cfgms

CFGMS is an open-source configuration, automation and infrastructure management platform aimed at managed service providers and IT teams. It is designed to manage large, multi-tenant fleets of Windows, Linux and macOS machines from a single control plane, and the project states its intent is not merely to report that something is wrong, but to connect an affected device or application to its dependencies and recent changes, identify the likely cause and remediate it safely. The README notes that these root-cause and Digital Employee Experience capabilities (experience signals, fleet baselines, predictive insight, remediation) are planned on the existing foundation rather than finished. The documented feature set covers desired-state configuration and policy-as-code; configuration drift detection and enforcement; workflow and event-driven automation; hierarchical multi-tenancy for MSPs and their clients; endpoint inventory with live telemetry and historical state; and an entity graph for modelling systems and their relationships. Integrations are listed for Microsoft 365, Active Directory, endpoints and infrastructure. Architecture is built around three cooperating components. The Controller is the central control plane for configuration, orchestration, workflows, fleet state, APIs and multi-tenant administration. The Steward is the agent that observes and manages a Windows, Linux or macOS endpoint. The Outpost is a planned local proxy and discovery component for networks and devices that cannot run a Steward. Internal control and data-plane communication uses gRPC over QUIC with mutual TLS, while external integrations use HTTPS and the REST API. Security design assumes that endpoints, and occasionally administrator accounts, may be compromised. Internal communication requires mutual TLS, secrets are encrypted, executable modules are signed, authorization is tenant-aware, and security-relevant activity is audited. Vulnerability reports are handled privately rather than through public issues. Interfaces include a cfg command-line tool and a REST API, with a controller-served web UI described as in early development. Building from source requires Go and Git; make build places binaries in bin/. Deployment requires initializing the controller CA and admin credential bundle with --init --config, and stewards join using a registration token the controller issues. Documentation covers a single-controller walkthrough, supported architectures and other deployment topologies. The project describes itself as in early development: the core architecture and a growing set of components are implemented, but it should not yet be treated as a finished production product, and interfaces and deployment procedures may change. Direction is tracked in a roadmap and project board. Licensing is GNU Affero General Public License v3.0, so it can be self-hosted and used by MSPs to manage client environments under the AGPL, with a separate commercial license available for embedding it in proprietary products. Contributions require signing a Contributor License Agreement and adding the contributor to a contributors file.