Add concourse_worker state

app/concourse_worker/defaults.yaml

@@ -0,0 +1,10 @@
+---
+
+container:
+  image: concourse/concourse
+  tag: latest
+  restart: unless-stopped
+  shm_size: 64M
+
+settings:
+  data_dir: /opt/concourse/data

app/concourse_worker/init.sls

@@ -0,0 +1,43 @@
+---
+
+{% from "app/concourse-worker/map.jinja" import container, settings with context %}
+
+generate worker key:
+  cmd.run:
+    - name: >
+        ssh-keygen
+        -q
+        -t rsa
+        -b 4096
+        -C 'concourse: TSA worker key'
+        -f {{ settings.data_dir }}/tsa_worker_key
+        -P ''
+    - unless: "test -f {{ settings.data_dir }}/tsa_worker_key"
+
+concourse worker image:
+  docker_image.present:
+    - name: {{ container.image }}
+    - tag: {{ container.tag }}
+
+concourse worker container:
+  docker_container.running:
+    - require:
+      - docker_image: concourse worker image
+      - cmd: generate worker key
+    - image: {{ container.image }}:{{ container.tag }}
+    - name: concourse-worker
+    - detach: true
+    - tty: true
+    - privileged: true
+    - shm_size: {{ container.shm_size }}
+    - restart_policy: "{{ container.restart }}"
+    - binds:
+      - {{ settings.data_dir }}:/data:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    - command: >
+        worker
+        --tsa-host {{ settings.tsa_host }}
+        --tsa-public-key {{ settings.tsa_host_public_key }}
+        --tsa-worker-private-key /data/tsa_worker_key
+{% if settings.args %}{% for arg in settings.args %}        {{ arg }}
+{% endfor %}{% endif %}

app/concourse_worker/map.jinja

@@ -0,0 +1,4 @@
+{% import_yaml "app/concourse-worker/defaults.yaml" as defaults %}
+
+{% set container = salt.pillar.get("concourse-worker:container", default=defaults["container"], merge=True) %}
+{% set settings = salt.pillar.get("concourse-worker:settings", default=defaults["settings"], merge=True) %}

top.sls

@@ -63,4 +63,8 @@ base:
     - match: grain
     - app.consul.tls
     - vault
-    - app.vault
+    - app.vault
+
+  'roles:concourse_worker':
+    - match: grain
+    - app.concourse_worker