Linux config-management rollout

Linux endpoint fleets use configuration-management artifacts rather than a classic MDM profile. Pavri ships idempotent Ansible, Chef, and Puppet examples under infra/mdm/linux/.

Support level

• Ubuntu/Debian .deb: install, enroll, heartbeat, and coding-agent observation have been live-verified on Ubuntu Noble.
• Fedora/RHEL-family .rpm: package metadata, scriptlets, systemd hardening, and file layout have PR-safe checks. A scheduled/manual live harness validates Fedora plus a RHEL-family userspace target with a real gateway token.
• Fleet rollout: Ansible, Chef, and Puppet artifacts can install, configure, enable, restart, and uninstall pavri-endpointd.

Required values

Replace the substitution markers before rollout:

Marker	Meaning
${GATEWAY_URL}	Gateway enrollment URL.
${ENROLLMENT_TOKEN}	One-time endpoint token minted in Pavri.
${ORG_ID}	Tenant/org identifier for rollout attribution.

The env file is written to /etc/pavri-endpoint/endpointd.env with mode 0600. Do not reuse enrollment tokens across endpoints.

Egress-proxy CA

Pass a tenant-approved CA PEM only when your fleet uses managed system trust. The artifacts install it into:

• Debian/Ubuntu: /usr/local/share/ca-certificates/pavri-egress-proxy.crt and run update-ca-certificates.
• Fedora/RHEL family: /etc/pki/ca-trust/source/anchors/pavri-egress-proxy.crt and run update-ca-trust extract.

When no CA PEM is configured, the compensating control is process-scoped trust from the sensor plus heartbeat posture for egress_proxy_trust_state.

Verification

After rollout:

sudo systemctl status pavri-endpointd
sudo journalctl -u pavri-endpointd -n 100 --no-pager
curl -fsS http://127.0.0.1:7878/metrics

Confirm the endpoint appears in the Pavri dashboard and reaches active heartbeat state before increasing rollout percentage.

note

The hosted RPM workflow uses privileged systemd containers. That is acceptable for RPM userspace/scriptlet smoke evidence, but it is not a RHEL kernel/eBPF certification. Use a Fedora/RHEL-family VM run before making kernel-specific observer claims.