.

cockpit/init.sls

@@ -0,0 +1,13 @@
+Install cockpit packages:
+  pkg.installed:
+    - pkgs:
+      - cockpit
+      - cockpit-podman
+
+
+Start cockpit:
+  service.running:
+    - name: cockpit
+    - enable: True
+    - watch:
+      - pkg: Install cockpit packages

dnsmasq/files/dnsmasq.conf

@@ -0,0 +1,686 @@
+# Configuration file for dnsmasq.
+#
+# Format is one option per line, legal options are the same
+# as the long options legal on the command line. See
+# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.
+
+# Accept DNS queries only from hosts whose address is on a local
+# subnet, ie a subnet for which an interface exists on the server.
+# It is intended to be set as a default on installation, to allow
+# unconfigured installations to be useful but also safe from being
+# used for DNS amplification attacks.
+#local-service
+
+# Listen on this specific port instead of the standard DNS port
+# (53). Setting this to zero completely disables DNS function,
+# leaving only DHCP and/or TFTP.
+#port=5353
+
+# The following two options make you a better netizen, since they
+# tell dnsmasq to filter out queries which the public DNS cannot
+# answer, and which load the servers (especially the root servers)
+# unnecessarily. If you have a dial-on-demand link they also stop
+# these requests from bringing up the link unnecessarily.
+
+# Never forward plain names (without a dot or domain part)
+#domain-needed
+# Never forward addresses in the non-routed address spaces.
+#bogus-priv
+
+# Uncomment these to enable DNSSEC validation and caching:
+# (Requires dnsmasq to be built with DNSSEC option.)
+#conf-file=/etc/dnsmasq.d/trust-anchors.conf
+#dnssec
+
+# Replies which are not DNSSEC signed may be legitimate, because the domain
+# is unsigned, or may be forgeries. Setting this option tells dnsmasq to
+# check that an unsigned reply is OK, by finding a secure proof that a DS 
+# record somewhere between the root and the domain does not exist. 
+# The cost of setting this is that even queries in unsigned domains will need
+# one or more extra DNS queries to verify.
+#dnssec-check-unsigned
+
+# Uncomment this to filter useless windows-originated DNS requests
+# which can trigger dial-on-demand links needlessly.
+# Note that (amongst other things) this blocks all SRV requests,
+# so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk.
+# This option only affects forwarding, SRV records originating for
+# dnsmasq (via srv-host= lines) are not suppressed by it.
+#filterwin2k
+
+# Change this line if you want dns to get its upstream servers from
+# somewhere other that /etc/resolv.conf
+#resolv-file=
+
+# By  default,  dnsmasq  will  send queries to any of the upstream
+# servers it knows about and tries to favour servers to are  known
+# to  be  up.  Uncommenting this forces dnsmasq to try each query
+# with  each  server  strictly  in  the  order  they   appear   in
+# /etc/resolv.conf
+#strict-order
+
+# If you don't want dnsmasq to read /etc/resolv.conf or any other
+# file, getting its servers from this file instead (see below), then
+# uncomment this.
+#no-resolv
+
+# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv
+# files for changes and re-read them then uncomment this.
+#no-poll
+
+# Add other name servers here, with domain specs if they are for
+# non-public domains.
+#server=/localnet/192.168.0.1
+
+# Example of routing PTR queries to nameservers: this will send all
+# address->name queries for 192.168.3/24 to nameserver 10.1.2.3
+#server=/3.168.192.in-addr.arpa/10.1.2.3
+
+# Add local-only domains here, queries in these domains are answered
+# from /etc/hosts or DHCP only.
+#local=/localnet/
+
+# Add domains which you want to force to an IP address here.
+# The example below send any host in double-click.net to a local
+# web-server.
+#address=/double-click.net/127.0.0.1
+
+# --address (and --server) work with IPv6 addresses too.
+#address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83
+
+# Add the IPs of all queries to yahoo.com, google.com, and their
+# subdomains to the vpn and search ipsets:
+#ipset=/yahoo.com/google.com/vpn,search
+
+# You can control how dnsmasq talks to a server: this forces
+# queries to 10.1.2.3 to be routed via eth1
+# server=10.1.2.3@eth1
+
+# and this sets the source (ie local) address used to talk to
+# 10.1.2.3 to 192.168.1.1 port 55 (there must be an interface with that
+# IP on the machine, obviously).
+# server=10.1.2.3@192.168.1.1#55
+
+# If you want dnsmasq to change uid and gid to something other
+# than the default, edit the following lines.
+#user=
+#group=
+
+# If you want dnsmasq to listen for DHCP and DNS requests only on
+# specified interfaces (and the loopback) give the name of the
+# interface (eg eth0) here.
+# Repeat the line for more than one interface.
+#interface=
+# Or you can specify which interface _not_ to listen on
+#except-interface=
+# Or which to listen on by address (remember to include 127.0.0.1 if
+# you use this.)
+#listen-address=
+# If you want dnsmasq to provide only DNS service on an interface,
+# configure it as shown above, and then use the following line to
+# disable DHCP and TFTP on it.
+#no-dhcp-interface=
+
+# On systems which support it, dnsmasq binds the wildcard address,
+# even when it is listening on only some interfaces. It then discards
+# requests that it shouldn't reply to. This has the advantage of
+# working even when interfaces come and go and change address. If you
+# want dnsmasq to really bind only the interfaces it is listening on,
+# uncomment this option. About the only time you may need this is when
+# running another nameserver on the same machine.
+#bind-interfaces
+
+# If you don't want dnsmasq to read /etc/hosts, uncomment the
+# following line.
+#no-hosts
+# or if you want it to read another file, as well as /etc/hosts, use
+# this.
+#addn-hosts=/etc/banner_add_hosts
+
+# Set this (and domain: see below) if you want to have a domain
+# automatically added to simple names in a hosts-file.
+#expand-hosts
+
+# Set the domain for dnsmasq. this is optional, but if it is set, it
+# does the following things.
+# 1) Allows DHCP hosts to have fully qualified domain names, as long
+#     as the domain part matches this setting.
+# 2) Sets the "domain" DHCP option thereby potentially setting the
+#    domain of all systems configured by DHCP
+# 3) Provides the domain part for "expand-hosts"
+#domain=thekelleys.org.uk
+
+# Set a different domain for a particular subnet
+#domain=wireless.thekelleys.org.uk,192.168.2.0/24
+
+# Same idea, but range rather then subnet
+#domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200
+
+# Uncomment this to enable the integrated DHCP server, you need
+# to supply the range of addresses available for lease and optionally
+# a lease time. If you have more than one network, you will need to
+# repeat this for each network on which you want to supply DHCP
+# service.
+#dhcp-range=192.168.0.50,192.168.0.150,12h
+
+# This is an example of a DHCP range where the netmask is given. This
+# is needed for networks we reach the dnsmasq DHCP server via a relay
+# agent. If you don't know what a DHCP relay agent is, you probably
+# don't need to worry about this.
+#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h
+
+# This is an example of a DHCP range which sets a tag, so that
+# some DHCP options may be set only for this network.
+#dhcp-range=set:red,192.168.0.50,192.168.0.150
+
+# Use this DHCP range only when the tag "green" is set.
+#dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h
+
+# Specify a subnet which can't be used for dynamic address allocation,
+# is available for hosts with matching --dhcp-host lines. Note that
+# dhcp-host declarations will be ignored unless there is a dhcp-range
+# of some type for the subnet in question.
+# In this case the netmask is implied (it comes from the network
+# configuration on the machine running dnsmasq) it is possible to give
+# an explicit netmask instead.
+#dhcp-range=192.168.0.0,static
+
+# Enable DHCPv6. Note that the prefix-length does not need to be specified
+# and defaults to 64 if missing/
+#dhcp-range=1234::2, 1234::500, 64, 12h
+
+# Do Router Advertisements, BUT NOT DHCP for this subnet.
+#dhcp-range=1234::, ra-only 
+
+# Do Router Advertisements, BUT NOT DHCP for this subnet, also try and
+# add names to the DNS for the IPv6 address of SLAAC-configured dual-stack 
+# hosts. Use the DHCPv4 lease to derive the name, network segment and 
+# MAC address and assume that the host will also have an
+# IPv6 address calculated using the SLAAC algorithm.
+#dhcp-range=1234::, ra-names
+
+# Do Router Advertisements, BUT NOT DHCP for this subnet.
+# Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.)
+#dhcp-range=1234::, ra-only, 48h
+
+# Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA
+# so that clients can use SLAAC addresses as well as DHCP ones.
+#dhcp-range=1234::2, 1234::500, slaac
+
+# Do Router Advertisements and stateless DHCP for this subnet. Clients will
+# not get addresses from DHCP, but they will get other configuration information.
+# They will use SLAAC for addresses.
+#dhcp-range=1234::, ra-stateless
+
+# Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses
+# from DHCPv4 leases.
+#dhcp-range=1234::, ra-stateless, ra-names
+
+# Do router advertisements for all subnets where we're doing DHCPv6
+# Unless overridden by ra-stateless, ra-names, et al, the router 
