redo salt setup

2026-04-03 20:04:32 +01:00
parent b36d658ba1
commit 17a2d4413b
12 changed files with 167 additions and 295 deletions
--- a/salt/configs.sls
+++ b/salt/configs.sls
@@ -1,11 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-
-{% for daemon in salt_daemons %}
-/etc/salt/{{ daemon }}:
-  file.managed:
-    - source: salt://salt/files/{{ daemon }}.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: 644
-{% endfor %}
--- a/salt/deb_install/init.sls
+++ b/salt/deb_install/init.sls
@@ -1,46 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-{% from "salt/deb_install/map.jinja" import osrelease, oscodename with context %}
-
-/etc/apt/keyrings/salt-archive-keyring-2023.pgp:
-  file.managed:
-    - source: https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
-    - source_hash: 36decef986477acb8ba2a1fc4041bcf9f22229ef6c939d0317c9e36a9d142b34
-
-/etc/apt/sources.list.d/salt.list:
-  file.managed:
-    - contents: deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.pgp arch=amd64] https://packages.broadcom.com/artifactory/saltproject-deb/ stable main
-
-salt-common:
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}'
-    - refresh: true
-    - require:
-      - file: /etc/apt/keyrings/salt-archive-keyring-2023.pgp
-      - file: /etc/apt/sources.list.d/salt.list
-
-salt {{ salt.pillar.get("salt:version") }}:
-  pkg.held:
-    - pkgs:
-      - salt-common
-{% for daemon in salt_daemons %}
-      - salt-{{ daemon }}
-{% endfor %}
-    - require:
-      - pkg: salt-common
-{% for daemon in salt_daemons %}
-      - pkg: salt-{{ daemon }}
-{% endfor %}
-  
-{% for daemon in salt_daemons %}
-salt-{{ daemon }}:
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}'
-    - require:
-      - pkg: salt-common
-  service.running:
-    - enable: true
-    - require:
-      - pkg: salt-{{ daemon }}
-    - listen:
-      - file: /etc/salt/{{ daemon }}
-{% endfor %}
--- a/salt/deb_install/map.jinja
+++ b/salt/deb_install/map.jinja
@@ -1,7 +0,0 @@
-{% if grains['os'] == 'Debian' and grains['osrelease']|int > 11 %}
-  {% set osrelease = 11 %}
-  {% set oscodename = 'bullseye' %}
-{% else %}
-  {% set osrelease = grains['osrelease'] %}
-  {% set oscodename = grains['oscodename'] %}
-{% endif %}
--- a/salt/files/SALT-PROJECT-GPG-PUBKEY-2023.pub
+++ b/salt/files/SALT-PROJECT-GPG-PUBKEY-2023.pub
@@ -1,41 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGNBGPazmABDAC6qc2st6/Uh/5AL325OB5+Z1XMFM2HhQNjB/VcYbLvcCx9AXsU
-eaEmNPm6OY3p5+j8omjpXPYSU7DUQ0lIutuAtwkDMROH7uH/r9IY7iu88S6w3q89
-bgbnqhu4mrSik2RNH2NqEiJkylz5rwj4F387y+UGH3aXIGryr+Lux9WxfqoRRX7J
-WCf6KOaduLSp9lF4qdpAb4/Z5yExXtQRA9HULSJZqNVhfhWInTkVPw+vUo/P9AYv
-mJVv6HRNlTb4HCnl6AZGcAYv66J7iWukavmYKxuIbdn4gBJwE0shU9SaP70dh/LT
-WqIUuGRZBVH/LCuVGzglGYDh2iiOvR7YRMKf26/9xlR0SpeU/B1g6tRu3p+7OgjA
-vJFws+bGSPed07asam3mRZ0Y9QLCXMouWhQZQpx7Or1pUl5Wljhe2W84MfW+Ph6T
