# Deploy DVE Agent with Jamf Pro

This guide covers deploying the PhantomKey DVE Agent to macOS fleets using Jamf Pro. Linux and Windows fleets should use the `install-dve-agent.sh` script in a Jamf policy extension attribute workflow or switch to [Intune](mdm-intune.md) for Windows.

## Prerequisites

- Jamf Pro admin access with permission to create packages and policies
- DVE backend configured with `AGENT_VERSION` and `AGENT_DOWNLOAD_BASE_URL`
- Outbound HTTPS from managed Macs to your DVE API and download host
- Optional: [Apple Business Manager](mdm-apple-business-manager.md) linked to Jamf for device enrollment

## Step 1: Confirm manifest URLs

Verify the public manifest resolves from a managed test Mac:

```bash
export DVE_API_BASE_URL="https://your-dve.example.com"
curl -s "${DVE_API_BASE_URL}/api/deployment/agent-manifest" | jq .
```

Record `manifest.download_urls.mac_arm` and `manifest.download_urls.mac_x64` for your fleet architecture mix.

## Step 2: Build a Jamf package

### Option A — Pre-built DMG from manifest

1. Download the current DMG for each architecture from the manifest URLs.
2. In Jamf Pro: **Settings → Computer Management → Packages → New**.
3. Upload the DMG or convert to `.pkg` using `pkgbuild`/`productbuild` if your standard requires pkg format.
4. Set **Category** to `Security` or your internal software taxonomy.
5. Enable **Fill user template** if deploying to `/Applications`.

### Option B — Script-driven install (recommended for auto-updates)

1. Upload `install-dve-agent.sh` to Jamf (Scripts section).
2. Set script parameter or environment extension attribute `DVE_API_BASE_URL`.
3. Create a policy that runs the script at login or recurring check-in.

Sample policy script wrapper:

```bash
#!/bin/bash
export DVE_API_BASE_URL="https://your-dve.example.com"
/usr/local/jamf/bin/jamf policy -event installDveAgent
# Or invoke the script directly from Jamf policy "Run Script"
```

## Step 3: Create a Jamf policy

1. **Computers → Policies → New**.
2. **General:** Name `Install PhantomKey DVE Agent`, Trigger `Recurring Check-in` or `Enrollment Complete`.
3. **Packages:** Add your DVE agent package OR add the install script.
4. **Scope:** Target Smart Groups for all DVE-eligible Macs (exclude servers without credential access if policy requires).
5. **Self Service:** Optional — enable for voluntary install during pilot; disable for mandatory production rollout.

## Step 4: Detection and compliance

Create an Extension Attribute or Smart Group criteria:

- **EA script:** Test for `/Applications/PhantomKey DVE Agent.app` or your installed bundle ID.
- **Ongoing policy:** Re-run install script weekly; script is idempotent and compares manifest version.

## Step 5: Confirm in DVE admin

1. IT Admin opens DVE **Deployment** settings.
2. Set `deployment_mode` to `mdm`, `mdm_platform` to `jamf`.
3. POST `confirm-agent-policy` after reviewing the agent-required notice.

## Sample download reference

Install scripts and policies should use live manifest data. Example URL pattern when `AGENT_DOWNLOAD_BASE_URL=https://downloads.phantomkey.pro/dve-agent` and `AGENT_VERSION=1.0.0`:

```
https://downloads.phantomkey.pro/dve-agent/v1.0.0/dve-agent-mac-arm64.dmg
https://downloads.phantomkey.pro/dve-agent/v1.0.0/checksums.sha256
```

## Troubleshooting

| Issue | Fix |
|-------|-----|
| Policy succeeds but agent missing | Check scope, verify script exit code in Jamf logs |
| Checksum failure in script | Confirm Mac architecture matches download URL (arm64 vs x64) |
| Users prompted for admin password | Deploy pkg with install location `/Applications` using root privileges |
| Manifest null | Configure DVE server env vars |

## API reference

- Public manifest: `GET /api/deployment/agent-manifest`
- Org deployment config: `PUT /api/orgs/{org_id}/deployment/config`

See [deployment overview](overview.md).