+# advertisements will have the M and O bits set, so that the clients
+# get addresses and configuration from DHCPv6, and the A bit reset, so the 
+# clients don't use SLAAC addresses.
+#enable-ra
+
+# Supply parameters for specified hosts using DHCP. There are lots
+# of valid alternatives, so we will give examples of each. Note that
+# IP addresses DO NOT have to be in the range given above, they just
+# need to be on the same network. The order of the parameters in these
+# do not matter, it's permissible to give name, address and MAC in any
+# order.
+
+# Always allocate the host with Ethernet address 11:22:33:44:55:66
+# The IP address 192.168.0.60
+#dhcp-host=11:22:33:44:55:66,192.168.0.60
+
+# Always set the name of the host with hardware address
+# 11:22:33:44:55:66 to be "fred"
+#dhcp-host=11:22:33:44:55:66,fred
+
+# Always give the host with Ethernet address 11:22:33:44:55:66
+# the name fred and IP address 192.168.0.60 and lease time 45 minutes
+#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m
+
+# Give a host with Ethernet address 11:22:33:44:55:66 or
+# 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume
+# that these two Ethernet interfaces will never be in use at the same
+# time, and give the IP address to the second, even if it is already
+# in use by the first. Useful for laptops with wired and wireless
+# addresses.
+#dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60
+
+# Give the machine which says its name is "bert" IP address
+# 192.168.0.70 and an infinite lease
+#dhcp-host=bert,192.168.0.70,infinite
+
+# Always give the host with client identifier 01:02:02:04
+# the IP address 192.168.0.60
+#dhcp-host=id:01:02:02:04,192.168.0.60
+
+# Always give the InfiniBand interface with hardware address
+# 80:00:00:48:fe:80:00:00:00:00:00:00:f4:52:14:03:00:28:05:81 the
+# ip address 192.168.0.61. The client id is derived from the prefix
+# ff:00:00:00:00:00:02:00:00:02:c9:00 and the last 8 pairs of
+# hex digits of the hardware address.
+#dhcp-host=id:ff:00:00:00:00:00:02:00:00:02:c9:00:f4:52:14:03:00:28:05:81,192.168.0.61
+
+# Always give the host with client identifier "marjorie"
+# the IP address 192.168.0.60
+#dhcp-host=id:marjorie,192.168.0.60
+
+# Enable the address given for "judge" in /etc/hosts
+# to be given to a machine presenting the name "judge" when
+# it asks for a DHCP lease.
+#dhcp-host=judge
+
+# Never offer DHCP service to a machine whose Ethernet
+# address is 11:22:33:44:55:66
+#dhcp-host=11:22:33:44:55:66,ignore
+
+# Ignore any client-id presented by the machine with Ethernet
+# address 11:22:33:44:55:66. This is useful to prevent a machine
+# being treated differently when running under different OS's or
+# between PXE boot and OS boot.
+#dhcp-host=11:22:33:44:55:66,id:*
+
+# Send extra options which are tagged as "red" to
+# the machine with Ethernet address 11:22:33:44:55:66
+#dhcp-host=11:22:33:44:55:66,set:red
+
+# Send extra options which are tagged as "red" to
+# any machine with Ethernet address starting 11:22:33:
+#dhcp-host=11:22:33:*:*:*,set:red
+
+# Give a fixed IPv6 address and name to client with 
+# DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2
+# Note the MAC addresses CANNOT be used to identify DHCPv6 clients.
+# Note also that the [] around the IPv6 address are obligatory.
+#dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5] 
+
+# Ignore any clients which are not specified in dhcp-host lines
+# or /etc/ethers. Equivalent to ISC "deny unknown-clients".
+# This relies on the special "known" tag which is set when
+# a host is matched.
+#dhcp-ignore=tag:!known
+
+# Send extra options which are tagged as "red" to any machine whose
+# DHCP vendorclass string includes the substring "Linux"
+#dhcp-vendorclass=set:red,Linux
+
+# Send extra options which are tagged as "red" to any machine one
+# of whose DHCP userclass strings includes the substring "accounts"
+#dhcp-userclass=set:red,accounts
+
+# Send extra options which are tagged as "red" to any machine whose
+# MAC address matches the pattern.
+#dhcp-mac=set:red,00:60:8C:*:*:*
+
+# If this line is uncommented, dnsmasq will read /etc/ethers and act
+# on the ethernet-address/IP pairs found there just as if they had
+# been given as --dhcp-host options. Useful if you keep
+# MAC-address/host mappings there for other purposes.
+#read-ethers
+
+# Send options to hosts which ask for a DHCP lease.
+# See RFC 2132 for details of available options.
+# Common options can be given to dnsmasq by name:
+# run "dnsmasq --help dhcp" to get a list.
+# Note that all the common settings, such as netmask and
+# broadcast address, DNS server and default route, are given
+# sane defaults by dnsmasq. You very likely will not need
+# any dhcp-options. If you use Windows clients and Samba, there
+# are some options which are recommended, they are detailed at the
+# end of this section.
+
+# Override the default route supplied by dnsmasq, which assumes the
+# router is the same machine as the one running dnsmasq.
+#dhcp-option=3,1.2.3.4
+
+# Do the same thing, but using the option name
+#dhcp-option=option:router,1.2.3.4
+
+# Override the default route supplied by dnsmasq and send no default
+# route at all. Note that this only works for the options sent by
+# default (1, 3, 6, 12, 28) the same line will send a zero-length option
+# for all other option numbers.
+#dhcp-option=3
+
+# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5
+#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
+
+# Send DHCPv6 option. Note [] around IPv6 addresses.
+#dhcp-option=option6:dns-server,[1234::77],[1234::88]
+
+# Send DHCPv6 option for namservers as the machine running 
+# dnsmasq and another.
+#dhcp-option=option6:dns-server,[::],[1234::88]
+
+# Ask client to poll for option changes every six hours. (RFC4242)
+#dhcp-option=option6:information-refresh-time,6h
+
+# Set option 58 client renewal time (T1). Defaults to half of the
+# lease time if not specified. (RFC2132)
+#dhcp-option=option:T1,1m
+
+# Set option 59 rebinding time (T2). Defaults to 7/8 of the
+# lease time if not specified. (RFC2132)
+#dhcp-option=option:T2,2m
+
+# Set the NTP time server address to be the same machine as
+# is running dnsmasq
+#dhcp-option=42,0.0.0.0
+
+# Set the NIS domain name to "welly"
+#dhcp-option=40,welly
+
+# Set the default time-to-live to 50
+#dhcp-option=23,50
+
+# Set the "all subnets are local" flag
+#dhcp-option=27,1
+
+# Send the etherboot magic flag and then etherboot options (a string).
+#dhcp-option=128,e4:45:74:68:00:00
+#dhcp-option=129,NIC=eepro100
+
+# Specify an option which will only be sent to the "red" network
+# (see dhcp-range for the declaration of the "red" network)
+# Note that the tag: part must precede the option: part.
+#dhcp-option = tag:red, option:ntp-server, 192.168.1.1
+
+# The following DHCP options set up dnsmasq in the same way as is specified
+# for the ISC dhcpcd in
+# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
+# adapted for a typical dnsmasq installation where the host running
+# dnsmasq is also the host running samba.
+# you may want to uncomment some or all of them if you use
+# Windows clients and Samba.
+#dhcp-option=19,0           # option ip-forwarding off
+#dhcp-option=44,0.0.0.0     # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
+#dhcp-option=45,0.0.0.0     # netbios datagram distribution server
+#dhcp-option=46,8           # netbios node type
+
+# Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.
+#dhcp-option=252,"\n"
+
+# Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client
+# probably doesn't support this......
+#dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com
+
+# Send RFC-3442 classless static routes (note the netmask encoding)
+#dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8
+
+# Send vendor-class specific options encapsulated in DHCP option 43.
+# The meaning of the options is defined by the vendor-class so
+# options are sent only when the client supplied vendor class
+# matches the class given here. (A substring match is OK, so "MSFT"
+# matches "MSFT" and "MSFT 5.0"). This example sets the
+# mtftp address to 0.0.0.0 for PXEClients.
+#dhcp-option=vendor:PXEClient,1,0.0.0.0
+
+# Send microsoft-specific option to tell windows to release the DHCP lease
+# when it shuts down. Note the "i" flag, to tell dnsmasq to send the
+# value as a four-byte integer - that's what microsoft wants. See
+# http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true
+#dhcp-option=vendor:MSFT,2,1i
+
+# Send the Encapsulated-vendor-class ID needed by some configurations of
+# Etherboot to allow is to recognise the DHCP server.
+#dhcp-option=vendor:Etherboot,60,"Etherboot"
+
+# Send options to PXELinux. Note that we need to send the options even
+# though they don't appear in the parameter request list, so we need
+# to use dhcp-option-force here.
+# See http://syslinux.zytor.com/pxe.php#special for details.
+# Magic number - needed before anything else is recognised
+#dhcp-option-force=208,f1:00:74:7e
+# Configuration file name
+#dhcp-option-force=209,configs/common
+# Path prefix
+#dhcp-option-force=210,/tftpboot/pxelinux/files/
+# Reboot time. (Note 'i' to send 32-bit value)
+#dhcp-option-force=211,30i
+
+# Set the boot filename for netboot/PXE. You will only need
+# this if you want to boot machines over the network and you will need
+# a TFTP server; either dnsmasq's built-in TFTP server or an
+# external one. (See below for how to enable the TFTP server.)
