{"id":19049985,"url":"https://github.com/everlag/salt-fun","last_synced_at":"2026-03-04T14:02:25.331Z","repository":{"id":78566862,"uuid":"413262717","full_name":"Everlag/salt-fun","owner":"Everlag","description":null,"archived":false,"fork":false,"pushed_at":"2021-10-04T03:34:53.000Z","size":11253,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-22T00:25:21.208Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Everlag.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-04T03:33:06.000Z","updated_at":"2021-10-04T03:34:55.000Z","dependencies_parsed_at":"2023-03-27T23:17:56.751Z","dependency_job_id":null,"html_url":"https://github.com/Everlag/salt-fun","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Everlag/salt-fun","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Everlag%2Fsalt-fun","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Everlag%2Fsalt-fun/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Everlag%2Fsalt-fun/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Everlag%2Fsalt-fun/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Everlag","download_url":"https://codeload.github.com/Everlag/salt-fun/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Everlag%2Fsalt-fun/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":284045913,"owners_count":26938122,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-12T02:00:06.336Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T23:12:30.465Z","updated_at":"2025-11-12T14:02:02.642Z","avatar_url":"https://github.com/Everlag.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"# nebula salt\n\nBasic configuration for booting up a salt master that has minions communicate exclusively over [nebula](https://github.com/slackhq/nebula).\n\nBootstrapping a minion over nebula and then having it communicate over nebula lets the salt-master not be exposed to the public internet, or at least ensures there's a NAT that prevents it from receiving unexpected inbound connections.\n\n## Setup\n\nSetup is fairly adhoc, especially setting up the master. In the future, this could be improved.\n\nSome binaries are checked into the repo to make this flow a bit easier. You can always grab the latest from the latest nebula release on github .\n\n### nebula\n\nFollow the nebula quickstart guide in the readme. Note that `ca.crt` should be everywhere and `ca.key` is extremely sensitive.\n\n### Master\n\nNote that all salt entries containing GPG encrypted data will need to be regenerated. `grep -r PGP` should find everything, typically nebula certificates that need to get reissused using your CA.\n\n1. (working within `master-config`)\n1. copy master to /etc/master\n1. `sudo apt install salt-master`\n1. run nebula on master: `sudo nebula -config config.yml` (optionally, configure as a service)\n1. Put `salt` directory in /srv/salt\n1. Generate gpg keys: (from https://r-pufky.github.io/docs/configuration-management/saltstack/salt-master/gpg.html)\n    - mkdir -p /etc/salt/gpgkeys\n    - chmod 0700 /etc/salt/gpgkeys\n    - gpg --gen-key --homedir /etc/salt/gpgkeys\n    - gpg --homedir /etc/salt/gpgkeys --armor --export \u003e salty_public_key.gpg\n1. Restart master: `sudo systemctl restart salt-master.service`\n1. Make sure master is happy: `sudo systemctl status salt-master.service`\n\n### Minions\n\n1. (working within `minion-bootstrap`)\n1. Boot up a minion with a reasonably new debian base image(bullseye known to work well)\n1. Issue certs and copy data using `pre-bootstrap.sh`\n    - ie, `./pre-bootstrap.sh 100 kyle@192.168.100.9 20`\n    - (first numerical argument is temporary index in network; second numerical argument is permanent, post-highstate, index in network)\n    - Note that this issues two flavors of credentials, temporary and permanent. If you wanted to use group-based firewalls, which nebula supports in `config.yml`, you could easily restrict the groups of either certificate.\n1. Include cert and ENCRYPTED key in nebula pillar init.sls with the hostname matching the planned hostname.\n    - ie, `cat permanent.key | gpg --homedir /etc/salt/gpgkeys --armor --batch --trust-model always --encrypt -r \"master\" \u003e enc`\n1. ssh into minion node and run `bootstrap.sh`\n    - follow instructions, which includes accepting the key on the master; find the unaccepted key with `salt-key -l all` then accept it `salt-key -a $HOSTNAME`\n    - you may have to run the bootstrap script twice as the minion may died on us.\n\nAt this point your minion should be up and communicating with salt via nebula.\n\n## Troubleshooting\n\n### salt failing to decrypt gpg\n\nDump the salt master logs using journalctl and see the lines where it says it failed to decrypt, look at the end of the line past the full PGP message.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feverlag%2Fsalt-fun","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feverlag%2Fsalt-fun","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feverlag%2Fsalt-fun/lists"}