Crypt is a client secret escrow tool (primarily FileVault, but other secret types too). Because it holds secrets, it is common to want to restrict access to retrieving secrets to certain locations. If you are running one node, you can simply add something like the following to your Nginx configuration: upstream crypt { server 127.0.0.1:8000 fail_timeout=0; } server { listen 443 ssl ; server_name crypt.company.com; expires 1h; ssl on; ssl_certificate /etc/nginx/ssl/crypt.company.com.pem; ssl_certificate_key /etc/nginx/ssl/crypt.company.com.key; add_header X-Frame-Options "SAMEORIGIN"; access_log /var/log/nginx/crypt.access.log; location ~ ^/(checkin) { proxy_pass http://crypt; # your proxy settings here } location / { proxy_redirect http:// https://; proxy_pass http://crypt; # your proxy settings here allow 10.0.0.0/8; # Office network allow 172.16.0.0/12; #VPC deny all; } } The above will allow everyone access to the /checkin endpoint (so keys continue to be escrowed), but restrict any other page to the subnets listed. ...

At work, we’re great fans of MicroMDM. It’s lightweight, it’s all driven via an API so we can configure it with code - it has nearly everything we want. But unfortunately, it doesn’t have everything - as Groob himself says, “it’s not a product” - this means it purposely doesn’t include some of the things you may need from an MDM. This is where MDMDirector comes in. MDMDirector is able to receive the data from MicroMDM from it’s webhook feature and then take action based on the data it receives. Perhaps you need to ensure a profile is of a certain version on all of your devices? MDMDirector has you covered. What about via a REST API? We definitely do that too. Would you like to retrieve SecurityInfo or CertificateList from the machines regularly? Yep, can do that as well. ...

Up until now Movember has been pretty light hearted - I’m guessing this is why a lot of you haven’t donated yet. Time for some numbers. Testicular cancer is the most common cancer in young men, with nearly 700,000 people getting it each year. There is a 50% chance that I will get testicular cancer again. If my cancer does come back, there is 5-10% chance it will kill me. ...

When I released Imagr back in 2015, it was a different time. We didn’t have T2 Macs, NetBoot was still around and DEP was just something most of us scoffed at using. In 2019, things have changed. MDM is no longer optional. DEP is the only automated method to deploy modern macOS devices. The NetBoot ship has well and truly sailed. No devices have been “imaged” in my organization for around two years. ...

The links to all of the code used in my talk at MacAD.UK are below. Movember Movember on Facebook London Apple Admins @ Jigsaw 24 grahamgilbert/macaduck19-supershell grahamgilbert/macaduck19-powerfulpython grahamgilbert/macaduck19-autopkg_overrides grahamgilbert/macaduck19-munki_repo

MacAD.UK is just a few weeks away, and I’m rather excited about the whole thing. I will be speaking on the second day about Practical CI/CD workflows for Mac Admins - a topic that I’ve wanted to speak about for quite some time. And of course I am hoping we will all be able to go for the now traditional curry one evening (I’m sure we can all agree, curry is the height of British cuisine).

Earlier this year I was diagnosed with testicular cancer. I’m one of the lucky ones, I caught it early, was fortunate enough to have excellent treatment and am now in remission. Testicular cancer is the most common form of cancer in men under 40 years old - chances are either you will get it or you will know someone who will. This year, I’m raising money for Movember. I’ve already raised an amazing amount mostly due to the generosity of the Apple admin community. I’ve had to raise my target several times until I went big and set it at $10,000. I blasted though that before November even started, so thank you to everyone who donated! ...

terraform-munki-repo is a Terraform module that will set up a production ready Munki repo for you. More specifically it will create: An s3 bucket to store your Munki repo An s3 bucket to store your logs A CloudFront Distribution so your clients will pull from an AWS endpoint near them A Lambda@Edge function that will set up basic authentication Why? A Munki repo is a basic web server. But you still need to worry about setting up one or more servers, patching those servers, scaling them around the world if you have clients in more than one country. Amazon Web Services has crazy high levels of up time - more than we could ever manage ourselves. CloudFront powers some of the world’s busiest websites without breaking a sweat, so it can handle your Munki repo without any trouble. So it makes sense to offload the running of these services so we can get on with our day. ...

Over time, you may notice your Sal install getting slower and slower - this will happen faster the more devices you have checking in. You may even see rediciulous amounts of disk space being used - maybe even 1Gb per hour. This can all be solved by tweaking some simple matinenance settings on your Postgres server. Background Before we crack on with how to stop this from happening, it will be useful to know how Postgres handles deleted data. ...

It’s been three long months since I gave a talk with Brett, my lovely coworker at MacAd.UK, so it’s time to give some talks on the side of the pond which I currently reside. Firstly I will be at MacDevOps:YVR on June 7th - 8th, where I will be joined by fellow beer snob Wes Whetstone where we will be talking about Crypt and probably talking about beer in the bar afterwards. ...