{% set system = salt['grains.filter_by']({
    'Arch': {
        'pkgs': ['sudo', 'vim', 'wget'],
        'utc': true,
        'user': {},
        'group': {},
        'job': {},
        'limit': {},
        'locale': {},
        'motd': {},
        'env': {},
        'profile': {},
        'proxy': {},
        'repo': {},
        'package': {},
        'autoupdates': {
          'pkgs': []
         },
        'selinux': 'permissive',
        'ca_certs_dir': '/usr/local/share/ca-certificates',
        'ca_certs_bin': 'update-ca-certificates',
        'atop': {
             'enabled': false,
             'interval': '20',
             'autostart': true,
             'logpath': '/var/log/atop',
             'outfile': '/var/log/atop/daily.log'
         },
         'sosreport': {},
    },
    'Debian': {
        'pkgs': ['python-apt', 'apt-transport-https', 'libmnl0'],
        'utc': true,
        'user': {},
        'group': {},
        'create_default_group_for_user': true,
        'job': {},
        'limit': {},
        'locale': {},
        'motd': {},
        'motd_news': {
             'enabled': false
        },
        'env': {},
        'profile': {},
        'proxy': {},
        'repo': {},
        'package': {},
        'autoupdates': {
             'pkgs': ['unattended-upgrades']
         },
        'selinux': 'permissive',
        'ca_certs_dir': '/usr/local/share/ca-certificates',
        'ca_certs_bin': 'update-ca-certificates',
        'atop': {
             'enabled': false,
             'interval': '20',
             'autostart': true,
             'logpath': '/var/log/atop',
             'outfile': '/var/log/atop/daily.log'
         },
         'sosreport': {},
    },
    'RedHat': {
        'pkgs': ['policycoreutils', 'policycoreutils-python', 'telnet', 'wget'],
        'utc': true,
        'user': {},
        'group': {},
        'job': {},
        'limit': {},
        'locale': {},
        'motd': {},
        'env': {},
        'profile': {},
        'proxy': {},
        'repo': {},
        'package': {},
        'autoupdates': {
             'pkgs': []
         },
        'selinux': 'permissive',
        'ca_certs_dir': '/etc/pki/ca-trust/source/anchors',
        'ca_certs_bin': 'update-ca-trust extract',
        'atop': {
             'enabled': false,
             'interval': '20',
             'autostart': true,
             'logpath': '/var/log/atop',
             'outfile': '/var/log/atop/daily.log'
         },
         'sosreport': {}
    },
}, grain='os_family', merge=salt['pillar.get']('linux:system')) %}

{% set at = salt['grains.filter_by']({
    'Debian': {
        'enabled': false,
        'pkgs': ['at'],
        'services': ['atd'],
        'user': {}
    },
}, grain='os_family', merge=salt['pillar.get']('linux:system:at')) %}

{% set cron = salt['grains.filter_by']({
    'Debian': {
        'enabled': false,
        'pkgs': ['cron'],
        'services': ['cron'],
        'user': {}
    },
}, grain='os_family', merge=salt['pillar.get']('linux:system:cron')) %}

{% set banner = salt['grains.filter_by']({
    'BaseDefaults': {
        'enabled': false,
    },
}, grain='os_family', merge=salt['pillar.get']('linux:system:banner'), base='BaseDefaults') %}

{% set auth = salt['grains.filter_by']({
    'Arch': {
        'enabled': false,
        'duo': {
            'enabled': false,
            'duo_host': 'localhost',
            'duo_ikey': '',
            'duo_skey': ''
        }
    },
    'RedHat': {
        'enabled': false,
        'duo': {
            'enabled': false,
            'duo_host': 'localhost',
            'duo_ikey': '',
            'duo_skey': ''
        }
    },
    'Debian': {
        'enabled': false,
        'duo': {
            'enabled': false,
            'duo_host': 'localhost',
            'duo_ikey': '',
            'duo_skey': ''
        }
    },
}, grain='os_family', merge=salt['pillar.get']('linux:system:auth')) %}

{% set ldap = salt['grains.filter_by']({
    'RedHat': {
        'enabled': false,
        'pkgs': ['openldap-clients', 'nss-pam-ldapd', 'authconfig', 'nscd'],
        'version': '3',
        'scope': 'sub',
        'uid': 'nslcd',
        'gid': 'nslcd',
    },
    'Debian': {
        'enabled': false,
        'pkgs': ['libnss-ldapd', 'libpam-ldapd', 'nscd'],
        'version': '3',
        'scope': 'sub',
        'uid': 'nslcd',
        'gid': 'nslcd',
    },
}, grain='os_family', merge=salt['pillar.get']('linux:system:auth:ldap')) %}

{%- load_yaml as login_defs_defaults %}
Debian:
    CHFN_RESTRICT:
        value: 'rwh'
    DEFAULT_HOME:
        value: 'yes'
    ENCRYPT_METHOD:
        value: 'SHA512'
    ENV_PATH:
        value: 'PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games'
    ENV_SUPATH:
        value: 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
    ERASECHAR:
        value: '0177'
    FAILLOG_ENAB:
        value: 'yes'
    FTMP_FILE:
        value: '/var/log/btmp'
    GID_MAX:
        value: '60000'
    GID_MIN:
        value: '1000'
    HUSHLOGIN_FILE:
        value: '.hushlogin'
    KILLCHAR:
        value: '025'
    LOGIN_RETRIES:
        value: '5'
    LOGIN_TIMEOUT:
        value: '60'
    LOG_OK_LOGINS:
        value: 'no'
    LOG_UNKFAIL_ENAB:
        value: 'no'
    MAIL_DIR:
        value: '/var/mail'
    PASS_MAX_DAYS:
        value: '99999'
    PASS_MIN_DAYS:
        value: '0'
    PASS_WARN_AGE:
        value: '7'
    SU_NAME:
        value: 'su'
    SYSLOG_SG_ENAB:
        value: 'yes'
    SYSLOG_SU_ENAB:
        value: 'yes'
    TTYGROUP:
        value: 'tty'
    TTYPERM:
        value: '0600'
    UID_MAX:
        value: '60000'
    UID_MIN:
        value: '1000'
    UMASK:
        value: '022'
    USERGROUPS_ENAB:
        value: 'yes'
{%- endload %}
{%- set login_defs = salt['grains.filter_by'](login_defs_defaults,
    grain='os_family', merge=salt['pillar.get']('linux:system:login_defs')) %}

{#    'network_name', #}

{% set interface_params = [
    'gateway',
    'mtu',
    'network',
    'broadcast',
    'master',
    'miimon',
    'ovs_ports',
    'ovs_bridge',
    'mode',
    'port_type',
    'peer',
    'lacp-rate',
    'dns-search',
    'up_cmds',
    'pre_up_cmds',
    'post_up_cmds',
    'down_cmds',
    'pre_down_cmds',
    'post_down_cmds',
    'maxwait',
    'stp',
    'gro',
    'rx',
    'tx',
    'sg',
    'tso',
    'ufo',
    'gso',
    'lro',
    'lacp_rate',
    'ad_select',
    'downdelay',
    'updelay',
    'hashing-algorithm',
    'hardware-dma-ring-rx',
    'hwaddr',
    'noifupdown',
    'arp_ip_target',
    'primary',
] %}
{% set debian_headers = "linux-headers-" + grains.get('kernelrelease')|string %}
{% set network = salt['grains.filter_by']({
    'Arch': {
        'pkgs': ['wpa_supplicant', 'dhclient', 'wireless_tools', 'ifenslave'],
        'bridge_pkgs': ['bridge-utils', 'vlan'],
        'ovs_pkgs': ['openvswitch-switch', 'vlan'],
        'hostname_file': '/etc/hostname',
        'network_manager': False,
        'systemd': {},
        'interface': {},
        'interface_params': interface_params,
        'bridge': 'none',
        'proxy': {
           'host': 'none',
        },
        'host': {},
        'mine_dns_records': False,
        'dhclient_config': '/etc/dhcp/dhclient.conf',
        'ovs_nowait': False,
    },
    'Debian': {
        'pkgs': ['ifenslave'],
        'hostname_file': '/etc/hostname',
        'bridge_pkgs': ['bridge-utils', 'vlan'],
        'ovs_pkgs': ['openvswitch-switch', 'bridge-utils', 'vlan'],
        'dpdk_pkgs': ['dpdk', 'dpdk-dev', 'dpdk-igb-uio-dkms', 'dpdk-rte-kni-dkms', debian_headers.encode('utf8') ],
        'network_manager': False,
        'systemd': {},
        'interface': {},
        'interface_params': interface_params,
        'bridge': 'none',
        'proxy': {
           'host': 'none'
        },
        'host': {},
        'mine_dns_records': False,
        'dhclient_config': '/etc/dhcp/dhclient.conf',
        'ovs_nowait': False,
    },
    'RedHat': {
        'pkgs': ['iputils'],
        'bridge_pkgs': ['bridge-utils', 'vlan'],
        'ovs_pkgs': ['openvswitch-switch', 'bridge-utils', 'vlan'],
        'hostname_file': '/etc/sysconfig/network',
        'network_manager': False,
        'systemd': {},
        'interface': {},
        'interface_params': interface_params,
        'bridge': 'none',
        'proxy': {
           'host': 'none'
        },
        'host': {},
        'mine_dns_records': False,
        'dhclient_config': '/etc/dhcp/dhclient.conf',
        'ovs_nowait': False,
    },
}, grain='os_family', merge=salt['pillar.get']('linux:network')) %}

