Securing Claude Code with TrueFoundry

#!/bin/bash
# MDM Deployment Script: Claude Code — Linux (amd64)
# Must be run as root.

set -euo pipefail

[[ "$(id -u)" -ne 0 ]] && { echo "ERROR: Must be run as root." >&2; exit 1; }

CONFIG_FILE="/etc/tfy/tfy-local-ai-setup.conf"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }

# ---------------------------------------------------------------------------
# Config — fill in on first run. Values are saved to ${CONFIG_FILE} and
# reloaded automatically on subsequent runs — no edits needed after that.
# To update a value later, set it here and run the script once more.
# ---------------------------------------------------------------------------
GATEWAY_URL="<your-gateway-url>"
CONTROL_PLANE_URL="<your-control-plane-url>"
TENANT_NAME="<your-tenant-name>"

# Optional: per-tool gateway URL overrides (both default to GATEWAY_URL if not set)
# CLAUDE_GATEWAY_URL=""
# CODEX_GATEWAY_URL=""

# Optional: override model IDs (defaults shown — change if using Claude Enterprise or a virtual model)
# OPUS_MODEL="claude-code/claude-opus"
# SONNET_MODEL="claude-code/claude-sonnet"
# HAIKU_MODEL="claude-code/claude-haiku"

# Optional: path to a JSON template for Claude Code managed-settings.json
# SETTINGS_FILE="/etc/tfy/base-settings.json"

# Optional: path to a TOML template for Codex config.toml
# CODEX_SETTINGS_FILE="/etc/tfy/base-codex-config.toml"

# ---------------------------------------------------------------------------
# Load + save config (before binary install)
# ---------------------------------------------------------------------------
# Fill in any placeholder values from the saved config file
if [[ -f "${CONFIG_FILE}" ]]; then
  while IFS='=' read -r _key _value; do
    [[ -z "${_key}" || "${_key}" == \#* ]] && continue
    _key="${_key// /}"; _value="${_value%\"}"; _value="${_value#\"}"
    case "${_key}" in
      GATEWAY_URL)       [[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && GATEWAY_URL="${_value}" ;;
      CONTROL_PLANE_URL) [[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && CONTROL_PLANE_URL="${_value}" ;;
      TENANT_NAME)       [[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && TENANT_NAME="${_value}" ;;
    esac
  done < "${CONFIG_FILE}"
fi

[[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && { log "ERROR: GATEWAY_URL not set — fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && { log "ERROR: CONTROL_PLANE_URL not set — fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && { log "ERROR: TENANT_NAME not set — fill it in above or check ${CONFIG_FILE}."; exit 1; }

# Persist config for future runs (root-owned, 644 — developers cannot edit)
mkdir -p "$(dirname "${CONFIG_FILE}")"
cat > "${CONFIG_FILE}" <<CONF
GATEWAY_URL="${GATEWAY_URL}"
CONTROL_PLANE_URL="${CONTROL_PLANE_URL}"
TENANT_NAME="${TENANT_NAME}"
CONF
chown root:root "${CONFIG_FILE}" && chmod 644 "${CONFIG_FILE}"
log "Config saved to ${CONFIG_FILE}."

BINARY_PATH="/usr/local/bin/tfy-local-ai-setup"
RELEASE_TAG="v1.3.0"
BINARY_URL="https://github.com/truefoundry/tfy-local-ai-setup/releases/download/${RELEASE_TAG}/tfy-local-ai-setup-linux-amd64"
VERSION_FILE="${BINARY_PATH}.version"

# ---------------------------------------------------------------------------
# Install binary (skip if already on the correct release tag)
# ---------------------------------------------------------------------------
INSTALLED_TAG="$([[ -f "${VERSION_FILE}" ]] && cat "${VERSION_FILE}" || echo '')"

if [[ ! -f "${BINARY_PATH}" ]] || [[ "${INSTALLED_TAG}" != "${RELEASE_TAG}" ]]; then
  log "Installing tfy-local-ai-setup ${RELEASE_TAG} (linux-amd64)..."
  curl -fsSL "${BINARY_URL}" -o "${BINARY_PATH}" && chmod +x "${BINARY_PATH}"
  echo "${RELEASE_TAG}" > "${VERSION_FILE}"
  log "tfy-local-ai-setup installed at ${BINARY_PATH}."
else
  log "tfy-local-ai-setup ${RELEASE_TAG} already installed — skipping download."
fi

# ---------------------------------------------------------------------------
# Run
# ---------------------------------------------------------------------------
exec "${BINARY_PATH}" \
  --claude-code \
  --url="${CONTROL_PLANE_URL}" \
  --tenant="${TENANT_NAME}" \
  --gateway="${GATEWAY_URL}" \
  ${CLAUDE_GATEWAY_URL:+--claude-gateway="${CLAUDE_GATEWAY_URL}"} \
  ${CODEX_GATEWAY_URL:+--codex-gateway="${CODEX_GATEWAY_URL}"} \
  ${OPUS_MODEL:+--opus-model="${OPUS_MODEL}"} \
  ${SONNET_MODEL:+--sonnet-model="${SONNET_MODEL}"} \
  ${HAIKU_MODEL:+--haiku-model="${HAIKU_MODEL}"} \
  ${SETTINGS_FILE:+--settings-file="${SETTINGS_FILE}"} \
  ${CODEX_SETTINGS_FILE:+--codex-settings-file="${CODEX_SETTINGS_FILE}"}

# MDM Deployment Script: Claude Code — Windows (amd64)
# Must be run as Administrator.

#Requires -RunAsAdministrator
Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

