Muster

Services

The decision worth arguing about

The non-obvious decision is how mutual TLS gets terminated on the device channel, and it is the decision that shapes the whole deployment. Every MDM check-in from an Apple device arrives with a per-device client certificate; the server must verify it and, critically, know which device it belongs to. The tempting answer is to terminate mTLS at the application behind a Network Load Balancer, because then the Go service has the full certificate and total control. We use ALB mutual TLS in verify mode instead, with the trust store held in S3, so the ALB validates the chain and passes the client certificate and its serial to the backend in headers. That buys us WAF in front of the device endpoint, which matters because it is a public, unauthenticated-at-the-network-layer surface that every managed laptop in the company hits on a schedule. The trade-off is real: ALB's mTLS revocation handling works from CRLs with size limits that a large fleet's revocation history will eventually exceed, so we still check every presented certificate serial against a revoked-identity table in Postgres on each check-in — meaning we pay for ALB certificate validation and keep an application-level revocation check anyway. We accept the duplication because the failure mode of skipping the application check is a wiped-and-reissued laptop still holding a valid management identity. Separately, APNs needs a persistent HTTP/2 connection, so one Fargate task holds it and pushes are paced through a Redis token bucket rather than fired in a burst; a 600-device fleet all checking in within the same two seconds after an unpaced push is a self-inflicted thundering herd.

Services

The decision worth arguing about

Azure diverges from AWS at exactly the same point, and not in our favour. Azure Front Door — the natural counterpart to CloudFront plus WAF, and what we use for every other application in this library — does not support mutual TLS client certificate authentication. The MDM device channel requires it. So the Azure shape puts Application Gateway v2 in front of the check-in service, because it does support mutual authentication with a configured trust store, and Front Door either sits in front of the console only or comes out entirely. The cost consequence is worth stating plainly: Front Door Standard bills largely by consumption and effectively costs nothing at this scale, whereas Application Gateway v2 carries a fixed per-hour gateway charge plus capacity units, which puts a floor of roughly $180 to $220 a month under the Azure deployment that simply does not exist on AWS. That is most of the gap between the two run-cost figures below. The second consequence is topological: Application Gateway is a regional resource, so a multi-region Muster on Azure needs Traffic Manager or Front Door doing DNS-level steering in front of regional gateways, where on AWS a single global ALB-per-region pattern behind Route 53 latency records is simpler. We would still deploy Muster on Azure for a Microsoft-centric customer — Entra ID for the console and Key Vault Managed HSM for the CA are both genuinely better than their AWS equivalents here — but the device channel is the one place where Azure's edge story costs you money.