base:
  '*':
    - base.sanity
    - groups
    - firewall
    - users
    - sudoers
    - backup.client
    - auto-security

  'roles:backup-server':
    - match: grain
    - backup.server

  'roles:cdn-logs':
    - match: grain
    - cdn-logs

  'roles:docs':
    - match: grain
    - docs

  'roles:downloads':
    - match: grain
    - downloads

  'roles:hg':
    - match: grain
    - hg
    - ssh.host_keys

  'roles:jython-web':
    - match: grain
    - jython

  'roles:loadbalancer':
    - match: grain
    - haproxy
    - openvpn.routing

  'roles:salt-master':
    - match: grain

  'roles:vpn':
    - match: grain
    - openvpn.server

base:
  '*':
    - base.sanity
    - groups
    - firewall
    - users
    - sudoers
    - backup.client
    - auto-security

  '* and not G@roles:vpn':
    - match: compound
    - openvpn.routing

  'roles:backup-server':
    - match: grain
    - backup.server

  'roles:cdn-logs':
    - match: grain
    - cdn-logs

  'roles:docs':
    - match: grain
    - docs

  'roles:downloads':
    - match: grain
    - downloads

  'roles:hg':
    - match: grain
    - hg
    - ssh.host_keys

  'roles:jython-web':
    - match: grain
    - jython

  'roles:loadbalancer':
    - match: grain
    - haproxy

  'roles:salt-master':
    - match: grain

  'roles:vpn':
    - match: grain
    - openvpn.server

Move the openvpn.routing state to be on everything but the vpn
Move the openvpn.routing state to be on everything but the vpn

python/psf-salt,dstufft/psf-salt,zooba/psf-salt,python/psf-salt,zware/psf-salt,python/psf-salt,zware/psf-salt,zware/psf-salt,caktus/psf-salt,dstufft/psf-salt,caktus/psf-salt,zware/psf-salt,caktus/psf-salt,python/psf-salt,zooba/psf-salt,zooba/psf-salt,dstufft/psf-salt