-yUm/j0yRlZJ750rGfDKA5gKIlTUXr+nTvsK3nnRiHGH2zwrC1BkPG8K6MLRluU/J
-ChgZo72AOpVNq9MAEQEAAbQ5U2FsdCBQcm9qZWN0IFBhY2thZ2luZyA8c2FsdHBy
-b2plY3QtcGFja2FnaW5nQHZtd2FyZS5jb20+iQHSBBMBCAA8FiEEEIV//dP5Hq5X
-eiHWZMu8gXPXaz8FAmPazmACGwMFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheA
-AAoJEGTLvIFz12s/yf0L/jyP/LfduA4DwpjKX9Vpk26tgis9Q0I54UerpD5ibpTA
-krzZxK1yFOPddcOjo+Xqg+I8aA+0nJkf+vsfnRgcpLs2qHZkikwZbPduZwkNUHX7
-6YPSXTwyFlzhaRycwPtvBPLFjfmjjjTi/aH4V/frfxfjH/wFvH/xiaiFsYbP3aAP
-sJNTLh3im480ugQ7P54ukdte2QHKsjJ3z4tkjnu1ogc1+ZLCSZVDxfR4gLfE6GsN
-YFNd+LF7+NtAeJRuJceXIisj8mTQYg+esTF9QtWovdg7vHVPz8mmcsrG9shGr+G9
-iwwtCig+hAGtXFAuODRMur9QfPlP6FhJw0FX/36iJ2p6APZB0EGqn7LJ91EyOnWv
-iRimLLvlGFiVB9Xxw1TxnQMNj9jmB1CA4oNqlromO/AA0ryh13TpcIo5gbn6Jcdc
-fD4Rbj5k+2HhJTkQ78GpZ0q95P08XD2dlaM2QxxKQGqADJOdV2VgjB2NDXURkInq
-6pdkcaRgAKme8b+xjCcVjLkBjQRj2s5gAQwAxmgflHInM8oKQnsXezG5etLmaUsS
-EkV5jjQFCShNn9zJEF/PWJk5Df/mbODj02wyc749dSJbRlTY3LgGz1AeywOsM1oQ
-XkhfRZZqMwqvfx8IkEPjMvGIv/UI9pqqg/TY7OiYLEDahYXHJDKmlnmCBlnU96cL
-yh7a/xY3ZC20/JwbFVAFzD4biWOrAm1YPpdKbqCPclpvRP9N6nb6hxvKKmDo7MqS
-uANZMaoqhvnGazt9n435GQkYRvtqmqmOvt8I4oCzV0Y39HfbCHhhy64HSIowKYE7
-YWIujJcfoIDQqq2378T631BxLEUPaoSOV4B8gk/Jbf3KVu4LNqJive7chR8F1C2k
-eeAKpaf2CSAe7OrbAfWysHRZ060bSJzRk3COEACk/UURY+RlIwh+LQxEKb1YQueS
-YGjxIjV1X7ScyOvam5CmqOd4do9psOS7MHcQNeUbhnjm0TyGT9DF8ELoE0NSYa+J
-PvDGHo51M33s31RUO4TtJnU5xSRb2sOKzIuBABEBAAGJAbYEGAEIACAWIQQQhX/9
-0/kerld6IdZky7yBc9drPwUCY9rOYAIbDAAKCRBky7yBc9drP8ctC/9wGi01cBAW
-BPEKEnfrKdvlsaLeRxotriupDqGSWxqVxBVd+n0Xs0zPB/kuZFTkHOHpbAWkhPr+
-hP+RJemxCKMCo7kT2FXVR1OYej8Vh+aYWZ5lw6dJGtgo3Ebib2VSKdasmIOI2CY/
-03G46jv05qK3fP6phz+RaX+9hHgh1XW9kKbdkX5lM9RQSZOof3/67IN8w+euy61O
-UhNcrsDKrp0kZxw3S+b/02oP1qADXHz2BUerkCZa4RVK1pM0UfRUooOHiEdUxKKM
-DE501hwQsMH7WuvlIR8Oc2UGkEtzgukhmhpQPSsVPg54y9US+LkpztM+yq+zRu33
-gAfssli0MvSmkbcTDD22PGbgPMseyYxfw7vuwmjdqvi9Z4jdln2gyZ6sSZdgUMYW
-PGEjZDoMzsZx9Zx6SO9XCS7XgYHVc8/B2LGSxj+rpZ6lBbywH88lNnrm/SpQB74U
-4QVLffuw76FanTH6advqdWIqtlWPoAQcEkKf5CdmfT2ei2wX1QLatTs=
-=ZKPF
-----END PGP PUBLIC KEY BLOCK-----
--- a/salt/files/logrotate
+++ b/salt/files/logrotate
@@ -0,0 +1,50 @@
+/var/log/salt/master {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+	create 0640 salt salt
+}
+
+/var/log/salt/minion {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+}
+
+/var/log/salt/key {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+	create 0640 salt salt
+}
+
+/var/log/salt/api {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+	create 0640 salt salt
+}
+
+/var/log/salt/syndic {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+}
+
+/var/log/salt/proxy {
+	weekly
+	missingok
+	rotate 7
+	compress
+	notifempty
+}
--- a/salt/files/update_salt.sh
+++ b/salt/files/update_salt.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -e
+set -x
+SALT_VERSION='{{ salt.pillar.get("salt:version") }}'
+/usr/bin/salt-pip install "salt==$SALT_VERSION"
