tlu/salt/states/hostapd/init.sls

Set {{ pillar['network']['wireless'] }} to not be managed by NetworkManager:
  cmd.run:
    - name: nmcli device set {{ pillar['network']['wireless'] }} managed no
    - unless: bash -c "if [[ \"$(nmcli device show {{ pillar['network']['wireless'] }} | sed -n 's/^GENERAL.STATE.*(\(.*\)).*$/\1/p')\" == \"unmanaged\" ]]; then exit 0; else exit 1; fi"

Configure keyfile block in NetworkManager.conf:
  file.append:
    - name: /etc/NetworkManager/NetworkManager.conf
    - text: |
        [keyfile]
        unmanaged-devices=interface-name:{{ pillar['network']['wireless'] }}

Delete {{ pillar['network']['interface'] }} connection:
  cmd.run:
    - name: nmcli connection delete {{ pillar['network']['interface'] }}
    - onlyif: nmcli connection show {{ pillar['network']['interface'] }} > /dev/null

Install hostapd:
  pkg.installed:
    - name: hostapd

Configure hostapd:
  file.managed:
    - name: /etc/hostapd.conf
    - source: salt://hostapd/files/hostapd.conf.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: "0600"

Create hostapd service unit file:
  file.managed:
    - name: /etc/systemd/system/hostapd.service
    - source: salt://hostapd/files/hostapd.service.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: "0644"

Reload systemd daemon:
  cmd.run:
    - name: systemctl daemon-reload
    - onchanges:
      - file: Create hostapd service unit file

Start hostapd:
  service.running:
    - name: hostapd
    - enable: True
    - watch:
      - file: Configure hostapd