+#dhcp-boot=pxelinux.0
+
+# The same as above, but use custom tftp-server instead machine running dnsmasq
+#dhcp-boot=pxelinux,server.name,192.168.1.100
+
+# Boot for iPXE. The idea is to send two different
+# filenames, the first loads iPXE, and the second tells iPXE what to
+# load. The dhcp-match sets the ipxe tag for requests from iPXE.
+#dhcp-boot=undionly.kpxe
+#dhcp-match=set:ipxe,175 # iPXE sends a 175 option.
+#dhcp-boot=tag:ipxe,http://boot.ipxe.org/demo/boot.php
+
+# Encapsulated options for iPXE. All the options are
+# encapsulated within option 175
+#dhcp-option=encap:175, 1, 5b         # priority code
+#dhcp-option=encap:175, 176, 1b       # no-proxydhcp
+#dhcp-option=encap:175, 177, string   # bus-id
+#dhcp-option=encap:175, 189, 1b       # BIOS drive code
+#dhcp-option=encap:175, 190, user     # iSCSI username
+#dhcp-option=encap:175, 191, pass     # iSCSI password
+
+# Test for the architecture of a netboot client. PXE clients are
+# supposed to send their architecture as option 93. (See RFC 4578)
+#dhcp-match=peecees, option:client-arch, 0 #x86-32
+#dhcp-match=itanics, option:client-arch, 2 #IA64
+#dhcp-match=hammers, option:client-arch, 6 #x86-64
+#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64
+
+# Do real PXE, rather than just booting a single file, this is an
+# alternative to dhcp-boot.
+#pxe-prompt="What system shall I netboot?"
+# or with timeout before first available action is taken:
+#pxe-prompt="Press F8 for menu.", 60
+
+# Available boot services. for PXE.
+#pxe-service=x86PC, "Boot from local disk"
+
+# Loads <tftp-root>/pxelinux.0 from dnsmasq TFTP server.
+#pxe-service=x86PC, "Install Linux", pxelinux
+
+# Loads <tftp-root>/pxelinux.0 from TFTP server at 1.2.3.4.
+# Beware this fails on old PXE ROMS.
+#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4
+
+# Use bootserver on network, found my multicast or broadcast.
+#pxe-service=x86PC, "Install windows from RIS server", 1
+
+# Use bootserver at a known IP address.
+#pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4
+
+# If you have multicast-FTP available,
+# information for that can be passed in a similar way using options 1
+# to 5. See page 19 of
+# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf
+
+
+# Enable dnsmasq's built-in TFTP server
+#enable-tftp
+
+# Set the root directory for files available via FTP.
+#tftp-root=/var/ftpd
+
+# Do not abort if the tftp-root is unavailable
+#tftp-no-fail
+
+# Make the TFTP server more secure: with this set, only files owned by
+# the user dnsmasq is running as will be send over the net.
+#tftp-secure
+
+# This option stops dnsmasq from negotiating a larger blocksize for TFTP
+# transfers. It will slow things down, but may rescue some broken TFTP
+# clients.
+#tftp-no-blocksize
+
+# Set the boot file name only when the "red" tag is set.
+#dhcp-boot=tag:red,pxelinux.red-net
+
+# An example of dhcp-boot with an external TFTP server: the name and IP
+# address of the server are given after the filename.
+# Can fail with old PXE ROMS. Overridden by --pxe-service.
+#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3
+
+# If there are multiple external tftp servers having a same name
+# (using /etc/hosts) then that name can be specified as the
+# tftp_servername (the third option to dhcp-boot) and in that
+# case dnsmasq resolves this name and returns the resultant IP
+# addresses in round robin fashion. This facility can be used to
+# load balance the tftp load among a set of servers.
+#dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name
+
+# Set the limit on DHCP leases, the default is 150
+#dhcp-lease-max=150
+
+# The DHCP server needs somewhere on disk to keep its lease database.
+# This defaults to a sane location, but if you want to change it, use
+# the line below.
+#dhcp-leasefile=/var/lib/misc/dnsmasq.leases
+
+# Set the DHCP server to authoritative mode. In this mode it will barge in
+# and take over the lease for any client which broadcasts on the network,
+# whether it has a record of the lease or not. This avoids long timeouts
+# when a machine wakes up on a new network. DO NOT enable this if there's
+# the slightest chance that you might end up accidentally configuring a DHCP
+# server for your campus/company accidentally. The ISC server uses
+# the same option, and this URL provides more information:
+# http://www.isc.org/files/auth.html
+#dhcp-authoritative
+
+# Set the DHCP server to enable DHCPv4 Rapid Commit Option per RFC 4039.
+# In this mode it will respond to a DHCPDISCOVER message including a Rapid Commit
+# option with a DHCPACK including a Rapid Commit option and fully committed address
+# and configuration information. This must only be enabled if either the server is 
+# the only server for the subnet, or multiple servers are present and they each
+# commit a binding for all clients.
+#dhcp-rapid-commit
+
+# Run an executable when a DHCP lease is created or destroyed.
+# The arguments sent to the script are "add" or "del",
+# then the MAC address, the IP address and finally the hostname
+# if there is one.
+#dhcp-script=/bin/echo
+
+# Set the cachesize here.
+#cache-size=150
+
+# If you want to disable negative caching, uncomment this.
+#no-negcache
+
+# Normally responses which come from /etc/hosts and the DHCP lease
+# file have Time-To-Live set as zero, which conventionally means
+# do not cache further. If you are happy to trade lower load on the
+# server for potentially stale date, you can set a time-to-live (in
+# seconds) here.
+#local-ttl=
+
+# If you want dnsmasq to detect attempts by Verisign to send queries
+# to unregistered .com and .net hosts to its sitefinder service and
+# have dnsmasq instead return the correct NXDOMAIN response, uncomment
+# this line. You can add similar lines to do the same for other
+# registries which have implemented wildcard A records.
+#bogus-nxdomain=64.94.110.11
+
+# If you want to fix up DNS results from upstream servers, use the
+# alias option. This only works for IPv4.
+# This alias makes a result of 1.2.3.4 appear as 5.6.7.8
+#alias=1.2.3.4,5.6.7.8
+# and this maps 1.2.3.x to 5.6.7.x
+#alias=1.2.3.0,5.6.7.0,255.255.255.0
+# and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40
+#alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
+
+# Change these lines if you want dnsmasq to serve MX records.
+
+# Return an MX record named "maildomain.com" with target
+# servermachine.com and preference 50
+#mx-host=maildomain.com,servermachine.com,50
+
+# Set the default target for MX records created using the localmx option.
+#mx-target=servermachine.com
+
+# Return an MX record pointing to the mx-target for all local
+# machines.
+#localmx
+
+# Return an MX record pointing to itself for all local machines.
+#selfmx
+
+# Change the following lines if you want dnsmasq to serve SRV
+# records.  These are useful if you want to serve ldap requests for
+# Active Directory and other windows-originated DNS requests.
+# See RFC 2782.
+# You may add multiple srv-host lines.
+# The fields are <name>,<target>,<port>,<priority>,<weight>
+# If the domain part if missing from the name (so that is just has the
+# service and protocol sections) then the domain given by the domain=
+# config option is used. (Note that expand-hosts does not need to be
+# set for this to work.)
+
+# A SRV record sending LDAP for the example.com domain to
+# ldapserver.example.com port 389
+#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389
+
+# A SRV record sending LDAP for the example.com domain to
+# ldapserver.example.com port 389 (using domain=)
+#domain=example.com
+#srv-host=_ldap._tcp,ldapserver.example.com,389
+
+# Two SRV records for LDAP, each with different priorities
+#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1
+#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2
+
+# A SRV record indicating that there is no LDAP server for the domain
+# example.com
+#srv-host=_ldap._tcp.example.com
+
+# The following line shows how to make dnsmasq serve an arbitrary PTR
+# record. This is useful for DNS-SD. (Note that the
+# domain-name expansion done for SRV records _does_not
+# occur for PTR records.)
+#ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services"
+
+# Change the following lines to enable dnsmasq to serve TXT records.
+# These are used for things like SPF and zeroconf. (Note that the
+# domain-name expansion done for SRV records _does_not
+# occur for TXT records.)
+
+#Example SPF.
+#txt-record=example.com,"v=spf1 a -all"
+
+#Example zeroconf
+#txt-record=_http._tcp.example.com,name=value,paper=A4
+
+# Provide an alias for a "local" DNS name. Note that this _only_ works
+# for targets which are names from DHCP or /etc/hosts. Give host
+# "bert" another name, bertrand
+#cname=bertand,bert
+
+# For debugging purposes, log each DNS query as it passes through
+# dnsmasq.
+#log-queries
+
+# Log lots of extra information about DHCP transactions.
+#log-dhcp
+
+# Include another lot of configuration options.
+#conf-file=/etc/dnsmasq.more.conf
+#conf-dir=/etc/dnsmasq.d
+
+# Include all the files in a directory except those ending in .bak
+#conf-dir=/etc/dnsmasq.d,.bak
+
+# Include all files in a directory which end in .conf
+conf-dir=/etc/dnsmasq.d/,*.conf
+
+# If a DHCP client claims that its name is "wpad", ignore that.
+# This fixes a security hole. see CERT Vulnerability VU#598349
+#dhcp-name-match=set:wpad-ignore,wpad
+#dhcp-ignore-names=tag:wpad-ignore

