docs: def apply_master_config(overrides=None, defaults=None):
      '''
      Returns master configurations dict.
      '''
      if defaults is None:
          defaults = DEFAULT_MASTER_OPTS.copy()
      if overrides is None:
          overrides = {}
  
      opts = defaults.copy()
      opts['__role'] = 'master'
      _adjust_log_file_override(overrides, defaults['log_file'])
      if overrides:
          opts.update(overrides)
  
      opts['__cli'] = salt.utils.stringutils.to_unicode(
          os.path.basename(sys.argv[0])
      )
  
      if 'environment' in opts:
          if opts['saltenv'] is not None:
              log.warning(
                  'The \'saltenv\' and \'environment\' master config options '
                  'cannot both be used. Ignoring \'environment\' in favor of '
                  '\'saltenv\'.',
              )
              # Set environment to saltenv in case someone's custom runner is
              # refrencing __opts__['environment']
              opts['environment'] = opts['saltenv']
          else:
              log.warning(
                  'The \'environment\' master config option has been renamed '
                  'to \'saltenv\'. Using %s as the \'saltenv\' config value.',
                  opts['environment']
              )
              opts['saltenv'] = opts['environment']
  
      if six.PY2 and 'rest_cherrypy' in opts:
          # CherryPy is not unicode-compatible
          opts['rest_cherrypy'] = salt.utils.data.encode(opts['rest_cherrypy'])
  
      for idx, val in enumerate(opts['fileserver_backend']):
          if val in ('git', 'hg', 'svn', 'minion'):
              new_val = val + 'fs'
              log.debug(
                  'Changed %s to %s in master opts\' fileserver_backend list',
                  val, new_val
              )
              opts['fileserver_backend'][idx] = new_val
  
      if len(opts['sock_dir']) > len(opts['cachedir']) + 10:
          opts['sock_dir'] = os.path.join(opts['cachedir'], '.salt-unix')
  
      opts['token_dir'] = os.path.join(opts['cachedir'], 'tokens')
      opts['syndic_dir'] = os.path.join(opts['cachedir'], 'syndics')
      # Make sure ext_mods gets set if it is an untrue value
      # (here to catch older bad configs)
      opts['extension_modules'] = (
          opts.get('extension_modules') or
          os.path.join(opts['cachedir'], 'extmods')
      )
      # Set up the utils_dirs location from the extension_modules location
      opts['utils_dirs'] = (
          opts.get('utils_dirs') or
          [os.path.join(opts['extension_modules'], 'utils')]
      )
  
      # Insert all 'utils_dirs' directories to the system path
      insert_system_path(opts, opts['utils_dirs'])
  
      if overrides.get('ipc_write_buffer', '') == 'dynamic':
          opts['ipc_write_buffer'] = _DFLT_IPC_WBUFFER
  
      using_ip_for_id = False
      append_master = False
      if not opts.get('id'):
          opts['id'], using_ip_for_id = get_id(
                  opts,
                  cache_minion_id=None)
          append_master = True
  
      # it does not make sense to append a domain to an IP based id
      if not using_ip_for_id and 'append_domain' in opts:
          opts['id'] = _append_domain(opts)
      if append_master:
          opts['id'] += '_master'
  
      # Prepend root_dir to other paths
      prepend_root_dirs = [
          'pki_dir', 'cachedir', 'pidfile', 'sock_dir', 'extension_modules',
          'autosign_file', 'autoreject_file', 'token_dir', 'syndic_dir',
          'sqlite_queue_dir', 'autosign_grains_dir'
      ]
  
      # These can be set to syslog, so, not actual paths on the system
      for config_key in ('log_file', 'key_logfile', 'ssh_log_file'):
          log_setting = opts.get(config_key, '')
          if log_setting is None:
              continue
  
          if urlparse(log_setting).scheme == '':
              prepend_root_dirs.append(config_key)
  
      prepend_root_dir(opts, prepend_root_dirs)
  
      # Enabling open mode requires that the value be set to True, and
      # nothing else!
      opts['open_mode'] = opts['open_mode'] is True
      opts['auto_accept'] = opts['auto_accept'] is True
      opts['file_roots'] = _validate_file_roots(opts['file_roots'])
      opts['pillar_roots'] = _validate_file_roots(opts['pillar_roots'])
  
      if opts['file_ignore_regex']:
          # If file_ignore_regex was given, make sure it's wrapped in a list.
          # Only keep valid regex entries for improved performance later on.
          if isinstance(opts['file_ignore_regex'], six.string_types):
              ignore_regex = [opts['file_ignore_regex']]
          elif isinstance(opts['file_ignore_regex'], list):
              ignore_regex = opts['file_ignore_regex']
  
          opts['file_ignore_regex'] = []
          for regex in ignore_regex:
              try:
                  # Can't store compiled regex itself in opts (breaks
                  # serialization)
                  re.compile(regex)
                  opts['file_ignore_regex'].append(regex)
              except Exception:
                  log.warning(
                      'Unable to parse file_ignore_regex. Skipping: %s',
                      regex
                  )
  
      if opts['file_ignore_glob']:
          # If file_ignore_glob was given, make sure it's wrapped in a list.
          if isinstance(opts['file_ignore_glob'], six.string_types):
              opts['file_ignore_glob'] = [opts['file_ignore_glob']]
  
      # Let's make sure `worker_threads` does not drop below 3 which has proven
      # to make `salt.modules.publish` not work under the test-suite.
      if opts['worker_threads'] < 3 and opts.get('peer', None):
          log.warning(
              "The 'worker_threads' setting in '%s' cannot be lower than "
              '3. Resetting it to the default value of 3.', opts['conf_file']
          )
          opts['worker_threads'] = 3
  
      opts.setdefault('pillar_source_merging_strategy', 'smart')
  
      # Make sure hash_type is lowercase
      opts['hash_type'] = opts['hash_type'].lower()
  
      # Check and update TLS/SSL configuration
      _update_ssl_config(opts)
      _update_discovery_config(opts)
  
      return opts