salt

gistfile1.txt

/etc/salt/master.d/api.conf
rest_cherrypy:
  port: 8000
  ssl_crt: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/certs/localhost.key

/etc/salt/master.d/auth.conf
external_auth:
  pam:
    saltapi:
      - .*
      - '@wheel'
      - '@runner'

/etc/salt/master
default_include: master.d/*.conf

setfacl -m u:salt:r /etc/shadow

curl -sSk https://xxxx:8000/login  -H 'Accept: application/x-yaml'  -d username=saltapi  -d password=xxxx  -d eauth=pam

salt -a pam '*' test.ping -l trace

echo 'saltapi' | passwd --stdin saltapi

chmod 755 /etc/pki/tls/certs/localhost.*

salt-call --local tls.create_self_signed_cert

pve:
python3.9 -m pip install markupsafe==2.0.1