dnsmasq/files/home.conf

@@ -1 +1,12 @@
 address=/rancher.rre.home/10.2.0.101
+address=/pepper.rre.home/10.2.0.102
+address=/s3.rre.home/10.2.0.102
+address=/nexus.rre.home/10.2.0.102
+address=/repo.rre.home/10.2.0.102
+address=/rancher.rre.home/10.2.0.101
+address=/pepper.home.lan/10.2.0.102
+address=/s3.home.lan/10.2.0.102
+address=/nexus.home.lan/10.2.0.102
+address=/repo.home.lan/10.2.0.102
+address=/docker.home.lan/10.2.0.102
+address=/rancher.home.lan/10.2.0.101

dnsmasq/files/hosts

@@ -30,9 +30,15 @@ ff02::3         ipv6-allhosts
 10.2.0.19	habanero
 10.2.0.20	piripiri
 10.2.0.21	jalapeno
+10.2.0.22	poblano
+10.2.0.22	npm
+10.2.0.40	cl1
+10.2.0.50	cl2
+10.2.0.51	cl2-ingress-public
 10.2.0.101	salt
 10.2.0.102	pepper
 
+
 #lab k3s cluster
 10.2.0.250	demo-k3s
 10.2.0.251	srv1
@@ -43,7 +49,6 @@ ff02::3         ipv6-allhosts
 # 10.2.0.60-70
 10.2.0.60	public
 10.2.0.61	private
-10.2.0.62	unifi
 10.2.0.63	gitea
 10.2.0.64	mqtt
 

dnsmasq/files/rre.conf

@@ -4,16 +4,15 @@ expand-hosts
 domain=rre.nu
 
 # public cnames
-cname=push.rre.nu,public.rre.nu.
-cname=git.rre.nu,public.rre.nu
-cname=home.rre.nu,public.rre.nu
-cname=nextcloud.rre.nu,public.rre.nu
-cname=nodered.rre.nu,public.rre.nu
-cname=longhorn.rre.nu,public.rre.nu
-cname=s3.rre.nu,public.rre.nu
-cname=rre.nu,public.rre.nu
-cname=mat.rre.nu,public.rre.nu
-cname=zigbee2mqtt.rre.nu,public.rre.nu
-cname=grafana.rre.nu,public.rre.nu
-cname=prometheus.rre.nu,public.rre.nu
-cname=repo.rre.nu,salt.rre.nu
+cname=push.rre.nu,cl2-ingress-public.rre.nu.
+cname=git.rre.nu,cl2-ingress-public.rre.nu
+cname=home.rre.nu,cl2-ingress-public.rre.nu
+cname=nextcloud.rre.nu,cl2-ingress-public.rre.nu
+cname=nodered.rre.nu,cl2-ingress-public.rre.nu
+cname=rre.nu,cl2-ingress-public.rre.nu
+cname=zigbee2mqtt.rre.nu,cl2-ingress-public.rre.nu
+cname=grafana.rre.nu,cl2-ingress-public.rre.nu
+cname=nv.rre.nu,cl2-ingress-public.rre.nu
+cname=esphome.rre.nu,cl2-ingress-public.rre.nu
+cname=unifi.rre.nu,cl2-ingress-public.rre.nu
+cname=rancher.rre.nu,cl1.rre.nu

dnsmasq/init.sls

@@ -2,6 +2,14 @@ Install dnsmasq:
   pkg.installed:
     - name: dnsmasq
 
+dnsmasq.conf configuration file:
+  file.managed:
+    - name: /etc/dnsmasq.conf
+    - source: salt://dnsmasq/files/dnsmasq.conf
+    - user: root
+    - group: root
+    - mode: "0644"
+
 rre.nu configuration file:
   file.managed:
     - name: /etc/dnsmasq.d/rre.conf
@@ -35,3 +43,4 @@ start dnsmasq:
       - file: rre.nu configuration file
       - file: rre.home configuration file
       - file: configure host file
+      - file: dnsmasq.conf configuration file

k3s/files/etc/salt/minion.d/beacons.conf

@@ -1,15 +0,0 @@
-beacons:
-  inotify:
-    - files:
-        /dev:
-          mask:
-            - create
-            - delete
-          exclude:
-           - /dev/gpiochip3
-           - /dev/serial
-           - /dev/ttyUSB0
-           - /dev/ttyUSB1
-           - /dev/ttyACM0
-           - /dev/ttyACM1
-    - disable_during_state_run: True

