Yeah, salt has SSH support and it supposed to be able to deploy without minion/target interaction, but it wasn’t very reliable or I was doing it wrong.

I started with SALT because of Security Onion, open source IDS. Only reason.

SALT can run master less, is that what you were after? Rather than having a single/central manager?