Deploying Floodtide to a fleet

Floodtide ships as a signed and notarised DMG. Today a fleet install is the ordinary one: copy Floodtide.app into Applications on each Mac, open it once, and enter the fleet key under Settings, then License. One key for every Mac; it activates up to the number of seats you bought.

With an MDM you can push the DMG, or the app inside it, the way you push any app today. The key is still entered once per Mac until the next release, version 1.4.5, reads it from a managed preference (below).

A signed PKG for MDM deployment, with the key preloaded, is the next piece of work for Teams after that and is not available today. No date is promised on this page; it is updated when either ships.

• Get the DMG. From the install page, or push it with your MDM. The app is signed with Developer ID (Team ID 2789Z6VPPC) and notarised, so Gatekeeper opens it without a right-click.
• Copy Floodtide.app to Applications. Drag it from the DMG, or have your MDM place it in /Applications. Floodtide updates itself from there.
• Enter the fleet key once. Open Floodtide, choose Settings, then License, paste the key and press Activate. The Mac takes one seat. The same key works on every Mac in the fleet.
• Allow the two background items. macOS asks the person at the Mac to allow Floodtide’s login item and, the first time an update needs it, its helper. An MDM can approve both in advance (below).

From version 1.4.5 Floodtide reads the licence key from a preference, so a Mac can arrive activated with nobody typing. The domain is com.getfloodtide.floodtide and the key is FloodtideLicenseKey, a string holding the fleet key. Floodtide reads it from /Library/Managed Preferences, where an MDM configuration profile puts it, and from /Library/Preferences, where the command below puts it, and activates on its first launch.

On a Mac without an MDM, as an administrator:

sudo defaults write /Library/Preferences/com.getfloodtide.floodtide FloodtideLicenseKey "FLOODTIDE-XXXXX-XXXXX-XXXXX"

With an MDM, the same key and value as custom settings for the domain com.getfloodtide.floodtide:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>FloodtideLicenseKey</key>
  <string>FLOODTIDE-XXXXX-XXXXX-XXXXX</string>
</dict>
</plist>

Jamf calls this Application and Custom Settings; Kandji and Mosyle take it as a custom profile; every MDM that writes managed preferences can deliver it. A profile is the better route: it survives a wipe of /Library/Preferences and it is removed cleanly when the Mac leaves the fleet.

A Mac that already holds a key keeps it; the preference is read only while the app has no licence of its own. Removing the preference does not deactivate a Mac: release its seat from the account page or from the Mac itself (below). Versions before 1.4.5 ignore the preference and still ask for the key once.

A signed and notarised installer package, placing the app in Applications with the key preloaded and the background items registered, is the next piece of Teams work after the managed preference. It is not available today, and this page names no date for it.

If a PKG is what you need before you buy, write to raf@bhopstudio.com and I will tell you where it stands. The managed preference above already removes the one step that needed a person at each Mac.

Floodtide registers two background items, both signed by the same Developer ID team, 2789Z6VPPC. On macOS 13 and later the person at the Mac is asked to allow each one in System Settings, under Login Items; a configuration profile with a com.apple.servicemanagement payload approves them in advance and no prompt appears.

• The login item. Floodtide.app itself, bundle identifier com.getfloodtide.floodtide, so it can check for updates at the times you set and run from the menu bar.
• The helper. A daemon with the label com.getfloodtide.floodtide.helper, installed on demand the first time an update has to write where the signed-in user cannot: an app owned by another account, a PKG installer, an App Store update. It is the only part of Floodtide that runs as root, and it does nothing until the app asks it to.

The payload, inside a configuration profile’s PayloadContent array:

<dict>
  <key>PayloadType</key>
  <string>com.apple.servicemanagement</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadIdentifier</key>
  <string>com.getfloodtide.floodtide.background-items</string>
  <key>PayloadUUID</key>
  <string>7D5E1F2A-6B3C-4E8D-9A0F-1C2B3D4E5F60</string>
  <key>PayloadDisplayName</key>
  <string>Floodtide background items</string>
  <key>Rules</key>
  <array>
    <dict>
      <key>RuleType</key>
      <string>TeamIdentifier</string>
      <key>RuleValue</key>
      <string>2789Z6VPPC</string>
      <key>Comment</key>
      <string>Floodtide login item (com.getfloodtide.floodtide) and helper (com.getfloodtide.floodtide.helper)</string>
    </dict>
  </array>
</dict>

One TeamIdentifier rule covers both items and anything Floodtide adds later under the same team. If your MDM builds the payload in its own editor, the rule type is Team Identifier and the value is 2789Z6VPPC. A profile that names only the app by bundle identifier would leave the helper to be approved by hand.

• One key, as many seats as you bought. Each Mac that activates takes one seat, between 5 and 500. A Mac that activates again with the same key, after a reinstall say, keeps its seat rather than taking a second one.
• The seat count follows the subscription. Add or remove Macs with Manage billing on your account page: Stripe prorates the difference onto your next invoice and the key holds the new count within a minute, inside the same 5 to 500.
• The Tide is included. Every Mac on the key has the Tide while the subscription runs; there is nothing to add per Mac.
• If the subscription ends. The key keeps installing updates for 30 more days; then installing stops and scanning stays free on every Mac. Subscribe again and the same key resumes.

On the Mac itself: Settings, then License, then Deactivate. The seat comes straight back.

From anywhere: sign in at bhopstudio.com/floodtide/account with the address the key was bought with. Under Licenses, every activated Mac is listed with the day it was last seen, and Release seat frees it. A sold, erased or lost Mac is released there, and the same key then activates the Mac that replaces it.

The account page shows an opaque label per Mac, not its name or serial number.

Stripe emails a VAT invoice for every payment, the first and each renewal, with the billing address, VAT number and purchase order number given at checkout. The latest invoice is linked from the Teams panel on your account page, and Manage billing there opens Stripe’s portal: every invoice, the card on file, the seat count and cancellation.

Cancelling ends the subscription with the year already paid; nothing more is charged. Within 14 days of any payment you can also have it refunded in full, no questions asked.

Write to raf@bhopstudio.com; the developer answers himself. For a deployment question, name your MDM and the macOS versions in the fleet; for a key problem, include the key.