### /srv/base/salt/top.sls
base:
  '*':
    - essential

  'master:localhost':
    - match: grain
    - cloud

  'G@fqdn:*.example.org or @fqdn:*ec2*':
    - match: compound
    - fail2ban.config

  'G@oscodename:precise and G@osarch:amd64':
    - match: compound
    - docker.precise

  'G@oscodename:trusty and G@osarch:amd64':
    - match: compound
    - docker

prod:
  '*.example.com':
    - users
    - ssh

  'db.example.com':
    - mysql.server
    - mysql.client

  'web.example.com':
    - mysql.client

### /srv/base/pillar/top.sls
base:
  '*':
    - failtoban

prod:
  '*.example.com':
    - users
    - hosts

  'db.example.com':
    - mysql


### /srv/prod/pillar/mysql.sls
mysql:
  server:
    bind-address: 0.0.0.0
    port: 3306
    user: mysql


### /srv/prod/pillar/(hosts|users).sls
...

### master.conf
file_roots:
  base:
    - /srv/base/salt

  prod:
    - /srv/prod/salt
    - /srv/base/salt

  dev:
    - /srv/dev/salt
    - /srv/prod/salt
    - /srv/base/salt

fileserver_backend:
 - roots
 - git

gitfs_remotes:
  - git://github.com/saltstack-formulas/fail2ban-formula.git
  - git://github.com/saltstack-formulas/users-formula.git
  - git://github.com/saltstack-formulas/mysql-formula.git

pillar_roots:
  base:
    - /srv/base/pillar

  prod:
    - /srv/prod/pillar
    - /srv/base/pillar

  dev:
    - /srv/dev/pillar
    - /srv/prod/pillar
    - /srv/base/pillar