k3s/files/etc/sysconfig/network/config

@@ -1,302 +0,0 @@
-## Type:        integer
-## Default:     ""
-#
-# How log to wait for IPv6 autoconfig in ifup when requested with
-# the auto6 or +auto6 tag in BOOTPROTO variable.
-# When unset, a wicked built-in default defer time (10sec) is used.
-#
-AUTO6_WAIT_AT_BOOT=""
-
-## Type:        list(all,dns,none,"")
-## Default:     ""
-#
-# Whether to update system (DNS) settings from IPv6 RA when requested
-# with the auto6 or +auto6 tag in BOOTPROTO variable.
-# Defaults to update if autoconf sysctl (address autoconf) is enabled.
-#
-AUTO6_UPDATE=""
-
-## Type:        list(auto,yes,no)
-## Default:     "auto"
-#
-# Permits to specify/modify a global ifcfg default. Use with care!
-#
-# This settings breaks rules for many things, which require carrier
-# before they can start, e.g. L2 link protocols, link authentication,
-# ipv4 duplicate address detection, ipv6 duplicate detection will
-# happen "post-mortem" and maybe even cause to disable ipv6 at all.
-# See also "man ifcfg" for further informations.
-#
-LINK_REQUIRED="auto"
-
-## Type:        string
-## Default:     ""
-#
-# Allows to specify a comma separated list of debug facilities used
-# by wicked. Negated facility names can be prepended by a "-", e.g.:
-#   "all,-events,-socket,-objectmodel,xpath,xml,dbus"
-#
-# When set, wicked debug level is automatically enabled.
-# For a complete list of facility names, see: "wicked --debug help".
-#
-WICKED_DEBUG=""
-
-## Type:        list("",error,warning,notice,info,debug,debug1,debug2,debug3)
-## Default:     ""
-#
-# Allows to specify wicked debug level. Default level is "notice".
-#
-WICKED_LOG_LEVEL=""
-## Path:	Network/General
-## Description:	Global network configuration
-#
-# Note: 
-# Most of the options can and should be overridden by per-interface
-# settings in the ifcfg-* files.
-#
-# Note: The ISC dhclient started by the NetworkManager is not using any
-# of these options -- NetworkManager is not using any sysconfig settings.
-#
-
-## Type:        yesno
-## Default:     yes
-# If ifup should check if an IPv4 address is already in use, set this to yes.
-#
-# Make sure that packet sockets (CONFIG_PACKET) are supported in the kernel,
-# since this feature uses arp, which depends on that.
-# Also be aware that this takes one second per interface; consider that when
-# setting up a lot of interfaces. 
-CHECK_DUPLICATE_IP="yes"
-
-## Type:        list(auto,yes,no)
-## Default:     auto
-# If ifup should send a gratuitous ARP to inform the receivers about its
-# IPv4 addresses. Default is to send gratuitous ARP, when duplicate IPv4
-# address check is enabled and the check were sucessful.
-#
-# Make sure that packet sockets (CONFIG_PACKET) are supported in the kernel,
-# since this feature uses arp, which depends on that.
-SEND_GRATUITOUS_ARP="auto"
-
-## Type:        yesno
-## Default:     no
-# Switch on/off debug messages for all network configuration stuff. If set to no
-# most scripts can enable it locally with "-o debug".
-DEBUG="no"
-
-## Type:	integer
-## Default:	30
-#
-# Some interfaces need some time to come up or come asynchronously via hotplug.
-# WAIT_FOR_INTERFACES is a global wait for all mandatory interfaces in
-# seconds. If empty no wait occurs.
-#
-WAIT_FOR_INTERFACES="30"
-
-## Type:	yesno
-## Default:	yes
-#
-# With this variable you can determine if the SuSEfirewall when enabled
-# should get started when network interfaces are started.
-FIREWALL="yes"
-
-## Type:	int
-## Default:	30
-#
-# When using NetworkManager you may define a timeout to wait for NetworkManager
-# to connect in NetworkManager-wait-online.service.  Other network services
-# may require the system to have a valid network setup in order to succeed.
-#
-# This variable has no effect if NetworkManager is disabled.
-#
-NM_ONLINE_TIMEOUT="30"
-
-## Type:        string
-## Default:     "dns-resolver dns-bind ntp-runtime nis"
-#
-# This variable defines the start order of netconfig modules installed
-# in the /etc/netconfig.d/ directory.
-#
-# To disable the execution of a module, don't remove it from the list
-# but prepend it with a minus sign, "-ntp-runtime".
-#
-NETCONFIG_MODULES_ORDER="dns-resolver dns-bind dns-dnsmasq nis ntp-runtime"
-
-## Type:        yesno
-## Default:     no
-#
-# Enable netconfig verbose reporting.
-#
-NETCONFIG_VERBOSE="no"
-
-## Type:	yesno
-## Default:	no
-#
-# This variable enables netconfig to always force a replace of modified
-# files and automatically enables the -f | --force-replace parameter.
-#
-# The purpose is to use it as workaround, when some other tool trashes
-# the files, e.g. /etc/resolv.conf and you observe messages like this
-# in your logs on in "netconfig update" output:
-# ATTENTION: You have modified /etc/resolv.conf. Leaving it untouched.
-#
-# Please do not forget to also report a bug as we have a system policy
-# to use netconfig.
-#
-NETCONFIG_FORCE_REPLACE="no"
-
-## Type:        string
-## Default:     "auto"
-#
-# Defines the DNS merge policy as documented in netconfig(8) manual page.
-# Set to "" to disable DNS configuration.
-#
-NETCONFIG_DNS_POLICY="auto"
-
-## Type:        string(resolver,bind,dnsmasq,)
-## Default:     "resolver"
-#
-# Defines the name of the DNS forwarder that has to be configured.
-# Currently implemented are "bind", "dnsmasq" and "resolver", that
-# causes to write the name server IP addresses to /etc/resolv.conf
-# only (no forwarder). Empty string defaults to "resolver".
-#
-NETCONFIG_DNS_FORWARDER="resolver"
-
-## Type:        yesno
-## Default:     yes
-#
-# When enabled (default) in forwarder mode ("bind", "dnsmasq"),
-# netconfig writes an explicit localhost nameserver address to the
-# /etc/resolv.conf, followed by the policy resolved name server list
-# as fallback for the moments, when the local forwarder is stopped.
-#
-NETCONFIG_DNS_FORWARDER_FALLBACK="yes"
-
-## Type:        string
-## Default:     ""
-#
-# List of DNS domain names used for host-name lookup.
-# It is written as search list into the /etc/resolv.conf file.
-#
-NETCONFIG_DNS_STATIC_SEARCHLIST=""
-
-## Type:        string
-## Default:     ""
-#
-# List of DNS nameserver IP addresses to use for host-name lookup.
-# When the NETCONFIG_DNS_FORWARDER variable is set to "resolver",
-# the name servers are written directly to /etc/resolv.conf.
-# Otherwise, the nameserver are written into a forwarder specific
-# configuration file and the /etc/resolv.conf does not contain any
-# nameservers causing the glibc to use the name server on the local
-# machine (the forwarder). See also netconfig(8) manual page
-#
-NETCONFIG_DNS_STATIC_SERVERS="10.2.0.101 10.2.0.102"
-
-## Type:        string
-## Default:     "auto"
-#
-# Allows to specify a custom DNS service ranking list, that is which
-# services provide preferred (e.g. vpn services), and which services
-# fallback settings (e.g. avahi).
-# Preferred service names have to be prepended with a "+", fallback
-# service names with a "-" character. The special default value
-# "auto" enables the current build-in service ranking list -- see the
-# netconfig(8) manual page -- "none" or "" disables the ranking.
-#
-NETCONFIG_DNS_RANKING="auto"
-
-## Type:        string
-## Default:     ""
-#
-# Allows to specify options to use when writting the /etc/resolv.conf,
-# for example:
-# 	"debug attempts:1 timeout:10"
-# See resolv.conf(5) manual page for details.
-#
-NETCONFIG_DNS_RESOLVER_OPTIONS=""
-
-## Type:        string
-## Default:     ""
-#
-# Allows to specify a sortlist to use when writting the /etc/resolv.conf,
-# for example:
-# 	130.155.160.0/255.255.240.0 130.155.0.0"
-# See resolv.conf(5) manual page for details.
-#
-NETCONFIG_DNS_RESOLVER_SORTLIST=""
-
-## Type:        string
-## Default:     "auto"
-#
-# Defines the NTP merge policy as documented in netconfig(8) manual page.
-# Set to "" to disable NTP configuration.
-#
-NETCONFIG_NTP_POLICY="auto"
-
-## Type:        string
-## Default:     ""
-#
-# List of NTP servers.
-#
-NETCONFIG_NTP_STATIC_SERVERS=""
-
-## Type:        string
-## Default:     "auto"
-#
-# Defines the NIS merge policy as documented in netconfig(8) manual page.
-# Set to "" to disable NIS configuration.
-#
-NETCONFIG_NIS_POLICY="auto"
-
-## Type:        string(yes,no,)
-## Default:     "yes"
-#
-# Defines whether to set the default NIS domain. When enabled and no domain
-# is provided dynamically or in static settings, /etc/defaultdomain is used.
-# Valid values are:
-#  - "no" or ""         netconfig does not set the domainname
-#  - "yes"              netconfig sets the domainname according to the
-#                       NIS policy using settings provided by the first
-#                       iterface and service that provided it.
-#  - "<interface name>" as yes, but only using settings from interface.
-#
-NETCONFIG_NIS_SETDOMAINNAME="yes"
-
-## Type:        string
-## Default:     ""
-#
-# Defines a default NIS domain.
-#
-# Further domain can be specified by adding a "_<number>" suffix to
-# the NETCONFIG_NIS_STATIC_DOMAIN and NETCONFIG_NIS_STATIC_SERVERS
-# variables, e.g.: NETCONFIG_NIS_STATIC_DOMAIN_1="second".
-#
-NETCONFIG_NIS_STATIC_DOMAIN=""
-
-## Type:        string
-## Default:     ""
-#
-# Defines a list of NIS servers for the default NIS domain or the
-# domain specified with same "_<number>" suffix.
-#
-NETCONFIG_NIS_STATIC_SERVERS=""
-
-## Type:	string
-## Default:	''
-#
-# Set this variable global variable to the ISO / IEC 3166 alpha2
-# country code specifying the wireless regulatory domain to set.
-# When not empty, ifup-wireless will be set in the wpa_supplicant
-# config or via 'iw reg set' command.
-#
-# Note: This option requires a wpa driver supporting it, like
-# the 'nl80211' driver used by default since openSUSE 11.3.
-# When you notice problems with your hardware, please file a
-# bug report and set e.g. WIRELESS_WPA_DRIVER='wext' (the old
-# default driver) in the ifcfg file.
-# See also "/usr/sbin/wpa_supplicant --help" for the list of
-# available wpa drivers.
-#
-WIRELESS_REGULATORY_DOMAIN=''

