Securing OpenAI Codex with TrueFoundry

#!/bin/bash
# MDM Deployment Script: OpenAI Codex, Linux (amd64)
# Must be run as root.

set -euo pipefail

[[ "$(id -u)" -ne 0 ]] && { echo "ERROR: Must be run as root." >&2; exit 1; }

CONFIG_FILE="/etc/tfy/tfy-local-ai-setup.conf"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }

# ---------------------------------------------------------------------------
# Config: fill in on first run. Values are saved to ${CONFIG_FILE} and
# reloaded automatically on subsequent runs, so no edits are needed after
# that. To update a value later, set it here and run the script once more.
# ---------------------------------------------------------------------------
GATEWAY_URL="<your-gateway-url>"
CONTROL_PLANE_URL="<your-control-plane-url>"
TENANT_NAME="<your-tenant-name>"

# Optional: gateway URL override for Codex (defaults to GATEWAY_URL if not set)
# CODEX_GATEWAY_URL=""

# Sign-in: "oidc" or "api-key". "api-key" is required for the ChatGPT subscription setup.
# OIDC_ISSUER and OIDC_CLIENT_ID are required while CODEX_AUTH is "oidc". See "OIDC sign-in" below.
CODEX_AUTH="oidc"
OIDC_ISSUER=""
OIDC_CLIENT_ID=""

# Header style when CODEX_AUTH is api-key. Ignored when CODEX_AUTH is oidc.
# "api-key" (default) or "chatgpt-subscription".
# See "Using Codex MDM with a ChatGPT Business or Enterprise subscription" below.
# CODEX_AUTH_MODE="api-key"

# Optional: default model for Codex (a virtual model slug is recommended).
# If unset, no model key is written and developers choose their own.
# CODEX_DEFAULT_MODEL="gpt-5.2-codex"

# Optional: path to a TOML template that the provider block is injected into
# CODEX_SETTINGS_FILE="/etc/tfy/base-codex-config.toml"

# ---------------------------------------------------------------------------
# Load + save config (before binary install)
# ---------------------------------------------------------------------------
# Fill in any placeholder values from the saved config file
if [[ -f "${CONFIG_FILE}" ]]; then
  while IFS='=' read -r _key _value; do
    [[ -z "${_key}" || "${_key}" == \#* ]] && continue
    _key="${_key// /}"; _value="${_value%\"}"; _value="${_value#\"}"
    case "${_key}" in
      GATEWAY_URL)       [[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && GATEWAY_URL="${_value}" ;;
      CONTROL_PLANE_URL) [[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && CONTROL_PLANE_URL="${_value}" ;;
      TENANT_NAME)       [[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && TENANT_NAME="${_value}" ;;
    esac
  done < "${CONFIG_FILE}"
fi

[[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && { log "ERROR: GATEWAY_URL not set. Fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && { log "ERROR: CONTROL_PLANE_URL not set. Fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && { log "ERROR: TENANT_NAME not set. Fill it in above or check ${CONFIG_FILE}."; exit 1; }

# Persist config for future runs (root-owned, 644, developers cannot edit)
mkdir -p "$(dirname "${CONFIG_FILE}")"
cat > "${CONFIG_FILE}" <<CONF
GATEWAY_URL="${GATEWAY_URL}"
CONTROL_PLANE_URL="${CONTROL_PLANE_URL}"
TENANT_NAME="${TENANT_NAME}"
CONF
chown root:root "${CONFIG_FILE}" && chmod 644 "${CONFIG_FILE}"
log "Config saved to ${CONFIG_FILE}."

BINARY_PATH="/usr/local/bin/tfy-local-ai-setup"
RELEASE_TAG="v1.4.2"
BINARY_URL="https://github.com/truefoundry/tfy-local-ai-setup/releases/download/${RELEASE_TAG}/tfy-local-ai-setup-linux-amd64"
VERSION_FILE="${BINARY_PATH}.version"

# ---------------------------------------------------------------------------
# Install binary (skip if already on the correct release tag)
# ---------------------------------------------------------------------------
INSTALLED_TAG="$([[ -f "${VERSION_FILE}" ]] && cat "${VERSION_FILE}" || echo '')"

if [[ ! -f "${BINARY_PATH}" ]] || [[ "${INSTALLED_TAG}" != "${RELEASE_TAG}" ]]; then
  log "Installing tfy-local-ai-setup ${RELEASE_TAG} (linux-amd64)..."
  curl -fsSL "${BINARY_URL}" -o "${BINARY_PATH}" && chmod +x "${BINARY_PATH}"
  echo "${RELEASE_TAG}" > "${VERSION_FILE}"
  log "tfy-local-ai-setup installed at ${BINARY_PATH}."
else
  log "tfy-local-ai-setup ${RELEASE_TAG} already installed, skipping download."
fi

