GUI?

[ZsBT]

Are you interested in implementing a web GUI? The https://github.com/erwindon/SaltGUI project is quite stable, I've been using it for years.
I'd be happy to help with merging this feature.

[cdalvaro]

Hi, thanks a lot for bringing this up for discussion.

This is something I've considered several times over the years, but ultimately decided against for the following reasons:

SaltGUI is not an official SaltStack project, and I generally prefer not to include third-party tools in the image.
I want to keep the image simple, lightweight, and as generic as possible so it's broadly applicable to all use cases.
That said, I'm open to doing some tests to see how well it works in practice.

If it turns out to be a good fit, I could consider publishing parallel images with -gui tags that include this support.

What do you think?

[ZsBT]

You are right - touching a stable image is not a good idea for cosmetic purposes.
In the light of the above-mentioned points, what if we planned, e.g., to use docker-salt-master:latest as the base image for the docker-salt-master:latest-gui tag? So it can be executed in an other github action, to prevent it break the main project.

My ideas:

• I'd imagine a separate dockerfile for SaltGUI.
• Binary and other files to be copied to the directory defined by envvar SALTGUI_HOME, which defaults to /home/saltgui .
• Strong usage of build args and environment variables ( as I see your current Dockerfile ).

[cdalvaro]

Yes, that is my initial intention. To build a new image using the stable one as base.

I'll try to make some advances this week.

[cdalvaro]

OK, so this is an image ready to test ghcr.io/cdalvaro/docker-salt-master:latest-gui-test

And a compose example:

services:
  master-gui:
    container_name: salt_master_gui
    image: ghcr.io/cdalvaro/docker-salt-master:latest-gui-test
    volumes:
      - ./roots:/home/salt/data/srv
      - ./config:/home/salt/data/config
      - ./keys:/home/salt/data/keys
      - ./logs:/home/salt/data/logs
    ports:
      - "4505:4505"
      - "4506:4506"
      ### salt-api port
      - "8000:8000"
    healthcheck:
      test: ["CMD", "/usr/local/sbin/healthcheck"]
      start_period: 30s
    environment:
      DEBUG: false
      TZ: Europe/Madrid
      PUID: 1000
      PGID: 1000
      SALT_LOG_LEVEL: info
      ### salt-api settings
      # SALT_API_ENABLED: 'True' # This is not needed when using the GUI image
      SALT_API_USER: saltgui
      SALT_API_USER_PASS: saltgui

You'll need to add a salt_api.conf file like this one to your config/ directory.

netapi_enable_clients:
  - local
  - local_async
  - local_batch
  - local_subset
  - runner
  - runner_async

external_auth:
  pam:
    saltgui:
      - .*
      - '@runner'
      - '@wheel'
      - '@jobs'

This is because the permissions can vary greatly based on the use and privileges that you want to give to saltgui, so I don't want to generate a default configuration for this. I will detail it in the documentation.

Please try it by accessing to: https://localhost:8000 and give me your feedback!

[cdalvaro]

I've build the test image using a Mac with Apple Silicon, so architecture is arm64.

If you are going to test on x86_64, then you'll have to build the image as explained here: #289 (reply in thread)

[ZsBT]

Thanks for the efforts. I highly agree that auth conf must be provided by the end-user. I'll give it a try in the upcoming days.
Can you please provide the dockerfile for the gui tag?

[cdalvaro]

The code is in this branch https://github.com/cdalvaro/docker-salt-master/tree/saltgui.

Clone that branch and run this command to build the image: make build-gui

[cdalvaro]

Support is being added in PR #291

[cdalvaro]

I'm almost ready to accept #291. Have you found any issues so far?

[ZsBT]

No issues at all. I've built an x86_64 image for my machine and everything works great.

[cdalvaro]

Awesome!

New version coming soon.

[ZsBT]

Can you please add python modules passlib and tornado?
I'm using file-based authentication in production:

salt.auth.file: The python-passlib library is required for htpasswd filetype

By adding the modules manually in the container with salt-pip, it got to work.

[cdalvaro]

Try adding them using this: https://github.com/cdalvaro/docker-salt-master?tab=readme-ov-file#python-extra-packages

If it doesn't work I'll add them to the image.

[ZsBT]

Indeed, I missed it.
It works well like this in my production environment, thank you!

[cdalvaro]

Great!