Squirrel is a Simple HTTPs server for munki. See the legacy branch for the API implementation. I plan on adding it back with Munki v3 support.
Download the latest release from the release page.
squirrel serve -repo=/path/to/munki_repo -tls-domain=munki.corp.example.com --basic-auth=CHANGEME
-repo
flag must be set to the path of a munki repository.
-tls-domain
flag must be set to the domain of your munki repo. This value is used by squirrel to obtain new TLS certificates.
-basic-auth
flag must be set to a password which will be used for authentication to the munki repo.
Once the server starts, you will see a prompt which prints the correct Authorization header that you need to add to your munki configuration profile.
The help text is convenient, but you might want to disable it if you're capturing logs somewhere. Use -no-help
flag to disable printing the help text.
Example:
Authorization: Basic c3F1aXJyZWw6Q0hBTkdFTUU=
See squirrel help
for full usage.
For help with systemd see the example/systemd folder.
For help enrolling macOS hosts, check out the example/profile folder.
Squirrel has pluggable storage for munki repo, specified with the -provider
flag.
The default provider is set to filesystem
, which will expect a local path to munki repo.
Other supported providers are s3
and gcs
(google cloud storage).
See the provider specific sections below for how to connect to S3 or GCS.
First, export the necessary credentials of a IAM user and region as environment variables. (You can also use the ~/.aws/credentials config file as described here)
export AWS_ACCESS_KEY_ID=AKID1234567890
export AWS_SECRET_ACCESS_KEY=MY-SECRET-KEY
export AWS_REGION=us-east-1
Now serve squirrel. Use the AWS bucket name for the -repo
flag.
squirrel serve -repo=awsbucketname -tls-domain=munki.corp.example.com --basic-auth=CHANGEME -provider=s3
To try the config locally on port 8080, you can run
squirrel serve -basic-auth="CHANGEME" -repo=awsbucketname -tls=false -provider=s3
Which will make your munki repo available at http://localhost:8080/repo/
.
Go to http://localhost:8080/repo/catalogs/all
to get a list of available credentials.
To use squirrel with GCS, you'll need a GCP service account file.
squirrel serve \
-repo=gcsbucketname \
-tls-domain=munki.corp.example.com \
-basic-auth=CHANGEME \
-provider=gcs \
-gcs-credentials /Users/groob/Downloads/groob-gcs-credentials.json
To try the config locally on port 8080, you can run
squirrel serve \
-repo=gcsbucketname \
-tls=false \
-basic-auth=CHANGEME \
-provider=gcs \
-gcs-credentials /Users/groob/Downloads/groob-gcs-credentials.json
Which will make your munki repo available at http://localhost:8080/repo/
.
Go to http://localhost:8080/repo/catalogs/all
to get a list of available credentials.
squirrel icon by Agne Alesiute from the Noun Project.