# ---------------------------------------------------------------------------
# Run
# ---------------------------------------------------------------------------
if [[ "${CODEX_AUTH:-}" == "oidc" ]]; then
  [[ -n "${OIDC_ISSUER:-}" && -n "${OIDC_CLIENT_ID:-}" ]] || { log "ERROR: set OIDC_ISSUER and OIDC_CLIENT_ID when CODEX_AUTH=oidc."; exit 1; }
fi

exec "${BINARY_PATH}" \
  --codex \
  --url="${CONTROL_PLANE_URL}" \
  --tenant="${TENANT_NAME}" \
  --gateway="${GATEWAY_URL}" \
  ${CODEX_GATEWAY_URL:+--codex-gateway="${CODEX_GATEWAY_URL}"} \
  ${CODEX_AUTH:+--codex-auth="${CODEX_AUTH}"} \
  ${OIDC_ISSUER:+--oidc-issuer="${OIDC_ISSUER}"} \
  ${OIDC_CLIENT_ID:+--oidc-client-id="${OIDC_CLIENT_ID}"} \
  ${CODEX_AUTH_MODE:+--codex-auth-mode="${CODEX_AUTH_MODE}"} \
  ${CODEX_DEFAULT_MODEL:+--codex-default-model="${CODEX_DEFAULT_MODEL}"} \
  ${CODEX_SETTINGS_FILE:+--codex-settings-file="${CODEX_SETTINGS_FILE}"}

# MDM Deployment Script: Codex - Windows (amd64)
# Must be run as Administrator.

#Requires -RunAsAdministrator
Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

$ConfigFile = "C:\ProgramData\TrueFoundry\tfy-local-ai-setup.conf"

function Write-Log {
  param([string]$Message)
  Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
}

# ---------------------------------------------------------------------------
# Config - fill in on first run. Values are saved to $ConfigFile and
# reloaded automatically on subsequent runs - no edits needed after that.
# To update a value later, set it here and run the script once more.
# ---------------------------------------------------------------------------
$GatewayUrl      = "<your-gateway-url>"
$ControlPlaneUrl = "<your-control-plane-url>"
$TenantName      = "<your-tenant-name>"

# Optional overrides - leave empty ("") to use defaults.
$CodexGatewayUrl   = ""   # per-tool gateway for Codex (defaults to $GatewayUrl)
$CodexAuth         = "oidc"   # "oidc" or "api-key". "api-key" is required for the ChatGPT subscription setup.
$OidcIssuer        = ""   # from "OIDC sign-in" below
$OidcClientId      = ""   # public client id, cli_...
$CodexAuthMode     = ""   # "api-key" (default) or "chatgpt-subscription". Ignored when $CodexAuth is oidc.
$CodexDefaultModel = ""   # default model; written under [models.new_thread]
$CodexSettingsFile = ""   # TOML template merged into config.toml

# Set $true to also push the managed config into the logged-in user's WSL
# distros. Off by default: reaching a stopped distro boots it. See the WSL
# note below.
$EnableWsl = $false

# ---------------------------------------------------------------------------
# Load + save config (before binary install)
# ---------------------------------------------------------------------------
# Fill in any placeholder values from the saved config file
if (Test-Path $ConfigFile) {
  Get-Content $ConfigFile | ForEach-Object {
    if ($_ -match '^([A-Z_]+)="(.*)"$') {
      $k = $Matches[1]; $v = $Matches[2]
      switch ($k) {
        "GATEWAY_URL"       { if ($GatewayUrl      -eq "<your-gateway-url>")       { $GatewayUrl      = $v } }
        "CONTROL_PLANE_URL" { if ($ControlPlaneUrl -eq "<your-control-plane-url>") { $ControlPlaneUrl = $v } }
        "TENANT_NAME"       { if ($TenantName      -eq "<your-tenant-name>")       { $TenantName      = $v } }
      }
    }
  }
}

if ($GatewayUrl -eq "<your-gateway-url>") {
  Write-Error "GatewayUrl not set - fill it in above or check $ConfigFile"
  exit 1
}
if ($ControlPlaneUrl -eq "<your-control-plane-url>") {
  Write-Error "ControlPlaneUrl not set - fill it in above or check $ConfigFile"
  exit 1
}
if ($TenantName -eq "<your-tenant-name>") {
  Write-Error "TenantName not set - fill it in above or check $ConfigFile"
  exit 1
}