{% set storage = salt['grains.filter_by']({
    'Arch': {
        'mount': {},
        'swap': {},
        'disk': {},
        'lvm': {},
        'lvm_services': ['lvm2-lvmetad', 'lvm2-lvmpolld', 'lvm2-monitor'],
        'loopback': {},
        'nfs': {
             'pkgs': ['nfs-utils']
         },
        'multipath': {
             'enabled': False,
             'pkgs': ['multipath-tools', 'multipath-tools-boot'],
             'service': ''
         },
    },
    'Debian': {
        'mount': {},
        'swap': {},
        'lvm': {},
        'disk': {},
        'lvm_services': ['lvm2-lvmetad', 'lvm2-lvmpolld', 'lvm2-monitor'],
        'loopback': {},
        'nfs': {
             'pkgs': ['nfs-common']
         },
        'multipath': {
             'enabled': False,
             'pkgs': ['multipath-tools', 'multipath-tools-boot'],
             'service': 'multipath-tools'
         },
        'lvm_pkgs': ['lvm2'],
    },
    'RedHat': {
        'mount': {},
        'swap': {},
        'lvm': {},
        'disk': {},
        'lvm_services': ['lvm2-lvmetad', 'lvm2-lvmpolld', 'lvm2-monitor'],
        'loopback': {},
        'nfs': {
             'pkgs': ['nfs-utils']
         },
        'multipath': {
             'enabled': False,
             'pkgs': [],
             'service': 'multipath'
         },
    },
}, merge=salt['grains.filter_by']({
    'trusty': {
        'lvm_services': ['udev'],
    },
}, grain='oscodename', merge=salt['pillar.get']('linux:storage'))) %}

{% set monitoring = salt['grains.filter_by']({
    'default': {
        'bond_status': {
            'interfaces': False
        },
        'zombie': {
            'warn': 3,
            'crit': 7,
        },
        'procs': {
            'warn': 5000,
            'crit': 10000,
        },
        'load': {
            'warn': '6,4,2',
            'crit': '12,8,4',
        },
        'swap': {
            'warn': '50%',
            'crit': '20%',
        },
        'disk': {
            'warn': '15%',
            'crit': '5%',
        },
        'netlink': {
            'interfaces': [],
            'interface_regex': '^[a-z0-9]+$',
            'ignore_selected': False,
        },
        'cpu_usage_percentage': {
              'warn': 90.0,
        },
        'cpu_steal_percentage': {
              'warn': 5.0,
              'crit': 10.0,
        },
        'memory_usage_percentage': {
            'warn': 90.0,
            'major': 95.0,
        },
        'disk_usage_percentage': {
            'warn': 85.0,
            'major': 95.0,
        },
        'inodes_usage_percentage': {
            'warn': 85.0,
            'major': 95.0,
        },
        'system_load_threshold': {
            'warn': 1,
            'crit': 2,
        },
        'rx_packets_dropped_threshold': {
            'warn': 60,
        },
        'tx_packets_dropped_threshold': {
            'warn': 100,
        },
        'swap_in_rate': {
            'warn': 1024 * 1024,
        },
        'swap_out_rate': {
            'warn': 1024 * 1024,
        },
        'failed_auths_threshold': {
            'warn': 5,
        },
        'netdev_budget_squeeze_rate': 0.1
    },
}, grain='os_family', merge=salt['pillar.get']('linux:monitoring')) %}

{%- set sysctl_min_kernel = {
    'net.core.netdev_budget_usecs': '4.12',
} %}