crypt][gitcrypt] - transparent file encryption in git\n  - Free/Open Source\n  - Performance: files are decrypted in the checked out repository\n  - Security: automatic encryption and directory based filters minimize the\n    chance of unencrypted secrets being pushed to GitHub\n- SaltStack\n  - Free/Open Source\n  - Performance\n  - Creative Commons is already using it and staff are familiar with it\n  - Version: `3007.3`\n    - For current targeted minion version, see `minion_target_version` in\n      [`pillars/salt/init.sls`](pillars/salt/init.sls)\n\n[gitcrypt]: https://www.agwa.name/projects/git-crypt/\n\n\n## Host Classification\n\nMinions are added and configured from `salt-prime` with the following Minion ID\nschema: **`HST__POD__LOC`** (host/role__pod/group__location). These variables\nare used to determine the state and pillar data.\n\nShow top states example command:\n```\nsudo salt \\* pillar.item states saltenv=${USER}\n```\n\nSee [`docs/Host_Classification.md`](docs/Host_Classification.md) for details.\n\n\n## Orchestration\n\nSee [`docs/Orchestration.md`](docs/Orchestration.md).\n\n\n## References\n\n\n### SaltStack\n\n- For the SaltStack version that this repository is developed on, see\n  [Decisions](#Decisions), above.\n- This repository attempts to tracks the most current release of SaltStack in\n  the SaltStack Debian repository: https://repo.saltstack.com/apt/debian/\n- For current version of SaltStack in Debian proper, see [Debian -- Package\n  Search Results -- salt-master][pkgsearch]\n\n[pkgsearch]: https://packages.debian.org/search?suite=default\u0026section=all\u0026arch=any\u0026searchon=names\u0026keywords=salt-master\n\n\n####  Best Practices\n\n- [Hardening Salt][hardensalt]\n  - *The only grain which can be safely used is `grains['id']` which contains\n    the Minion ID.* ([FAQ Q.21][FAQ21])\n- [Salt Best Practices][saltbest]\n- [Salt Formulas][saltformulas]\n\n[hardensalt]: https://docs.saltstack.com/en/latest/topics/hardening.html\n[saltbest]: https://docs.saltstack.com/en/latest/topics/best_practices.html\n[saltformulas]: https://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html\n\n\n#### Frequently Referenced Documentation\n\n- [Salt Module Reference][moduleref]\n  - [state modules][statemodules]\n- [Requisites and Other Global State Arguments][requisites]\n\n[moduleref]: https://docs.saltstack.com/en/latest/ref/index.html\n[statemodules]: https://docs.saltstack.com/en/latest/ref/states/all/index.html\n[requisites]: https://docs.saltstack.com/en/latest/ref/states/requisites.html\n\n\n## Repository Documentation\n\n- [`README.md`](README.md)\n- [`bootstrap-aws/README.md`](bootstrap-aws/README.md)\n- `docs/`\n  - [`Host_Classification.md`](docs/Host_Classification.md)\n  - [`Orchestration.md`](docs/Orchestration.md)\n  - [`WordPress.md`](docs/WordPress.md)\n\n\n## Formula Repositories\n\n- [saltstack-formulas/mysql-formula][mysql-formula]: Install the MySQL client\n  and/or server\n- [saltstack-formulas/php-formula][php-formula]: Formula to set up and\n  configure php\n\n[mysql-formula]: https://github.com/saltstack-formulas/mysql-formula\n[php-formula]: https://github.com/saltstack-formulas/php-formula\n\n\n## License\n\n- [`LICENSE`](LICENSE) (Expat/[MIT][mit] License)\n\n[mit]: http://www.opensource.org/licenses/MIT \"The MIT License | Open Source Initiative\"\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcreativecommons%2Fsre-salt-prime","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcreativecommons%2Fsre-salt-prime","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcreativecommons%2Fsre-salt-prime/lists"}