k3s/files/etc/udev/rules.d/90-RFXtrx433.rules

@@ -1,6 +0,0 @@
-SUBSYSTEM=="tty", \
-ACTION=="add", \
-DRIVERS=="ftdi_sio", \
-ATTRS{interface}=="RFXtrx433", \
-MODE="0666", \
-SYMLINK+="rfxtrx433"

k3s/files/etc/udev/rules.d/90-zigbee.rules

@@ -1,6 +0,0 @@
-SUBSYSTEM=="tty", \
-ACTION=="add", \
-ATTRS{manufacturer}=="Texas Instruments", \
-ATTRS{product}=="TI CC2531 USB CDC", \
-MODE="0666", \
-SYMLINK+="zigbee"

k3s/files/etc/udev/rules.d/90-zwave.rules

@@ -1,6 +0,0 @@
-SUBSYSTEM=="tty", \
-ACTION=="add", \
-ATTRS{idProduct}=="0200", \
-ATTRS{idVendor}=="0658", \
-MODE=="0666", \
-SYMLINK+="zwave"

k3s/firewalld.sls

@@ -1,7 +0,0 @@
-Stop firewalld if running:
-  service.dead:
-    - name: firewalld
-
-Disable firewalld:
-  service.disabled:
-    - name: firewalld

k3s/init.sls

@@ -1,4 +0,0 @@
-include:
-  - k3s.firewalld
-  - k3s.network
-  - k3s.usb-devices

k3s/network.sls

@@ -1,13 +0,0 @@
-configure /etc/sysconfig/network/config:
-  file.managed:
-    - name: /etc/sysconfig/network/config
-    - source: salt://k3s/files/etc/sysconfig/network/config
-    - user: root
-    - group: root
-    - mode: "0644"
-
-run netupdate:
-  cmd.run:
-    - name: netconfig update -f
-    - onchanges:
-      - file: /etc/sysconfig/network/config

k3s/usb-devices.sls

@@ -1,49 +0,0 @@
-Install PyInotify:
-  pkg.installed:
-    - name: python3-pyinotify
-
-Add the rfxcom433 beacon file:
-  file.managed:
-    - name: /etc/salt/minion.d/beacons.conf
-    - source: salt://k3s/files/etc/salt/minion.d/beacons.conf
-    - user: root
-    - group: root
-    - mode: "0644"
-
-Restart salt-minion:
-  service.running:
-    - name: salt-minion
-    - watch:
-      - file: Add the rfxcom433 beacon file
-
-Add the rfxcom udev rule:
-  file.managed:
-    - name: /etc/udev/rules.d/90-RFXtrx433.rules
-    - source: salt://k3s/files/etc/udev/rules.d/90-RFXtrx433.rules
-    - user: root
-    - group: root
-    - mode: "0644"
-
-Add the zwave udev rule:
-  file.managed:
-    - name: /etc/udev/rules.d/90-zwave.rules
-    - source: salt://k3s/files/etc/udev/rules.d/90-zwave.rules
-    - user: root
-    - group: root
-    - mode: "0644"
-
-Add the zigbee udev rule:
-  file.managed:
-    - name: /etc/udev/rules.d/90-zigbee.rules
-    - source: salt://k3s/files/etc/udev/rules.d/90-zigbee.rules
-    - user: root
-    - group: root
-    - mode: "0644"
-
-reload udev rules:
-  cmd.run:
-    - name: udevadm control --reload
-    - onchanges:
-      - file: Add the rfxcom udev rule
-      - file: Add the zwave udev rule
-      - file: Add the zigbee udev rule

lib.sls

@@ -0,0 +1,79 @@
+{% macro container_deploy(container) -%}
+{% set user = salt['pillar.get']('podman:user', 'root') %}
+{% set home = salt['user.info'](user).home %}
+{% set group = salt['pillar.get']('podman:group', 'root') %}
+{% set zone = salt['pillar.get']('containers:zone', 'public') %}
+
+
+{% if pillar['containers'][container]['ports'] is defined %}
+Defining firewalld service for {{ container }}:
+  firewalld.service:
+    - name: {{ container }}
+    - ports:
+      {%- for port in pillar['containers'][container]['ports'] %}
+      {%- if port['protocol'] is defined %}
+      {%- set protocol = port['protocol'] %}
+      {%- else %}
+      {%- set protocol = 'tcp' %}
+      {%- endif %}
+      - {{ port['host'] }}/{{ protocol }}
+      {%- endfor %}
+
+adding service {{ container }} to {{ zone }} zone:
+  firewalld.present:
+    - name: {{ zone }}
+    - services:
+      - {{ container }}
+{% endif %}
+
+Create container manage file for {{ container }}:
+  file.managed:
+    - name: "{{ home }}/bin/{{ container }}.sh"
+    - source: salt://podman/files/container.sh.jinja
+    - template: jinja
+    - user: {{ user }}
+    - group: {{ group }}
+    - mode: "0750"
+    - context:
+      container: {{ container }}
+      args: {{ pillar['containers'][container] }}
+
+{% if pillar['containers'][container]['volumes'] is defined %}
+{% for volume, mount in pillar['containers'][container]['volumes'].items() %}
+Create {{ volume }} volume for {{ container }}:
+  cmd.run:
+    - name: podman volume create {{ container }}-{{ volume }}
+    - runas: {{ user }}
+    - unless: podman volume exists {{ container }}-{{ volume }}
+{% endfor %}
+{% endif %}
+
+Create container {{ container }}:
+  cmd.run:
+    - name: "{{ home }}/bin/{{ container }}.sh --create"
+    - runas: {{ user }}
+    - unless: podman container exists {{ container }}
+
+Create container {{ container }} unit file:
+  cmd.run:
+    - name: podman generate systemd --name {{ container }} > {{ home }}/.config/systemd/user/{{ container }}.service
+    - runas: {{ user }}
+    - onchanges:
+      - cmd: Create container {{ container }}
+
+Run user daemon reload for {{ container }} unit:
+  cmd.run:
+    - name: systemctl --user daemon-reload
+    - runas: {{ user }}
+    - onchanges:
+       - cmd: Create container {{ container }} unit file
+
+start container {{ container }}:
+  cmd.run:
+    - name: "{{ home }}/bin/{{ container }}.sh --start"
+    - runas: {{ user }}
+    - unless: "{{ home }}/bin/{{ container }}.sh --is-running"
+    - onchanges:
+      - cmd: Run user daemon reload for {{ container }} unit
+    
+{% endmacro -%}

