0
0
mirror of https://github.com/saltstack-formulas/users-formula.git synced 2024-12-24 02:56:10 +01:00
users-formula/pillar.example

186 lines
5.3 KiB
Plaintext
Raw Normal View History

users-formula:
2018-06-12 19:02:57 +02:00
use_vim_formula: True
lookup: # override the defauls in map.jinja
root_group: root
2013-07-28 00:53:23 +02:00
users:
## Minimal required pillar values
2013-07-28 00:53:23 +02:00
auser:
fullname: A User
## Full list of pillar values
2018-10-03 17:35:06 +02:00
allow_gid_change: False
buser:
fullname: B User
2014-04-25 04:51:11 +02:00
password: $6$w.............
enforce_password: True
# WARNING: If 'empty_password' is set to True, the 'password' statement
# will be ignored by enabling password-less login for the user.
empty_password: False
2016-12-01 16:59:51 +01:00
hash_password: False
system: False
2014-03-30 20:31:47 +02:00
home: /custom/buser
2016-06-13 17:22:09 +02:00
homedir_owner: buser
homedir_group: primarygroup
user_dir_mode: 750
createhome: True
roomnumber: "A-1"
workphone: "(555) 555-5555"
homephone: "(555) 555-5551"
manage_vimrc: False
2018-10-03 17:35:06 +02:00
allow_gid_change: True
manage_bashrc: False
2015-08-09 18:59:51 +02:00
manage_profile: False
2014-12-22 14:22:46 +01:00
expire: 16426
2018-06-14 20:12:13 +02:00
# Disables user management except sudo rules.
# Useful for setting sudo rules for system accounts created by package instalation
sudoonly: False
sudouser: True
# sudo_rules doesn't need the username as a prefix for the rule
# this is added automatically by the formula.
# ----------------------------------------------------------------------
# In case your sudo_rules have a colon please have in mind to not leave
# spaces around it. For example:
# ALL=(ALL) NOPASSWD: ALL <--- THIS WILL NOT WORK (Besides syntax is ok)
# ALL=(ALL) NOPASSWD:ALL <--- THIS WILL WORK
2014-12-22 14:22:46 +01:00
sudo_rules:
2014-03-30 22:31:20 +02:00
- ALL=(root) /usr/bin/find
- ALL=(otheruser) /usr/bin/script.sh
sudo_defaults:
- '!requiretty'
shell: /bin/bash
remove_groups: False
prime_group:
name: primarygroup
gid: 500
groups:
- users
optional_groups:
- some_groups_that_might
- not_exist_on_all_minions
ssh_key_type: rsa
# You can inline the private keys ...
ssh_keys:
privkey: PRIVATEKEY
pubkey: PUBLICKEY
2018-02-14 07:12:58 +01:00
# or you can provide path to key on Salt fileserver
privkey: salt://path_to_PRIVATEKEY
pubkey: salt://path_to_PUBLICKEY
# you can provide multiple keys, the keyname is taken as filename
# make sure your public keys suffix is .pub
2017-04-08 16:45:17 +02:00
foobar: PRIVATEKEY
foobar.pub: PUBLICKEY
# ... or you can pull them from a different pillar,
# for example one called "ssh_keys":
ssh_keys_pillar:
id_rsa: "ssh_keys"
another_key_pair: "ssh_keys"
2013-07-28 00:53:23 +02:00
ssh_auth:
2014-02-14 15:33:03 +01:00
- PUBLICKEY
ssh_auth.absent:
- PUBLICKEY_TO_BE_REMOVED
# Generates an authorized_keys file for the user
# with the given keys
ssh_auth_file:
- PUBLICKEY
# ... or you can pull them from a different pillar similar to ssh_keys_pillar
ssh_auth_pillar:
id_rsa: "ssh_keys"
# If you prefer to keep public keys as files rather
# than inline in pillar, this works.
ssh_auth_sources:
- salt://keys/buser.id_rsa.pub
ssh_auth_sources.absent:
- salt://keys/deleteduser.id_rsa.pub # PUBLICKEY_FILE_TO_BE_REMOVED
# Manage the ~/.ssh/config file
ssh_known_hosts:
importanthost:
port: 22
fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48
key: PUBLICKEY
enc: ssh-rsa
hash_known_hosts: True
timeout: 5
fingerprint_hash_type: sha256
ssh_known_hosts.absent:
- notimportanthost
ssh_config:
all:
hostname: "*"
options:
- "StrictHostKeyChecking no"
- "UserKnownHostsFile=/dev/null"
importanthost:
hostname: "needcheck.example.com"
options:
- "StrictHostKeyChecking yes"
# Using gitconfig without Git installed will result in an error
# https://docs.saltstack.com/en/latest/ref/states/all/salt.states.git.html:
# This state module now requires git 1.6.5 (released 10 October 2009) or newer.
gitconfig:
user.name: B User
user.email: buser@example.com
"url.https://.insteadOf": "git://"
gitconfig.absent:
- push.default
- color\..+
2015-07-01 18:15:31 +02:00
google_2fa: True
google_auth:
ssh: |
SOMEGAUTHHASHVAL
" RESETTING_TIME_SKEW 46956472+2 46991595-2
" RATE_LIMIT 3 30 1415800560
" DISALLOW_REUSE 47193352
" TOTP_AUTH
11111111
22222222
33333333
44444444
55555555
2018-06-14 20:12:13 +02:00
# unique: True allows user to have non unique uid
unique: False
uid: 1001
user_files:
enabled: True
# 'source' allows you to define an arbitrary directory to sync, useful to use for default files.
# should be a salt fileserver path either with or without 'salt://'
# if not present, it defaults to 'salt://users/files/user/<username>
source: users/files/default
template: jinja
# You can specify octal mode for files and symlinks that will be copied. Since version 2016.11.0
# it's possible to use 'keep' for file_mode, to preserve file original mode, thus you can save
# execution bit for example.
file_mode: keep
sym_mode: 640
exclude_pat: "*.gitignore"
## Absent user
cuser:
absent: True
purge: True
force: True
## Old syntax of absent_users still supported
absent_users:
- donald
- bad_guy
2019-03-07 11:55:56 +01:00
groups:
badguys:
absent: True
niceguys:
gid: 4242
system: False
addusers: root
delusers: toor
ssl-cert:
system: True
members:
- www-data
- openldap