I can’t remember the particulars right now, but there’s a small team that remotely manages the macbooks of Google employees. I suspect that their tools would be a great fit here.

Found the resource I was thinking of:

- https://www.usenix.org/conference/lisa13/managing-macs-googl...

Unfortunately that was 2013, and https://github.com/google/macops only has a couple commits, so those devops processes are likely very outdated.

The mailing list is dead, but as of mid-2017 this statement was made:

> The main google/macops project is still alive, but there is more development currently going on in the other projects we link to (like santa).

> We still use puppet, as do our Linux and Windows fleet, but none of us actually use puppet infrastructure. We are all working with a standalone (masterless) model.

santa seems to be the only actively-developed macOS management tool on the google github profile, but other tools listed in the talk are actively developed (puppet of course, munki, etc)

They started using Puppet against Mac dev machines, then switched to internal tools I believe. But it was one of the first times it occurred to me that we should manage and use DevOps and SRE practices against user machines and user workloads where possible. The trouble is the tooling isn’t that mature yet, and we can’t assume real-time data or always connected machines, and we don’t have a herd because users only have one machine with them at any time and remote state deletion only works when you know you’re not deleting critical state, which in turn requires better tooling and a greater understanding of user application state persistence behaviour than most are willing to invest time in doing.

This is what makes Chromebooks so easy to maintain though: web apps and sandboxed Android apps can all easily sync to the cloud and compartmentalize their data.

I would pay real money for a linux distro that works as well as ChromeOS or macOS that doesn’t have all the phone-home endemic to both (yes, Macs phone home like mad even with iCloud and all of the analytics off).

People have been doing this for a long time. My team uses Puppet & and Ansible to manage Linux user workstations for our university, and the Windows team uses SCCM + other Windows tools. A big reason why we've stuck with Puppet is is it's flexible enough to manage internal systems + and user workstations fairly well, with a lot of the code being shared with all systems Linux/Unix systems we manage.

Does Homebrew not do this for you? You can install pretty much any popular app use cask installs. If Homebrew works for you, you can use a Brewfile similar to a Gemfile or package.json to handle adding and removing apps from your system?

Homebrew works for a lot of stuff, but not little details. For example:

All my Firefox plugins and their config (I guess this is technically data)

All the settings I've changed though the control panel (I can't figure out every file that changes when I make a change).

Any time I've changed a setting with nvram or defaults

Most of the settings of the default apple apps.

My wireless configs

For most of these, there is probably a shell script one could write that can backup and restore them, but I've never found a holistic solution.

nix + home-manager will get you pretty good coverage for non-commercial software. The learning curve is steep but once you get there it's amazing.