$ConfigFile = "C:\ProgramData\TrueFoundry\tfy-local-ai-setup.conf"

function Write-Log {
  param([string]$Message)
  Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
}

# ---------------------------------------------------------------------------
# Config — fill in on first run. Values are saved to $ConfigFile and
# reloaded automatically on subsequent runs — no edits needed after that.
# To update a value later, set it here and run the script once more.
# ---------------------------------------------------------------------------
$GatewayUrl      = "<your-gateway-url>"
$ControlPlaneUrl = "<your-control-plane-url>"
$TenantName      = "<your-tenant-name>"

# Optional overrides — leave empty ("") to use defaults.
$ClaudeGatewayUrl  = ""   # per-tool gateway for Claude Code (defaults to $GatewayUrl)
$CodexGatewayUrl   = ""   # per-tool gateway for Codex (defaults to $GatewayUrl)
$OpusModel         = ""   # defaults to claude-code/claude-opus
$SonnetModel       = ""   # defaults to claude-code/claude-sonnet
$HaikuModel        = ""   # defaults to claude-code/claude-haiku
$SettingsFile      = ""   # JSON template for Claude Code managed-settings.json
$CodexSettingsFile = ""   # TOML template for Codex config.toml

# ---------------------------------------------------------------------------
# Load + save config (before binary install)
# ---------------------------------------------------------------------------
# Fill in any placeholder values from the saved config file
if (Test-Path $ConfigFile) {
  Get-Content $ConfigFile | ForEach-Object {
    if ($_ -match '^([A-Z_]+)="(.*)"$') {
      $k = $Matches[1]; $v = $Matches[2]
      switch ($k) {
        "GATEWAY_URL"       { if ($GatewayUrl      -eq "<your-gateway-url>")       { $GatewayUrl      = $v } }
        "CONTROL_PLANE_URL" { if ($ControlPlaneUrl -eq "<your-control-plane-url>") { $ControlPlaneUrl = $v } }
        "TENANT_NAME"       { if ($TenantName      -eq "<your-tenant-name>")       { $TenantName      = $v } }
      }
    }
  }
}

if ($GatewayUrl      -eq "<your-gateway-url>")       { Write-Error "GatewayUrl not set — fill it in above or check $ConfigFile"; exit 1 }
if ($ControlPlaneUrl -eq "<your-control-plane-url>") { Write-Error "ControlPlaneUrl not set — fill it in above or check $ConfigFile"; exit 1 }
if ($TenantName      -eq "<your-tenant-name>")       { Write-Error "TenantName not set — fill it in above or check $ConfigFile"; exit 1 }

# Persist config for future runs (SYSTEM-owned, Administrators + Users: read-only)
$ConfigDir = Split-Path $ConfigFile
if (-not (Test-Path $ConfigDir)) { New-Item -ItemType Directory -Path $ConfigDir | Out-Null }
@"
GATEWAY_URL="$GatewayUrl"
CONTROL_PLANE_URL="$ControlPlaneUrl"
TENANT_NAME="$TenantName"
"@ | Set-Content -Path $ConfigFile -Encoding UTF8
icacls $ConfigFile /inheritance:r /grant "SYSTEM:(F)" /grant "Administrators:(R)" /grant "Users:(R)" | Out-Null
Write-Log "Config saved to $ConfigFile."

$BinaryDir   = "C:\Program Files\TrueFoundry"
$BinaryPath  = "$BinaryDir\tfy-local-ai-setup.exe"
$ReleaseTag  = "v1.3.0"
$BinaryUrl   = "https://github.com/truefoundry/tfy-local-ai-setup/releases/download/$ReleaseTag/tfy-local-ai-setup-windows-amd64.exe"
$VersionFile = "$BinaryPath.version"

# ---------------------------------------------------------------------------
# Install binary (skip if already on the correct release tag)
# ---------------------------------------------------------------------------
$InstalledTag = if (Test-Path $VersionFile) { (Get-Content $VersionFile -Raw).Trim() } else { "" }

if (-not (Test-Path $BinaryPath) -or $InstalledTag -ne $ReleaseTag) {
  Write-Log "Installing tfy-local-ai-setup $ReleaseTag (windows-amd64)..."
  if (-not (Test-Path $BinaryDir)) { New-Item -ItemType Directory -Path $BinaryDir | Out-Null }
  Invoke-WebRequest -Uri $BinaryUrl -OutFile $BinaryPath -UseBasicParsing
  Set-Content -Path $VersionFile -Value $ReleaseTag
  Write-Log "tfy-local-ai-setup installed at $BinaryPath."
} else {
  Write-Log "tfy-local-ai-setup $ReleaseTag already installed — skipping download."
}

# ---------------------------------------------------------------------------
# Run
# ---------------------------------------------------------------------------
$RunArgs = @("--claude-code", "--url=$ControlPlaneUrl", "--tenant=$TenantName", "--gateway=$GatewayUrl")
if ($ClaudeGatewayUrl) { $RunArgs += "--claude-gateway=$ClaudeGatewayUrl" }
if ($CodexGatewayUrl)  { $RunArgs += "--codex-gateway=$CodexGatewayUrl" }
if ($OpusModel)          { $RunArgs += "--opus-model=$OpusModel" }
if ($SonnetModel)        { $RunArgs += "--sonnet-model=$SonnetModel" }
if ($HaikuModel)         { $RunArgs += "--haiku-model=$HaikuModel" }
if ($SettingsFile)       { $RunArgs += "--settings-file=$SettingsFile" }
if ($CodexSettingsFile)  { $RunArgs += "--codex-settings-file=$CodexSettingsFile" }
& $BinaryPath @RunArgs
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }