# Deploy Antacid with Jamf Pro

Antacid is a Jamf-native control pack. Developers do not install anything.
IT imports scripts and Extension Attributes into Jamf Pro; the Jamf agent runs them.

## Prerequisites

- Jamf Pro (cloud or on-prem)
- Managed macOS computers with Homebrew **or** Node.js available for `secretless-ai`
- Network access to install [secretless-ai](https://github.com/opena2a-org/secretless-ai) (Homebrew tap preferred)

## 1. Deploy Antacid files

Copy this repository onto each Mac under:

```text
/Library/Application Support/antacid/
  lib/
  jamf/
```

Recommended approaches:

1. **Jamf package** — build a `.pkg` that installs the tree above, then attach a policy.
2. **Policy script payload** — run [`jamf/policies/install-secretless.sh`](../jamf/policies/install-secretless.sh) from a checkout staged in `/private/tmp/antacid` (the script syncs `lib/` into the support directory).

The install policy also ensures `jq` and `secretless-ai` (Homebrew tap `opena2a-org/tap/secretless-ai`, npm fallback).

## 2. Create Extension Attributes

Jamf Pro → Settings → Computer management → Extension Attributes → New.

For each script in [`jamf/extension-attributes/`](../jamf/extension-attributes/):

| Display Name | Script file | Data Type |
|---|---|---|
| Antacid Compliant | `antacid_compliant.sh` | String |
| Antacid Secretless Version | `antacid_version.sh` | String |
| Antacid Last Check | `antacid_last_check.sh` | String |
| Antacid Findings Count | `antacid_findings_count.sh` | String |
| Antacid Scan Truncated | `antacid_scan_truncated.sh` | String |
| Antacid AI Secret Names | `antacid_ai_secret_names.sh` | String |
| Antacid AI Secret Sources | `antacid_ai_secret_sources.sh` | String |
| Antacid AI Secret Count | `antacid_ai_secret_count.sh` | String |

Paste the script body, Input Type = Script, Inventory subset = Extension Attributes.

EAs only **read** `/var/db/antacid/state.json`. They never call cloud APIs and never store secret values.

## 3. Policies

### Policy A — Install (once / ongoing)

- Script: `install-secretless.sh`
- Trigger: Recurring check-in or once per computer
- Scope: developer Smart Group

### Policy B — Inventory (daily)

- Script: `antacid-inventory.sh`
- Trigger: Recurring check-in or custom trigger `antacid-inventory`
- Frequency: Once every day
- Scope: same developer group
- Exit codes: `0` compliant, `1` noncompliant, `2` error

After inventory, the script best-effort runs `jamf recon` so EAs refresh.

## 4. Optional org config

Deploy [`config/org.antacid.plist.example`](../config/org.antacid.plist.example) as a Configuration Profile custom settings payload for domain `org.antacid`, or drop JSON at `/etc/antacid/config.json` (see `config/config.json.example`).

| Key | Meaning |
|---|---|
| `minSecretlessVersion` | Fail compliance if secretless-ai is older |
| `requireMcpGate` | Also fail when MCP configs still hold sensitive env names |
| `scanMaxFiles` | Passed through to `secretless-ai scan --max-files` |
| `scanUserHome` | Scan the console user's home (default true) |
| `installMethod` | `brew` (default) or `npm` |

## 5. Smart Groups & admin report

Follow [`jamf/smart-groups.md`](../jamf/smart-groups.md).

**Fastest admin report:** Advanced Computer Search → columns include Antacid AI Secret Count / Names / Sources → Export CSV.

**API report:** from an IT workstation:

```bash
export JAMF_URL="https://yourorg.jamfcloud.com"
export JAMF_CLIENT_ID="..."
export JAMF_CLIENT_SECRET="..."
./jamf/export-report.sh -o "antacid-report-$(date +%Y%m%d).csv"
```

## Privacy

State and Jamf inventory contain **secret names and sources only**. Values never leave the Mac via Antacid.

## Verification

On a pilot Mac after Policy A + B:

```bash
cat /var/db/antacid/state.json | jq '{compliant, aiSecretCount, aiSecretNamesCsv, reason}'
```

Then confirm the same fields appear on the computer record’s Extension Attributes tab in Jamf Pro.