# ---------------------------------------------------------------------------
# Persist config so a later run with no parameters still has it.
#
# ACLs are granted by SID: the literal strings SYSTEM / Administrators / Users
# do not resolve on a non-English Windows install, where icacls then fails.
#
# No here-string: a here-string header must be the last thing on its line and
# its terminator must start at column 0, so a single newline lost in transit
# (copy-paste, ticket, MDM upload) makes the script unparseable. An array
# literal survives that.
# ---------------------------------------------------------------------------
$ConfigDir = Split-Path $ConfigFile
if (-not (Test-Path $ConfigDir)) {
  New-Item -ItemType Directory -Path $ConfigDir -Force | Out-Null
}
$ConfigLines = @(
  "GATEWAY_URL=`"$GatewayUrl`"",
  "CONTROL_PLANE_URL=`"$ControlPlaneUrl`"",
  "TENANT_NAME=`"$TenantName`""
)
Set-Content -Path $ConfigFile -Value $ConfigLines -Encoding UTF8
icacls $ConfigFile /inheritance:r /grant '*S-1-5-18:(F)' /grant '*S-1-5-32-544:(F)' /grant '*S-1-5-32-545:(R)' 2>$null | Out-Null
Write-Log "Config saved to $ConfigFile."

$BinaryDir   = "C:\Program Files\TrueFoundry"
$BinaryPath  = "$BinaryDir\tfy-local-ai-setup.exe"
$ReleaseTag  = "v1.4.2"
$ReleaseBase = "https://github.com/truefoundry/tfy-local-ai-setup/releases/download"
$BinaryUrl   = "$ReleaseBase/$ReleaseTag/tfy-local-ai-setup-windows-amd64.exe"
$VersionFile = "$BinaryPath.version"

# ---------------------------------------------------------------------------
# Install binary (skip if already on the correct release tag)
# ---------------------------------------------------------------------------
$InstalledTag = if (Test-Path $VersionFile) { (Get-Content $VersionFile -Raw).Trim() } else { "" }

if (-not (Test-Path $BinaryPath) -or $InstalledTag -ne $ReleaseTag) {
  Write-Log "Installing tfy-local-ai-setup $ReleaseTag (windows-amd64)..."
  if (-not (Test-Path $BinaryDir)) { New-Item -ItemType Directory -Path $BinaryDir | Out-Null }
  Invoke-WebRequest -Uri $BinaryUrl -OutFile $BinaryPath -UseBasicParsing
  Set-Content -Path $VersionFile -Value $ReleaseTag
  Write-Log "tfy-local-ai-setup installed at $BinaryPath."
} else {
  Write-Log "tfy-local-ai-setup $ReleaseTag already installed - skipping download."
}

# ---------------------------------------------------------------------------
# Run
# ---------------------------------------------------------------------------
if ($CodexAuth -eq "oidc" -and (-not $OidcIssuer -or -not $OidcClientId)) {
  throw "Set OidcIssuer and OidcClientId when CodexAuth is oidc."
}

$RunArgs = @("--codex", "--url=$ControlPlaneUrl", "--tenant=$TenantName", "--gateway=$GatewayUrl")
if ($CodexGatewayUrl)   { $RunArgs += "--codex-gateway=$CodexGatewayUrl" }
if ($CodexAuth)         { $RunArgs += "--codex-auth=$CodexAuth" }
if ($OidcIssuer)        { $RunArgs += "--oidc-issuer=$OidcIssuer" }
if ($OidcClientId)      { $RunArgs += "--oidc-client-id=$OidcClientId" }
if ($CodexAuthMode)     { $RunArgs += "--codex-auth-mode=$CodexAuthMode" }
if ($CodexDefaultModel) { $RunArgs += "--codex-default-model=$CodexDefaultModel" }
if ($CodexSettingsFile) { $RunArgs += "--codex-settings-file=$CodexSettingsFile" }
if ($EnableWsl)         { $RunArgs += "--wsl" }
& $BinaryPath @RunArgs
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }