Add Salt baseline states for Proxmox Mail Gateway.

Co-authored-by: Cursor <cursoragent@cursor.com>

pmg/ssh_hardening.sls

@@ -0,0 +1,35 @@
+{% set ssh_allow_users = salt['pillar.get']('pmg:ssh_allow_users', []) %}
+{% set ssh_password_authentication = salt['pillar.get']('pmg:ssh_password_authentication', True) %}
+
+pmg-sshd-dropin-dir:
+  file.directory:
+    - name: /etc/ssh/sshd_config.d
+    - user: root
+    - group: root
+    - mode: '0755'
+
+pmg-sshd-hardening-config:
+  file.managed:
+    - name: /etc/ssh/sshd_config.d/99-hardening.conf
+    - source: salt://pmg/files/99-hardening.conf.jinja
+    - template: jinja
+    - context:
+        ssh_allow_users: {{ ssh_allow_users }}
+        ssh_password_authentication: {{ ssh_password_authentication }}
+    - user: root
+    - group: root
+    - mode: '0644'
+
+pmg-validate-sshd-config:
+  cmd.run:
+    - name: sshd -t
+    - onchanges:
+      - file: pmg-sshd-hardening-config
+
+pmg-sshd-service:
+  service.running:
+    - name: ssh
+    - enable: true
+    - reload: true
+    - watch:
+      - cmd: pmg-validate-sshd-config