micromdm/squirrel

A server just for munki

Squirrel is a Simple HTTPs server for munki. See the [legacy](https://github.com/micromdm/squirrel/tree/legacy) branch for the API implementation. I plan on adding it back with Munki v3 support.

Features

• Automatic HTTPS - squirrel provides a built in Let's Encrypt Client.
• Basic Authentication - Basic Auth for munki repo
• Use cloud storage as a repo backend.
• Structured request logging with JSON or logfmt output.

Install

Download the latest release from the release page.

Quickstart

squirrel serve -repo=/path/to/munki_repo -tls-domain=munki.corp.example.com --basic-auth=CHANGEME

-repo flag must be set to the path of a munki repository.
-tls-domain flag must be set to the domain of your munki repo. This value is used by squirrel to obtain new TLS certificates.
-basic-auth flag must be set to a password which will be used for authentication to the munki repo.

Once the server starts, you will see a prompt which prints the correct Authorization header that you need to add to your munki configuration profile. The help text is convenient, but you might want to disable it if you're capturing logs somewhere. Use -no-help flag to disable printing the help text.

Example:

Authorization: Basic c3F1aXJyZWw6Q0hBTkdFTUU=

See squirrel help for full usage.

Keep the process running with systemd

For help with systemd see the example/systemd folder.

Enroll mac hosts:

For help enrolling macOS hosts, check out the example/profile folder.

Repo provider

Squirrel has pluggable storage for munki repo, specified with the -provider flag. The default provider is set to filesystem, which will expect a local path to munki repo.

Other supported providers are s3 and gcs(google cloud storage).

See the provider specific sections below for how to connect to S3 or GCS.

S3 provider

First, export the necessary credentials of a IAM user and region as environment variables. (You can also use the ~/.aws/credentials config file as described here)

export AWS_ACCESS_KEY_ID=AKID1234567890
export AWS_SECRET_ACCESS_KEY=MY-SECRET-KEY
export AWS_REGION=us-east-1

Now serve squirrel. Use the AWS bucket name for the -repo flag.

squirrel serve -repo=awsbucketname -tls-domain=munki.corp.example.com --basic-auth=CHANGEME -provider=s3

To try the config locally on port 8080, you can run

squirrel serve -basic-auth="CHANGEME" -repo=awsbucketname -tls=false -provider=s3

Which will make your munki repo available at http://localhost:8080/repo/. Go to http://localhost:8080/repo/catalogs/all to get a list of available credentials.

Google Cloud Storage Provider

To use squirrel with GCS, you'll need a GCP service account file.

squirrel serve \
    -repo=gcsbucketname \
    -tls-domain=munki.corp.example.com \
    -basic-auth=CHANGEME \
    -provider=gcs \
    -gcs-credentials /Users/groob/Downloads/groob-gcs-credentials.json 

To try the config locally on port 8080, you can run

squirrel serve \
    -repo=gcsbucketname \
    -tls=false \
    -basic-auth=CHANGEME \
    -provider=gcs \
    -gcs-credentials /Users/groob/Downloads/groob-gcs-credentials.json 

Which will make your munki repo available at http://localhost:8080/repo/. Go to http://localhost:8080/repo/catalogs/all to get a list of available credentials.

---

squirrel icon by Agne Alesiute from the Noun Project.

squirrel's Issues

Support for 2 Auth Headers

Hello,

As requested in the #micromdm channel on Slack, i'd be nice to have support for 2 auth headers, that would allow me to update my clients with the new auth headers as well as have support for clients using the old auth headers until they have a chance to update to the new auth headers.

Thanks!

S3 as a backend

It would be lovely if I could use S3 as my storage.

acme/autocert error

Hello,

I could be completely dumb here, but i've tried initializing the squirrel server, forwarded dns for the domain i've been using, set the right repo url and auth headers in the munki config script, still have the below error

TLS handshake error from 10.0.0.15:58825: acme/autocert: host not configured

Am I missing a step? I followed your directions to a T.