securityonion

mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-09 04:42:40 +02:00

Files

T

Mike Reeves 1abfd77351 Hide telegraf password from console and close so-minion race

Two fixes on the postgres telegraf fan-out path:

1. postgres.auth cmd.run leaked the password to the console because
   Salt always prints the Name: field and `show_changes: False` does
   not apply to cmd.run. Move the user and password into the `env:`
   attribute so the shell body still sees them via $PG_USER / $PG_PASS
   but Salt's state reporter never renders them.

2. so-minion's addMinion -> setupMinionFiles sequence removes the
   minion pillar file and rewrites it from scratch, which wipes the
   postgres.telegraf.* entries the reactor may have already written on
   salt-key accept. Add a postgres.auth fan-out step to
   orch.deploy_newnode (the orch so-minion kicks off after
   setupMinionFiles) and require it from the new minion's highstate.
   Idempotent via the existing unless: guard in postgres.auth.

2026-04-21 15:10:57 -04:00

files

Use TELEGRAFMERGED for telegraf.output and de-jinja pg_hba.conf

2026-04-20 16:06:01 -04:00

tools/sbin

Move postgres backup script and cron to the postgres states

2026-04-21 09:42:41 -04:00

auth.sls

Hide telegraf password from console and close so-minion race

2026-04-21 15:10:57 -04:00

config.sls

Tidy config.sls makedirs and postgres helpLinks