{"id":19234557,"url":"https://github.com/smitelli/salt","last_synced_at":"2026-02-25T20:02:11.233Z","repository":{"id":54158231,"uuid":"155935989","full_name":"smitelli/salt","owner":"smitelli","description":"The Salt states that underpin... well... pretty much everything.","archived":false,"fork":false,"pushed_at":"2024-09-12T16:47:53.000Z","size":835,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-09-13T05:47:51.221Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"SaltStack","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/smitelli.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-11-03T00:39:39.000Z","updated_at":"2024-09-12T16:47:56.000Z","dependencies_parsed_at":"2023-01-23T06:00:11.408Z","dependency_job_id":"9fe4edde-240a-4774-ab6d-676abd31348c","html_url":"https://github.com/smitelli/salt","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smitelli%2Fsalt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smitelli%2Fsalt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smitelli%2Fsalt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smitelli%2Fsalt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/smitelli","download_url":"https://codeload.github.com/smitelli/salt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223849217,"owners_count":17213640,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T16:14:17.016Z","updated_at":"2026-02-25T20:02:06.198Z","avatar_url":"https://github.com/smitelli.png","language":"SaltStack","funding_links":[],"categories":[],"sub_categories":[],"readme":"Salt\n====\n\nThe Salt states that underpin... well... pretty much everything.\n\nby [Scott Smitelli](mailto:scott@smitelli.com)\n\nYe Olde Quicke Starte\n=====================\n\nAll the below commands assume the user is already root.\n\n```bash\nhostnamectl set-hostname hostname.fqdn.com\nreboot\n\ncd $(mktemp -d)\ncurl -o bootstrap-salt.sh -L https://bootstrap.saltproject.io\nsh bootstrap-salt.sh -X -F -c /tmp\n\n# https://github.com/saltstack/salt-bootstrap/issues/1933\napt-get install build-essential libmariadb-dev\nsalt-pip install mysqlclient\n\nmkdir -p /etc/salt/gpgkeys /srv/salt\n# install {pub,sec}ring.gpg into /etc/salt/gpgkeys/\n# install ./ into /srv/salt/\ncp /srv/salt/states/salt/files/minion.conf /etc/salt/minion.d/00-minion.conf\nsalt-call --log-level=info --local state.apply\n```\n\n### Using the Vagrant environment:\n\n```bash\nvagrant up\n```\n\nThat's really all there is to it. By default no interesting states/pillars are\nloaded, the GPG keys are missing, and the guest VM doesn't do anything useful.\nPresumably you know what you want to do and how to accomplish it.\n\nThe Vagrantfile uses port 80 on the host for the guest's web server, which some\nhost OSes may not like.\n\n### Run states:\n\n```bash\nsudo salt-call --local state.apply\n```\n\n### Meaningful data may be stored in any of the following locations:\n\n* /etc/letsencrypt\n* /var/lib/awstats\n* /var/lib/myautodump2\n* /var/lib/mysql\n* /var/opt/website\n\n### Create a brand-new key pair (this requires redoing all the pillar encryption):\n\n```bash\ngpg --homedir /etc/salt/gpgkeys --gen-key\n```\n\n* Key type: RSA and RSA\n* Key size: 4096\n* Key is valid for: 0 (does not expire)\n* Real name: salt@smitelli.com\n* Email address: salt@smitelli.com\n* Comment: [empty]\n* Passphrase: [empty]\n\n### Encode a secret (make *sure* you consider if you want or don't want `-n`):\n\n```bash\necho -n 'SECRET' | sudo gpg --homedir /etc/salt/gpgkeys --armor --batch --trust-model always --encrypt -r salt@smitelli.com\n```\n\n### Create an /etc/shadow password hash:\n\n```bash\nopenssl passwd -1  # MD5\nopenssl passwd -6  # SHA-512\n```\n\n### Create SSH keypairs:\n\n```bash\nssh-keygen -o -t ed25519 -f ...\nssh-keygen -o -t rsa -b 2048 -f ...\nssh-keygen -o -t ecdsa -b 521 -f ...\n```\n\n### TODOs:\n\n* Content-Security-Policy and Feature-Policy for each website\n* Go through EVERY SINGLE include and requisite to make sure states are atomic\n* Check that each website works in isolation\n* icinga2: https://blog.sleeplessbeastie.eu/2018/01/15/how-to-install-icinga2-and-icingaweb2/\n* ...or NetData: https://www.netdata.cloud/\n* gallery throws deprecation warnings on install\n* TnF smarty version has a deprecation warning\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmitelli%2Fsalt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsmitelli%2Fsalt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmitelli%2Fsalt/lists"}