Saltstack docker

services:
  salt-master:
    image: saltstack/salt:latest
    container_name: salt-master
    restart: unless-stopped
    ports:
      - "4505:4505"
      - "4506:4506"
    volumes:
      - ./config/master:/etc/salt/master:ro
      - salt-pki:/etc/salt/pki
      - ./srv/salt:/srv/salt
      - ./srv/pillar:/srv/pillar
      - salt-cache:/var/cache/salt
      - salt-run:/var/run/salt

  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    environment:
      # Run at 2:00 AM every night
      # Format: Seconds Minutes Hours DayOfMonth Month DayOfWeek
      - WATCHTOWER_SCHEDULE=0 0 2 * * *
      # Remove old unpatched image layers from disk after updating
      - WATCHTOWER_CLEANUP=true
      # Check for base image updates regardless of local tag
      - WATCHTOWER_INCLUDE_RESTARTING=true
    volumes:
      # CRITICAL: This must point to the rootless user's socket, not /var/run!
      # Replace '1001' with the output of `id -u`
      - /run/user/1001/docker.sock:/var/run/docker.sock
    # Restrict Watchtower to ONLY update the salt-master container
    command: salt-master

volumes:
  salt-pki:
  salt-cache:
  salt-run:

#!/bin/bash
set -e

# ==========================================
# CONFIGURATION
# ==========================================
# Replace with your Dockerized Salt Master's IP or DNS name
SALT_MASTER="mysalt.example.com" 

# Uses the machine's hostname by default, or you can hardcode a name (e.g., "web-server-01")
MINION_ID=$(hostname) 
# ==========================================

if [[ $EUID -ne 0 ]]; then
   echo "Error: This script must be run as root. Try using: sudo $0"
   exit 1
fi

echo "==> Installing prerequisites..."
apt-get update
apt-get install -y curl gnupg

echo "==> Adding Salt Project repository for Ubuntu 24.04 LTS (Noble)..."
mkdir -p /etc/apt/keyrings
curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg \
  https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/SALT-PROJECT-GPG-PUBKEY-2023.gpg

echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=amd64] https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/3006 noble main" \
  | tee /etc/apt/sources.list.d/salt.list > /dev/null

echo "==> Installing Salt Minion..."
apt-get update
apt-get install -y salt-minion

echo "==> Configuring Minion to connect to $SALT_MASTER..."
mkdir -p /etc/salt/minion.d
echo "master: $SALT_MASTER" > /etc/salt/minion.d/master.conf
echo "$MINION_ID" > /etc/salt/minion_id

echo "==> Enabling and starting Salt Minion service..."
systemctl enable --now salt-minion
systemctl restart salt-minion

echo "=================================================="
echo "Success! The Salt Minion ($MINION_ID) is running."
echo "It has sent its public key to $SALT_MASTER."
echo "You must now log into the Master server and accept this key."
echo "=================================================="

# List pending keys to verify the minion showed up
docker compose exec salt-master salt-key -L

# Accept the specific minion key
docker compose exec salt-master salt-key -a