+/usr/bin/salt-pip install -r "https://raw.githubusercontent.com/saltstack/salt/refs/tags/v$SALT_VERSION/requirements/zeromq.txt"
--- a/salt/init.sls
+++ b/salt/init.sls
@@ -1,12 +1,74 @@
-include:
-  - salt.configs
-{% if grains['osarch'].lower().startswith('arm') or grains['os'] == 'Fedora' %}
-  - salt.pypi_install
-{% elif grains['os_family'] == 'Debian' %}
-  - salt.deb_install
-{% elif grains['os_family'] == 'RedHat' %}
-  - salt.rhel_install
-{% else %}
-  {{ raise("Unsupported grains.os") }}
+{% macro salt_daemon(daemon) %}
+salt-{{ daemon }}:
+  service.running:
+    - enable: true
+    - listen:
+      - file: /etc/salt/{{ daemon }}
+    - watch:
+      - cmd: update salt
+    - require:
+      - file: /lib/systemd/system/salt-{{ daemon }}.service
+      - module: systemd reload for salt
+/etc/salt/{{ daemon }}:
+  file.managed:
+    - source: salt://{{ slspath }}/files/{{ daemon }}.jinja
+    - template: jinja
+    - user: root
+    - group: root
+    - mode: 640
+/lib/systemd/system/salt-{{ daemon }}.service:
+  file.managed:
+    - source: salt://{{ slspath }}/files/salt-{{ daemon }}.service
+    - user: root
+    - group: root
+    - mode: 644
+{% endmacro %}
+
+/etc/logrotate.d/salt:
+  file.managed:
+    - source: salt://{{ slspath }}/files/logrotate
+    - user: root
+    - group: root
+    - mode: 644
+
+{{ salt_daemon("minion" ) }}
+
+{% if salt.pillar.get('salt:master', false) %}
+{{ salt_daemon("master" ) }}
 {% endif %}
-  - salt.modules
+
+systemd reload for salt:
+  module.run:
+    - name: service.systemctl_reload
+    - onchanges:
+      - file: /lib/systemd/system/salt-minion.service
+{% if salt.pillar.get('salt:master', false) %}
+      - file: /lib/systemd/system/salt-master.service
+{% endif %}
+
+saltutil.sync_all:
+  saltutil.sync_all:
+    - refresh: True
+
+salt dependencies:
+  pkg.installed:
+    - pkgs:
+      - usbutils  # for the lsusb grain
+      - dmidecode
+
+{% for link in ('salt', 'salt-call', 'salt-minion', 'salt-proxy', 'salt-run', 'salt-key') %}
+/usr/bin/{{ link }}:
+  file.symlink:
+    - target: /opt/saltstack/salt/bin/{{ link }}
+{% endfor %}
+/usr/bin/salt-pip:
+  file.symlink:
+    - target: /opt/saltstack/salt/bin/pip
+
+update salt:
+  cmd.script:
+    - source: salt://{{ slspath }}/files/update_salt.sh
+    - template: jinja
+    - unless: /usr/bin/salt-pip freeze | grep -q 'salt=={{ salt.pillar.get("salt:version") }}'
+    - require:
+      - file: /usr/bin/salt-pip
--- a/salt/map.jinja
+++ b/salt/map.jinja
@@ -1,5 +0,0 @@
-{% if salt.pillar.get('salt:master', false) %}
-{%   set salt_daemons = ['master', 'minion'] %}
-{% else %}
-{%   set salt_daemons = ['minion'] %}
-{% endif %}
--- a/salt/modules.sls
+++ b/salt/modules.sls
@@ -1,7 +0,0 @@
-saltutil.sync_all:
-  saltutil.sync_all:
-    - refresh: True
-
-{# required for the lsusb grain #}
-usbutils:
-  pkg.installed: []
--- a/salt/pypi_install.sls
