What you're building

A Linux server (we call it MasterControl) that acts as a bridge between your Linux fleet and Active Directory. It runs:

• PostgreSQL — device inventory, profiles, enrollment tokens
• FastAPI admin console — web UI for managing devices and profiles
• NGINX — reverse proxy with mTLS for agent communication
• SSSD + realmd — Active Directory domain join and Kerberos auth
• Internal CA — issues client certificates to enrolled devices

The postinstall.sh

The entire server builds itself from a single postinstall.sh. Here's what each phase does:

Build and deploy the management server

# 1. Configure the build
export VMNAME="mastercontrol"
export DOMAIN="corp.example.com"
export MC_DOMAIN="mastercontrol.corp.example.com"
export INSTALL_PROFILE="gnome-min"
export NETWORK_MODE="static"
export STATIC_IP="10.100.10.100"

# 2. Build the ISO (bakes postinstall.sh + preseed + darksite into a Debian ISO)
bash build-intunenix.sh

# 3. What happens automatically:
#    - ISO uploads to Proxmox
#    - VM created (UEFI, 4 cores, 4GB RAM, 32GB disk)
#    - Preseed runs unattended Debian install
#    - VM powers off after install
#    - ISO ejected, boot from disk
#    - postinstall.sh runs (installs everything)
#    - VM powers off after postinstall
#    - VM starts for production
#
# Total: ~15 minutes. Zero interaction.

Domain join from the web console

Open https://mastercontrol.corp.example.com in a browser. Go to AD Settings. Enter your domain details:

AD Domain:          corp.example.com
AD Admin User:      administrator
AD Admin Password:  [your AD admin password]
Computer OU:        OU=Linux,OU=Servers,DC=corp,DC=example,DC=com
[x] Join domain now

Click Save. The server runs realm join with your credentials, configures SSSD for Kerberos authentication, and the machine appears in Active Directory. AD users can now SSH in with their domain credentials.

# What happens under the hood:
realm join corp.example.com --user=administrator --computer-ou="OU=Linux,..."
# SSSD configured for AD authentication
# Kerberos keytab generated
# PAM configured for AD logins
# Home directories auto-created via oddjob-mkhomedir

# AD users can now login:
ssh user@CORP.EXAMPLE.COM@mastercontrol.corp.example.com

Create a device profile

Profiles define what an endpoint should look like. Create one from the web console or CLI:

# From the web console: Profiles → Create
# Name: workstation
# Spec (JSON):
{
  "packages": {
    "apt_install": ["libreoffice", "firefox-esr", "thunderbird", "vlc"]
  },
  "security": {
    "auto_updates": true,
    "ufw_rules": ["allow OpenSSH", "allow 443/tcp"]
  },
  "ad": {
    "auto_join": true,
    "computer_ou": "OU=Workstations,DC=corp,DC=example,DC=com"
  }
}

# Or from CLI:
mcctl new-profile workstation /path/to/workstation.json

Issue enrollment tokens

# Generate a token that endpoints use to register
mcctl issue-token workstation 7d
# TOKEN: a3f8e2c1-7b4d-4e9a-b8c3-1234567890ab
# Expires in 7 days

# Bake this token into endpoint ISOs or pass via seed disk

Build endpoint ISOs

Each endpoint ISO carries an enrollment token and the MasterControl CA cert. On first boot, the endpoint:

1. Runs firstboot.sh (the IntuneNix firstboot service)
2. Contacts MasterControl: POST /enroll {cn: "ws-001", token: "a3f8..."}
3. Receives a client certificate signed by the internal CA
4. Joins Active Directory using the profile's AD settings
5. Installs the profile's packages
6. Applies security policies
7. Reports back to MasterControl with device status

# The endpoint's firstboot hook:
cat > /opt/intunenix/firstboot.d/01-enroll.sh <<'HOOK'
#!/bin/bash
MC_URL="https://mastercontrol.corp.example.com"
TOKEN="a3f8e2c1-7b4d-4e9a-b8c3-1234567890ab"
CN="$(hostname)"

# Enroll with MasterControl
curl -sk -X POST "${MC_URL}/enroll" \
  -H "Content-Type: application/json" \
  -d "{\"cn\": \"${CN}\", \"token\": \"${TOKEN}\"}"

# Join AD (realm join uses the profile's settings)
realm join corp.example.com \
  --user=svc-linux-join \
  --computer-ou="OU=Workstations,DC=corp,DC=example,DC=com" \
  --unattended
HOOK
chmod +x /opt/intunenix/firstboot.d/01-enroll.sh

Scale it: spray 50 workstations

# Build once, clone on Proxmox
for i in $(seq 1 50); do
  pvesh create /nodes/fiend/qemu/1002/clone \
    --newid $((2000 + i)) \
    --name "ws-$(printf '%03d' $i)" \
    --full true
  pvesh create /nodes/fiend/qemu/$((2000 + i))/status/start
done

# Each clone boots, runs firstboot, enrolls with MasterControl,
# joins AD, installs packages, and appears in the dashboard.
# 50 workstations. Zero manual configuration.

# Check enrollment:
mcctl ls-devices
#  cn       | profile     | enrolled_at          | last_seen
# ----------+-------------+----------------------+----------
#  ws-001   | workstation | 2026-03-21 08:00:00  | ...
#  ws-002   | workstation | 2026-03-21 08:00:03  | ...
#  ...      | ...         | ...                  | ...

What you manage from the browser