From 2f489895ef870f1ada7879f0606159c56b4813ae Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 29 Mar 2022 10:17:21 -0400
Subject: [PATCH] top match and remove_gui state

---
 salt/top.sls                    | 6 +++++-
 salt/workstation/remove_gui.sls | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 salt/workstation/remove_gui.sls

diff --git a/salt/top.sls b/salt/top.sls
index 6e2de8d33..dd41ff9fe 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -511,6 +511,10 @@ base:
     - filebeat
     - idh
 
-  '*_workstation and G@saltversion:{{saltversion}}':
+  'J@workstation:gui:enabled:^[Tt][Rr][Uu][Ee]$ and ( G@saltversion:{{saltversion}} and G@os:CentOS )':
     - match: compound
     - workstation
+
+  'J@workstation:gui:enabled:^[Ff][Aa][Ll][Ss][Ee]$ and ( G@saltversion:{{saltversion}} and G@os:CentOS )':
+    - match: compound
+    - workstation.remove_gui
diff --git a/salt/workstation/remove_gui.sls b/salt/workstation/remove_gui.sls
new file mode 100644
index 000000000..96880a5ab
--- /dev/null
+++ b/salt/workstation/remove_gui.sls
@@ -0,0 +1,5 @@
+remove_graphical_target:
+  file.symlink:
+    - name: /etc/systemd/system/default.target
+    - target: /lib/systemd/system/multi-user.target
+    - force: True