claudetools/session-logs/2026-05-07-howard-gururmm-macos-installer-and-cf-bot-block.md

GuruRMM — macOS installer missing + Cloudflare blocking install one-liner

Date: 2026-05-07 Tenant / Site: Main Office (WEST-MEADOW-9025) Triggered by: Sylvia's Mac mini (Sylvias-Mini) install attempt failed

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Summary

While trying to enroll Sylvia's Mac mini in GuruRMM, two distinct issues surfaced. Both are server-side problems, not user error.

1. The bootstrap one-liner (curl -fsSL ... | sudo bash) returns 403 because Cloudflare Bot Fight Mode blocks bare curl/* user agents. This affects every platform, not just Mac — anyone running the documented install command on Linux/Windows/Mac is hitting the CF challenge page before the request ever reaches the GuruRMM server.
2. There is no macOS installer route on the server. /install/<site>/{macos,darwin,mac,osx} all return 404. Only linux and windows are implemented.

Reproduction

sylvia@Sylvias-Mini ~ % curl -fsSL 'https://rmm.azcomputerguru.com/install/WEST-MEADOW-9025/linux' | sudo bash
curl: (22) The requested URL returned error: 403

(she used /linux — wrong platform anyway, but the 403 is from Cloudflare, not GuruRMM)

Diagnosis from Howard-Home

$ curl -i https://rmm.azcomputerguru.com/install/WEST-MEADOW-9025/linux
HTTP/1.1 403 Forbidden
Server: cloudflare
Cf-Mitigated: challenge
...

With a normal browser UA, request reaches the server:

$ curl -A 'Mozilla/5.0 ... Safari/537.36' https://rmm.azcomputerguru.com/install/WEST-MEADOW-9025/linux
# GuruRMM Agent Installer
# Site: Main Office (WEST-MEADOW-9025)
HTTP 200

Platform enumeration (with browser UA so CF doesn't block):

Path	Result
/install/WEST-MEADOW-9025/linux	200 (script)
/install/WEST-MEADOW-9025/windows	200
/install/WEST-MEADOW-9025/macos	404
/install/WEST-MEADOW-9025/darwin	404
/install/WEST-MEADOW-9025/mac	404
/install/WEST-MEADOW-9025/osx	404
/install/WEST-MEADOW-9025/apple	404

Message for Mike

Two GuruRMM items for you:

1. Build the macOS agent + installer route (Sylvia is blocked)

Sylvia (Main Office / WEST-MEADOW-9025) needs an agent on her Mac mini. There is no macOS target today. Scope:

• Rust agent built for aarch64-apple-darwin (Apple Silicon) and x86_64-apple-darwin (Intel)
• Server route: /install/<site>/macos returning either a shell installer (parity with linux) or a signed .pkg
• LaunchDaemon for service supervision (mac equivalent of the systemd unit on Linux)
• Apple Developer ID signing + notarization so Gatekeeper doesn't block install on a stock Mac. Without notarization, every user has to right-click→Open or pop System Settings → Privacy & Security to allow it. Painful at scale.
• Install path convention: /usr/local/gururmm (or /opt/gururmm for parity with Linux, but /usr/local is more macOS-native)

If notarization is too much work for v1, a shell-script installer that builds from a code-signed binary still works for mom-and-pop deployments, just expects user to right-click→Open the first time.

2. Cloudflare bot challenge is blocking the install one-liner

Independent of the macOS work, the Linux/Windows install commands documented in the dashboard don't work as written today. Bare curl is being challenged by CF. Three fixes (pick one):

• Server-side, recommended: Cloudflare WAF rule to skip bot fight mode on (http.request.uri.path matches "^/install/"). That's the cleanest — install commands stay copy-pasteable.
• Page Rule: Security Level "Essentially Off" for /install/*.
• Document the UA flag in the install command: curl -fsSL -A 'Mozilla/5.0 ...' — but that's a bandage, every user hits it.

I'd go with the WAF skip. The endpoint already requires a valid site code so we're not exposing anything new by removing the bot check on it.

Howard follow-ups

• Sylvia's Mac mini: diagnose slowness / low-memory popups separately (this session) — not enrollment-related.
• Once Mike ships the macOS agent, return to Sylvia for enrollment.

Artifacts

None — diagnosis was all live curl probes, no persistent state.