+++ b/salt/pypi_install.sls
@@ -1,49 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-
-'make salt venv':
-  cmd.run:
-    - name: /usr/bin/python3 -m venv /opt/saltstack/salt
-    - creates: /opt/saltstack/salt
-
-pip install salt:
-  cmd.run:
-    - name: /opt/saltstack/salt/bin/pip3 install 'salt=={{ salt.pillar.get("salt:version") }}'
-    - unless: /opt/saltstack/salt/bin/pip3 freeze | grep -q 'salt=={{ salt.pillar.get("salt:version") }}'
-    - require:
-      - cmd: 'make salt venv'
-
-{%   for link in ('salt', 'salt-call', 'salt-minion', 'salt-proxy', 'salt-run', 'salt-key') %}
-/usr/bin/{{ link }}:
-  file.symlink:
-    - target: /opt/saltstack/salt/bin/{{ link }}
-{%   endfor %}
-/usr/bin/salt-pip:
-  file.symlink:
-    - target: /opt/saltstack/salt/bin/pip3
-
-systemd reload for salt:
-  module.run:
-    - name: service.systemctl_reload
-    - onchanges:
-{%   for daemon in salt_daemons %}
-      - file: /lib/systemd/system/salt-{{ daemon }}.service
-{%   endfor %}
-
-{%   for daemon in salt_daemons %}
-/lib/systemd/system/salt-{{ daemon }}.service:
-  file.managed:
-    - source: salt://salt/files/salt-{{ daemon }}.service
-    - user: root
-    - group: root
-    - mode: 644
-salt-{{ daemon }}:
-  service.running:
-    - enable: true
-    - require:
-      - file: /lib/systemd/system/salt-{{ daemon }}.service
-      - module: systemd reload for salt
-    - watch:
-      - cmd: pip install salt
-    - listen:
-      - file: /etc/salt/{{ daemon }}
-{%   endfor %}
--- a/salt/rhel_install.sls
+++ b/salt/rhel_install.sls
@@ -1,42 +0,0 @@
-{% from "salt/map.jinja" import salt_daemons with context %}
-
-{% if grains['os'] not in ('CentOS', 'AlmaLinux') %}
-  {{ raise("Unsupported distro") }}
-{% endif %}
-
-/etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023:
-  file.managed:
-    - source: salt://salt/files/SALT-PROJECT-GPG-PUBKEY-2023.pub
-salt:
-  pkgrepo.managed:
-    - baseurl: "https://repo.saltproject.io/salt/py3/redhat/{{ grains['osmajorrelease'] }}/x86_64/minor/{{ salt.pillar.get("salt:version") }}"
-    - humanname: Salt repo for RHEL/CentOS/AlmaLinux {{ grains['osmajorrelease'] }} PY3
-    - gpgkey: file:///etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023
-    - skip_if_unavailable: true
-    - failovermethod: priority
-    - priority: 10
-    - enabled: 1
-    - enabled_metadata: 1
-    - gpgcheck: 1
-    - gpgkey: file:///etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023
-    - require:
-      - file: /etc/pki/rpm-gpg/SALT-PROJECT-GPG-PUBKEY-2023
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}-*'
-    - refresh: true
-    - require:
-      - pkgrepo: salt
-
-{% for daemon in salt_daemons %}
-salt-{{ daemon }}:
-  pkg.installed:
-    - version: '{{ salt.pillar.get("salt:version") }}-*'
-    - require:
-      - pkg: salt
-  service.running:
-    - enable: true
-    - require:
-      - pkg: salt-{{ daemon }}
-    - listen:
-      - file: /etc/salt/{{ daemon }}
-{% endfor %}
--- a/setup.sh
+++ b/setup.sh
@@ -1,8 +1,7 @@
 #!/bin/bash
-
 set -e

-SALT_VERSION='3007.1'
+SALT_VERSION='3007.13'

 CYAN='\033[1;36m'
 RED='\033[0;31m'
@@ -13,90 +12,53 @@ if [ $UID -ne 0 ]; then
  exit 1
 fi

-if [ -f /etc/debian_version ]; then
-  PKG_CHECK='dpkg -l'
-  PKG_INSTALL='apt-get -y install'
-elif [ -f /etc/redhat-release ]; then
-  PKG_CHECK='rpm -q'
-  PKG_INSTALL='yum -y install'
-else
-  echo -e "${RED}Unrecognized OS${NC}"
-  exit 1
+if [ -f /usr/bin/dnf ]; then
+  dnf -d0 -y install pciutils-libs || :
 fi

-TO_INSTALL=""
-for PKG in jq curl python3-distro; do
-  if ! $PKG_CHECK $PKG &>/dev/null; then
-    TO_INSTALL="$TO_INSTALL $PKG"
-  fi
-done
-if [ -n "$TO_INSTALL" ]; then
-  echo -e "${CYAN}Installing ${TO_INSTALL}${NC}"
-  $PKG_INSTALL $TO_INSTALL
-fi
-
-DISTRO="$(python3 -m distro --json | jq -r .id)"
-CODENAME="$(python3 -m distro --json | jq -r .codename)"
-OS_VERSION="$(python3 -m distro --json | jq -r .version)"
 PUBLIC_IPV4="$(curl -s -4 ifconfig.me)"

-echo -e -n "${CYAN}Ensure $PUBLIC_IPV4 is whitelisted on the salt master, then press enter${NC}"
+echo -e -n "${CYAN}Add $PUBLIC_IPV4 to the firewall on on the salt master, then press enter${NC}"
 read

-if ! [ -e /usr/bin/salt-call ]; then
-  if [[ "$DISTRO" == "fedora" ]]; then
-    mkdir -p /etc/salt/pki/minion
-    echo -e "${CYAN}Fedora detected - installing Python3.10 if not present, then using a venv${NC}"
-    if ! which python3.10 &>/dev/null; then
-      wget -O /usr/local/bin/python3.10 https://github.com/niess/python-appimage/releases/download/python3.10/python3.10.13-cp310-cp310-manylinux_2_28_x86_64.AppImage
-      chmod +x /usr/local/bin/python3.10
+mkdir -p /etc/salt/pki/minion \
+  /etc/salt/minion.d \
+  /var/cache/salt/minion \
+  /var/log/salt \
+  /var/run/salt
+
+if [ -e /opt/saltstack/salt/bin/salt-call ]; then
+  echo "/opt/saltstack/salt/bin/salt-call already exists"
+else
+  if ! [ -f /root/.local/bin/python3.10 ]; then
+    if ! [ -f /root/.local/bin/uv ]; then
+      echo -e "${CYAN}Installing uv${NC}"
+      curl -LsSf https://astral.sh/uv/install.sh | sh
    fi
-    [ -e /opt/saltstack/salt ] ||
-      /usr/local/bin/python3.10 -m venv /opt/saltstack/salt
-    /opt/saltstack/salt/bin/pip3 freeze | grep -q ^salt== ||
-      /opt/saltstack/salt/bin/pip3 install "salt==$SALT_VERSION"
-    ln -sfT /opt/saltstack/salt/bin/salt-call /usr/bin/salt-call
-  elif [[ "$(uname -m)" =~ arm* ]]; then
-    echo -e "${CYAN}Arm CPU detected. Using venv install method${NC}"
-    [ -e /opt/saltstack/salt ] ||
-      python3 -m venv /opt/saltstack/salt
-    /opt/saltstack/salt/bin/pip3 freeze | grep -q ^salt== ||
-      /opt/saltstack/salt/bin/pip3 install "salt==$SALT_VERSION"
-    ln -sfT /opt/saltstack/salt/bin/salt-call /usr/bin/salt-call
-  elif [[ "$DISTRO" == "centos" ]] || [[ "$DISTRO" == "almalinux" ]]; then
-    if [[ "$DISTRO" == "almalinux" ]]; then
-        OS_VERSION="$(python3 -m distro --json | jq -r .version_parts.major)"
+    if ! [ -f /root/.local/bin/uv ]; then
+      echo -e "${RED}Failed to install uv${NC}"
+      exit 1
    fi
-    rpm --import https://repo.saltproject.io/salt/py3/redhat/$OS_VERSION/x86_64/SALT-PROJECT-GPG-PUBKEY-2023.pub
-    [ -f /etc/yum.repos.d/salt.repo ] ||
-      curl -fsSL -o /etc/yum.repos.d/salt.repo https://repo.saltproject.io/salt/py3/redhat/$OS_VERSION/x86_64/minor/$SALT_VERSION.repo
-    yum clean all
-    yum install -y salt-minion
-  elif [[ "$DISTRO" == "ubuntu" ]]; then
-    mkdir -p /etc/apt/keyrings
-    KEYPATH=/etc/apt/keyrings/salt-archive-keyring-2023.gpg
-    curl -fsSL -o $KEYPATH https://repo.saltproject.io/salt/py3/ubuntu/$OS_VERSION/amd64/SALT-PROJECT-GPG-PUBKEY-2023.gpg
-    [ -f /etc/apt/sources.list.d/salt.list ] ||
-      echo "deb [signed-by=$KEYPATH arch=amd64] https://repo.saltproject.io/salt/py3/ubuntu/$OS_VERSION/amd64/minor/$SALT_VERSION $CODENAME main" > /etc/apt/sources.list.d/salt.list
-    apt-get update
-    apt-get -y install salt-minion
-  elif [[ "$DISTRO" == "debian" ]]; then
-    if [ $OS_VERSION -gt 11 ]; then
-      OS_VERSION=11
-      CODENAME=bullseye
-    fi
-    mkdir -p /etc/apt/keyrings
-    KEYPATH=/etc/apt/keyrings/salt-archive-keyring-2023.gpg
-    [ -f $KEYPATH ] ||
-      curl -fsSL -o $KEYPATH https://repo.saltproject.io/salt/py3/debian/$OS_VERSION/amd64/SALT-PROJECT-GPG-PUBKEY-2023.gpg
-    [ -f /etc/apt/sources.list.d/salt.list ] ||
-      echo "deb [signed-by=$KEYPATH arch=amd64] https://repo.saltproject.io/salt/py3/debian/$OS_VERSION/amd64/minor/$SALT_VERSION $CODENAME main" > /etc/apt/sources.list.d/salt.list
-    apt-get update
-    apt-get -y install salt-minion
-  else
-    echo -e "${RED}Unrecognized OS${NC}"
+    /root/.local/bin/uv python update-shell || true
+    export PATH="/root/.local/bin:$PATH"
+    echo -e "${CYAN}Installing Python 3.10 with uv${NC}"
+    uv python install 3.10
+  fi
+  if ! [ -f /root/.local/bin/python3.10 ]; then
+    echo -e "${RED}Failed to install python 3.10${NC}"
    exit 1
  fi
+  if ! [ -e /opt/saltstack/salt ]; then
+    echo -e "${CYAN}Setting up venv in /opt/saltstack/salt${NC}"
+    /root/.local/bin/python3.10 -m venv /opt/saltstack/salt
+    /opt/saltstack/salt/bin/pip install -U pip
+  fi
+  if ! /opt/saltstack/salt/bin/pip freeze | grep -q ^salt== ; then
+    echo -e "${CYAN}Installing salt $SALT_VERSION${NC}"
+    /opt/saltstack/salt/bin/pip install "salt==$SALT_VERSION"
+    /opt/saltstack/salt/bin/pip install -r "https://raw.githubusercontent.com/saltstack/salt/refs/tags/v$SALT_VERSION/requirements/zeromq.txt"
+  fi
+  ln -svfT /opt/saltstack/salt/bin/salt-call /usr/bin/salt-call
 fi

 APPLY='salt-call state.apply --master=kpi.keiran.us salt'