minio/files/minio.service.jinja

@@ -1,14 +0,0 @@
-[Unit]
-Description=MinIO podman container
-
-[Service]
-Restart=on-failure
-ExecStartPre=/usr/bin/rm -f /%t/%n-pid /%t/%n-cid
-ExecStart=/usr/bin/podman run --conmon-pidfile  /%t/%n-pid  --cidfile /%t/%n-cid --detach -p "9000:9000" -e "MINIO_ACCESS_KEY={{ pillar['minio']['accesskey'] }}" -v "/srv/minio:/data" -e "MINIO_SECRET_KEY={{ pillar['minio']['secretkey'] }}" minio/minio server /data
-ExecStop=/usr/bin/sh -c "/usr/bin/podman rm -f `cat /%t/%n-cid`"
-KillMode=none
-Type=forking
-PIDFile=/%t/%n-pid
-
-[Install]
-WantedBy=multi-user.target

minio/init.sls

@@ -1,3 +0,0 @@
-include:
-  - minio.prereq
-  - minio.systemd

minio/prereq.sls

@@ -1,10 +0,0 @@
-Create local MinIO storage:
-  file.directory:
-    - name: /srv/minio
-    - user: root
-    - group: root
-    - mode: "0755"
-
-Install podman:
-  pkg.installed:
-    - name: podman

minio/systemd.sls

@@ -1,20 +0,0 @@
-Create minio systemd service:
-  file.managed:
-    - name: /etc/systemd/system/minio.service
-    - source: salt://minio/files/minio.service.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: "0660"
-
-SystemD daemon reload:
-  cmd.run:
-    - name: systemctl --system daemon-reload
-    - onchanges:
-      - file: Create minio systemd service
-
-start MinIO:
-  service.running:
-    - name: minio.service
-    - onchanges:
-      - cmd: SystemD daemon reload

podman/containers.sls

@@ -0,0 +1,60 @@
+{% set user = salt['pillar.get']('podman:user', 'root') %}
+{% set home = salt['user.info'](user).home %}
+{% set group = salt['pillar.get']('podman:group', 'root') %}
+
+
+
+{% for name, args in salt['pillar.get']('containers', {} ).items() %}
+
+Create container manage file for {{ name }}:
+  file.managed:
+    - name: "{{ home }}/bin/{{ name }}.sh"
+    - source: salt://podman/files/container.sh.jinja
+    - template: jinja
+    - user: {{ user }}
+    - group: {{ group }}
+    - mode: "0750"
+    - context:
+      container: {{ name }}
+      args: {{ args }}
+
+{% if args['volumes'] is defined %}
+{% for volume, mount in args['volumes'].items() %}
+Create {{ volume }} volume for {{ name }}:
+  cmd.run:
+    - name: podman volume create {{ name }}-{{ volume }}
+    - runas: {{ user }}
+    - unless: podman volume exists {{ name }}-{{ volume }}
+{% endfor %}
+{% endif %}
+
+Create container {{ name }}:
+  cmd.run:
+    - name: "{{ home }}/bin/{{ name }}.sh --create"
+    - runas: {{ user }}
+    - unless: podman container exists {{ name }}
+
+Create container {{ name }} unit file:
+  cmd.run:
+    - name: podman generate systemd --name {{ name }} > {{ home }}/.config/systemd/user/{{ name }}.service
+    - runas: {{ user }}
+    - onchanges:
+      - cmd: Create container {{ name }}
+
+Run user daemon reload for {{ name }} unit:
+  cmd.run:
+    - name: systemctl --user daemon-reload
+    - runas: {{ user }}
+    - onchanges:
+       - cmd: Create container {{ name }} unit file
+
+start container {{ name }}:
+  cmd.run:
+    - name: "{{ home }}/bin/{{ name }}.sh --start"
+    - runas: {{ user }}
+    - unless: "{{ home }}/bin/{{ name }}.sh --is-running"
+    - onchanges:
+      - cmd: Run user daemon reload for {{ name }} unit
+    
+
+{% endfor %}

podman/files/99-zigbee-serial.rules

@@ -0,0 +1 @@
+SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a8", SYMLINK+="zigbee-serial", MODE="0666"

podman/files/container.sh.jinja

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+
+function pull_image(){
+    if ! podman image exists {{ args['image'] }}:{{ args['tag'] }}; then
+        podman pull {{ args['image'] }}:{{ args['tag'] }}
+    fi
+
+}
+
+function create_volumes() {
+{% for volume, mounts in args['volumes'].items() -%}
+    if ! podman volume exists {{ container }}-{{ volume }}; then
+        podman volume create {{ container }}-{{ volume }}
+    fi
+{% endfor %}
+}
+
+function create_container() {
+    if ! podman container exists {{ container }};then
+        podman container create \
+            --name {{ container }} \
+	    {%- if args['volumes'] is defined %}
+            {%- for volume, mount in args['volumes'].items() %}
+            -v {{ container }}-{{ volume }}:{{ mount }} \
+    	    {%- endfor %}
+	    {%- endif %}
+	    {%- if args['ports'] is defined %}
+    	    {%- for ports in args['ports'] %}
+    	    -p {{ ports['host'] }}:{{ ports['container'] }}{% if ports['protocol'] is defined %}/{{ ports['protocol'] }}{% endif %} \
+            {%- endfor %}
+	    {%- endif %}
+	    {%- if args['env'] is defined %}
+    	    {%- for key, value in args['env'].items() %}
+    	    -e {{ key }}={{ value }} \
+    	    {%- endfor %}
+	    {%- endif %}
+	    {%- if args['devices'] is defined %}
+	    {%- for key, value in args['devices'].items() %}
+	    --device {{ key }}:{{ value}} \
+	    {%- endfor %}
+            {%- endif %}
+    	    {{ args['image'] }}:{{ args['tag'] }}
+    fi
+
+}
+
+function generate_systemd_unit_file() {
+    podman generate systemd --name {{ container }} > $HOME/.config/systemd/user/{{ container }}.service
+}
+
+function check_update() {
+    podman pull {{ args['image'] }}:{{ args['tag'] }}
+    if [[ "$(podman image inspect {{ args['image'] }}:{{ args['tag'] }} --format "{% raw %}{{.Id}}{% endraw %}")" == "$(podman inspect {{ container }} --format "{% raw %}{{ .Image }}{% endraw %}")" ]];then
+        echo "No image updates available"
+	return 0
+    else
+        echo "Image update available"
+	return 1
+    fi
+}
+
+function update() {
+    if ! check_update; then
+       systemctl --user stop {{ container }}
+       podman container rm {{ container }}
+       create_container
+       generate_systemd_unit_file
+       systemctl --user daemon-reload
+       systemctl --user enable --now {{ container }}.service
+    fi
+}
+    
+
+
+function printHelp(){
+    cat << EOF
+Usage ${0##*/} [options..]
+-h,-?, --help           Show help and exit
+-p, --pull              pull container image ({{ container }}:{{ args['tag'] }})
+-v, --volumes           create container volumes
+-c, --create            create {{ container }} containers
+-s, --start             start and enables {{ container }} container
+-S, --stop              stop {{ container }} container
+-i, --is-running        check to see if container service is running
+-u, --check-update      check if there are image updates avaiable
+-U, --update            perform image update if it exists
+-g, --generate-systemd  generate user systemd service unit file
+EOF
+}
+
+
+while :; do
+    case $1 in
+        -h|-\?|--help)
+            printHelp
+            exit
+            ;;
+        -p|--pull)
+            pull_image
+            shift
+            ;;
+        -v|--volumes)
+            create_volumes
+            shift
+            ;;
+        -c|--create)
+            create_container
+            shift
+            ;;
+	-s|--start)
+	    systemctl --user enable --now {{ container }}.service
+	    shift
+	    ;;
+	-S|--stop)
+	    systemctl --user stop {{ container }}.service
+	    shift
+	    ;;
+	-i|--is-running)
+            systemctl --user is-active {{ container }}.service
+	    exit $?
+	    shift
+	    ;;
+        -g|--generate-systemd)
+	    generate_systemd_unit_file
+	    shift
+	    ;;
+	-u|--check-update)
+	    check_update
+	    shift
+	    ;;
+	-U|--update)
+	    update
+	    shift
+	    ;;
+        --)                 #End of all options
+            shift
+            break
+            ;;
+        -?*)
+            printf "'%s' is not a valid option\n" "$1" >&2
+            exit 1
+            ;;
+        *)                 #Break out of case, no more options
+            break
+    esac
+    shift
+done
+

