{% set journald_system_max_use = salt['pillar.get']('pmg:journald_system_max_use', '1G') %}
{% set journald_max_file_sec = salt['pillar.get']('pmg:journald_max_file_sec', '1month') %}

pmg-journald-dropin-dir:
  file.directory:
    - name: /etc/systemd/journald.conf.d
    - user: root
    - group: root
    - mode: '0755'

pmg-journald-retention:
  file.managed:
    - name: /etc/systemd/journald.conf.d/99-retention.conf
    - source: salt://pmg/files/journald-retention.conf.jinja
    - template: jinja
    - context:
        journald_system_max_use: {{ journald_system_max_use }}
        journald_max_file_sec: {{ journald_max_file_sec }}
    - user: root
    - group: root
    - mode: '0644'

pmg-restart-journald:
  cmd.run:
    - name: systemctl restart systemd-journald
    - onchanges:
      - file: pmg-journald-retention

pmg-auditd-package:
  pkg.installed:
    - name: auditd

pmg-audit-rules:
  file.managed:
    - name: /etc/audit/rules.d/99-pmg-baseline.rules
    - source: salt://pmg/files/99-pmg-baseline.rules.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: '0640'

pmg-reload-audit-rules:
  cmd.run:
    - name: augenrules --load
    - onchanges:
      - file: pmg-audit-rules

pmg-auditd-service:
  service.running:
    - name: auditd
    - enable: true

pmg-rsyslog-service:
  service.running:
    - name: rsyslog
    - enable: true