Saltstack host configuration and improving data readability - salt-stack

Question

We're using salt (masterless, fwiw) to maintain a fleet of 10 hosts. That will probably grow to 15-20 by year end. I have a pillar file called credentials/init.sls that has a single huge hunk of yaml that looks something like this:
host_credentials:
host1.example.com:
role: staging
mysql:
superdatabase:
role1:
username: role1_username
password: someSecretSHA1
from_hosts:
- host2.example.com
grants: select, insert, update, delete
role2:
username: role2_username
password: anotherSecretSHA1
from_hosts:
- host3.example.com
grants: select
host2.example.com:
role: staging
superthing:
mysql:
database: superdatabase
host: host1.example.com
role: role1
The point here is that the code that configures host1 can fetch all of its pertinent data from host_credentials['host1.example.com'] and the code that sets up host2 can fetch its data from host_credentials['host2.example.com'] with some lookups, for example, in host1's info in order to know the user and password for superdatabase on host1 with role1.
This works, but it's cumbersome. In fact, it's sufficiently cumbersome that the firewall rules, which at first glance might also have been in this yaml structure, are now in a different pillar file. Moreover, nothing controls that each host's yaml conforms to the pattern we want, so we have to do a fair bit of error checking in the salt code.
In addition, when someday we use a salt master, this would lead us to have to share all host information with all minions, hardly ideal.
The goal is to have each bit of information written down once. If I change a password for a mysql database user, for example, I shouldn't have to change it twice, once on the server, again on each client that uses that database. Moreover, I'd like to have semi-reasonable error messages when I do the wrong thing. If I tell host4 to connect to mysql on host2, I should get an error message that says something like "host4 requested to connect to mysql on host2, but host2 does not run a mysql server".
At the moment, the only better solution I've found is to write some python code (using the salt py renderer) that generates an empty object but does a lot of checking in the middle.
salt/codequal/init.sls:
#!py
def run():
# Do lots of error checking here.
return {}
Any feedback most welcome. Since I haven't seen this sort of thing written down, I suspect I've missed a more natural way to do what I want.