podman/files/env_file.jinja

@@ -0,0 +1,3 @@
+{% for key, value in env_vars.items() -%}
+{{ key }}={{ value }}
+{% endfor -%}

podman/files/npm-container.conf

@@ -0,0 +1 @@
+net.ipv4.ip_unprivileged_port_start=80

podman/firewalld.sls

@@ -0,0 +1,20 @@
+{% set zone = salt['pillar.get']('containers:zone', 'public') %}
+
+{% for name, args in salt['pillar.get']('containers', {} ).items() %}
+{% if args['ports'] is defined %}
+
+Defining firewalld service for {{ name }}:
+  firewalld.service:
+    - name: {{ name }}
+    - ports:
+      {%- for port in args['ports'] %}
+      - {{ port['host'] }}/tcp
+      {%- endfor %}
+
+adding service {{ name }} to {{ zone }} zone:
+  firewalld.present:
+    - name: {{ zone }}
+    - services:
+      - {{ name }}
+{% endif %}
+{% endfor %}

podman/gitea.sls

@@ -0,0 +1,4 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+{{ container_deploy('gitea') }}
+

podman/gotify.sls

@@ -0,0 +1,4 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+{{ container_deploy('gotify') }}
+

podman/init.sls

@@ -0,0 +1,11 @@
+{% set user = salt['pillar.get']('podman:user', 'root') %}
+
+Install packages needed for podman:
+  pkg.installed:
+    - pkgs:
+      - podman
+
+Set linger for user {{ user }}:
+  cmd.run:
+    - name: loginctl enable-linger {{ user }}
+    - unless: test -e /var/lib/systemd/linger/{{ user }}

podman/mariadb.sls

@@ -0,0 +1,4 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+{{ container_deploy('mariadb') }}
+

podman/mosquitto.sls

@@ -0,0 +1,4 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+{{ container_deploy('mosquitto') }}
+

podman/nextcloud.sls

@@ -0,0 +1,4 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+{{ container_deploy('nextcloud') }}
+

podman/npm.sls

@@ -0,0 +1,19 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+Make sure user can open low tcp ports:
+  file.managed:
+    - name: /etc/sysctl.d/npm-container.conf
+    - source: salt://podman/files/npm-container.conf
+    - user: root
+    - group: root
+    - mode: "0644"
+
+Reload sysctl:
+  cmd.run:
+    - name: sysctl --system
+    - onchanges:
+      - file: Make sure user can open low tcp ports
+
+
+{{ container_deploy('npm') }}
+

podman/unifi.sls

@@ -0,0 +1,4 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+{{ container_deploy('unifi') }}
+

podman/zigbee2mqtt.sls

@@ -0,0 +1,20 @@
+{% from 'lib.sls' import container_deploy with context %}
+
+Create udev-rule for zigbee usb dongel:
+   file.managed:
+     - name: /etc/udev/rules.d/99-zigbee-serial.rules
+     - source: salt://podman/files/99-zigbee-serial.rules
+     - user: root
+     - group: root
+     - mode: "0644"
+
+Relead udev rules for zigbee dongel:
+  cmd.run:
+    - name: udevadm control --reload-rules
+    - onchanges:
+      - file: Create udev-rule for zigbee usb dongel
+
+
+
+{{ container_deploy('zigbee2mqtt') }}
+

top.sls

@@ -5,6 +5,10 @@ base:
     - sudo
     - ssh
 
+  'poblano.rre.nu':
+    - podman
+    - cockpit
+
   'pepper.rre.nu':
     - dnsmasq
 
@@ -12,9 +16,8 @@ base:
     - dnsmasq
     - salt-master
 
-  'k3s':
-    - match: nodegroup
-    - k3s
+  'woody.rre.nu':
+    - wifi-voucher
 
   'minio:enabled:true':
     - match: pillar

wifi-voucher/files/voucher.env.jinja

@@ -0,0 +1,3 @@
+{% for key, value in pillar['voucher']['config'].items() -%}
+{{ key }}="{{ value }}"
+{% endfor -%}

wifi-voucher/files/wifi-voucher.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=WIFI-Voucher system for my guest network
+After=network.target
+
+[Service]
+Type=simple
+Restart=always
+User=voucher
+ExecStart=/usr/local/bin/voucher
+EnvironmentFile=/etc/default/wifi-voucher
+
+[Install]
+WantedBy=multi-user.target

wifi-voucher/init.sls

@@ -0,0 +1,4 @@
+include:
+  - wifi-voucher.packages
+  - wifi-voucher.user
+  - wifi-voucher.service

wifi-voucher/packages.sls

@@ -0,0 +1,9 @@
+Install CUPS and bsd tools:
+  pkg.installed:
+    - pkgs:
+      - cups
+      - cups-bsd
+
+Install wifi-voucher:
+  pip.installed:
+    - name: https://git.rre.nu/jonas/wifi-voucher/raw/branch/main/dist/voucher-{{ pillar['voucher']['version'] }}-py39-none-any.whl

wifi-voucher/remove.sls

@@ -0,0 +1,4 @@
+remove voucher user:
+  user.absent:
+    - name: voucher
+    - purge: True

wifi-voucher/service.sls

@@ -0,0 +1,31 @@
+WIFI-Voucher Unit environment file:
+  file.managed:
+    - name: /etc/default/wifi-voucher
+    - source: salt://wifi-voucher/files/voucher.env.jinja
+    - template: jinja
+    - user: root
+    - group: voucher
+    - mode: "0640"
+
+WIFI-Voucher unit service file:
+  file.managed:
+    - name: /etc/systemd/system/wifi-voucher.service
+    - source: salt://wifi-voucher/files/wifi-voucher.service
+    - user: root
+    - group: root
+    - mode: "0644"
+
+SystemD Reload:
+  cmd.run:
+    - name: systemctl --system daemon-reload
+    - onchanges:
+      - file: WIFI-Voucher unit service file
+
+Start wifi-voucher:
+  service.running:
+    - name: wifi-voucher
+    - enable: True
+    - watch:
+      - file: WIFI-Voucher Unit environment file
+      - file: WIFI-Voucher unit service file
+      - cmd: SystemD Reload

wifi-voucher/user.sls

@@ -0,0 +1,8 @@
+WIFI-Voucher user:
+  user.present:
+    - name: voucher
+    - fullname: wifi-voucher system
+    - home: /home/voucher
+    - shell: /bin/bash
+    - groups:
+      - gpio