xolo-server 2.1.0 → 2.2.2

data/lib/xolo/server/mixins/title_jamf_access.rb

@@ -56,7 +56,7 @@ module Xolo
         end
 
         # Create title-level things in jamf when creating a title.
-        #
+        # No need to deal with versions here, there are none yet.
         # @return [void]
         ################################
         def create_title_in_jamf
@@ -85,6 +85,10 @@ module Xolo
           # Just calling this will create it if it doesn't exist.
           jamf_frozen_group
 
+          # If we have target-groups, create the jamf_target_groups_exclusion_group
+          # to use as an exclusion
+          jamf_target_groups_exclusion_group if target_groups && !target_groups.pix_empty?
+
           # This either notifies, or does it
           # TODO: EAs for subscribed titles can change at any time and need
           # re-accepted - Notifications must happen.
@@ -100,9 +104,31 @@ module Xolo
         def update_title_in_jamf
           # ORDER MATTERS
 
+          # target group changes are tricky cuz the related group is in scopes
+          # all over the place.
+          need_to_delete_jamf_target_groups_exclusion_group = false
+
+          # TODO: Move this to a sep. method
+          if changes_for_update[:target_groups]
+            # if some->none, update the scopes later, then delete the group at the end
+            if changes_for_update[:target_groups][:new].empty?
+              need_to_delete_jamf_target_groups_exclusion_group = true
+
+            # if from none->some, create the group - add to scopes later
+            elsif changes_for_update[:target_groups][:old].empty?
+              # create the group
+              jamf_target_groups_exclusion_group
+
+            # if tgt grps changed, just update the smartgroup, don't change any scopes
+            else
+              configure_jamf_target_groups_exclusion_group changes_for_update[:target_groups][:new]
+              progress "Jamf: Done updating smart group '#{jamf_target_groups_exclusion_group_name}'", log: :debug
+            end
+          end
+
           # if the exclusions have changed update the manual install released policy
-          if changes_for_update[:excluded_groups]
-            progress "Jamf: Updating excluded groups for Manual Released Policy '#{jamf_manual_install_released_policy_name}'."
+          if changes_for_update[:target_groups] || changes_for_update[:excluded_groups]
+            progress "Jamf: Updating scope for Manual Released Policy '#{jamf_manual_install_released_policy_name}'."
             configure_jamf_manual_install_released_policy(jamf_manual_install_released_policy)
           end
 
@@ -132,39 +158,32 @@ module Xolo
           update_ssvc
           # TODO: deal with icon changes: if changes_for_update&.key? :self_service_icon
 
+          # are there any versions yet? if no, not active
           if jamf_title_active?
             update_versions_for_title_changes_in_jamf
           else
             log_debug "Jamf: Title '#{display_name}' (#{title}) is not yet active to Jamf, nothing to update in versions."
           end
+
+          # version scopes should have been updated, now do the title
+          configure_jamf_manual_install_released_policy
+          delete_jamf_target_groups_exclusion_group if need_to_delete_jamf_target_groups_exclusion_group
         end
 
         # Repair this title in Jamf Pro
-        # - TODO: activate title in patch mgmt
-        #   - TODO: Accept Patch EA
-        # - title-installed smart group 'xolo-<title>-installed'
-        # - frozen static group 'xolo-<title>-frozen'
-        # - manual/SSvc install-current-release policy 'xolo-<title>-install'
-        #   - trigger 'xolo-<title>-install'
-        #   - ssvc icon
-        #   - ssvc category
-        #   - description
-        # - if uninstallable
-        #   - uninstall script 'xolo-<title>-uninstall'
-        #   - uninstall policy 'xolo-<title>-uninstall'
-        #   - if expirable
-        #     - expire policy 'xolo-<title>-expire'
-        #       - trigger  'xolo-<title>-expire'
+        # - TODO: activate title in patch mgmt if needed
+        #   - TODO: Accept Patch EA if needed
         #
         ###############################################
         def repair_jamf_title_objects
           progress "Jamf: Repairing Jamf objects for title '#{title}'", log: :info
 
-          configure_jamf_installed_group
+          repair_jamf_installed_group
           repair_jamf_uninstall_policy
           repair_jamf_uninstall_script
           repair_jamf_expire_policy
           repair_frozen_group
+          repair_jamf_target_groups_exclusion_group
           repair_jamf_manual_install_released_policy
         end
 
@@ -186,9 +205,11 @@ module Xolo
 
           delete_jamf_patch_title
 
-          # static group deleted last,
+          # excl groups deleted last,
           # was used in scopes for patch and normal policies
           delete_jamf_frozen_group
+
+          delete_jamf_target_groups_exclusion_group
         end
 
         # If any title changes require updates to existing versions in
@@ -206,9 +227,13 @@ module Xolo
         ############################
         def update_versions_for_title_changes_in_jamf
           version_objects.each do |vers_obj|
+            progress "Jamf: Applying changes to version '#{vers_obj.version}' of title '#{title}' (#{self.class})", log: :info
             vers_obj.update_release_groups(ttl_obj: self)  if changes_for_update&.key? :release_groups
-            vers_obj.update_excluded_groups(ttl_obj: self) if changes_for_update&.key? :excluded_groups
+
+            vers_obj.update_excluded_groups(ttl_obj: self) if changes_for_update&.key?(:excluded_groups) || changes_for_update&.key?(:target_groups)
+
             vers_obj.update_jamf_package_notes(ttl_obj: self) if need_to_update_description?
+            vers_obj.update_patch_policy_deployment(ttl_obj: self) if changes_for_update&.key? :self_service_updates
           end
         end
 
@@ -792,8 +817,13 @@ module Xolo
 
           jamf_installed_group.criteria = Jamf::Criteriable::Criteria.new(jamf_installed_group_criteria)
           jamf_installed_group.save
-          log_debug 'Jamf: Sleeping 30 secs to let Jamf server see changes to Installed smart group.'
-          sleep 30
+          log_debug 'Jamf: Sleeping 15 secs to let Jamf server see changes to Installed smart group.'
+          sleep 15
+        end
+
+        ############################
+        def repair_jamf_installed_group
+          configure_jamf_installed_group
         end
 
         # The criteria for the smart group in Jamf that contains all Macs
@@ -846,6 +876,141 @@ module Xolo
           @jamf_installed_group_url = "#{jamf_gui_url}/smartComputerGroups.html?id=#{gr_id}&o=r"
         end
 
+        #######  The TargetGroups Exclusion Group
+        ###########################################
+        ###########################################
+
+        ############################
+        def jamf_target_groups_exclusion_group
+          return @jamf_target_groups_exclusion_group if @jamf_target_groups_exclusion_group
+          return if target_groups_to_use.pix_empty?
+
+          if jamf_target_groups_exclusion_group_exist?
+            @jamf_target_groups_exclusion_group = Jamf::ComputerGroup.fetch(
+              name: jamf_target_groups_exclusion_group_name,
+              cnx: jamf_cnx
+            )
+          else
+            return if deleting?
+
+            progress "Jamf: Creating smart group '#{jamf_target_groups_exclusion_group_name}'", log: :info
+
+            @jamf_target_groups_exclusion_group = Jamf::ComputerGroup.create(
+              name: jamf_target_groups_exclusion_group_name,
+              type: :smart,
+              cnx: jamf_cnx
+            )
+            @jamf_target_groups_exclusion_group.save
+            configure_jamf_target_groups_exclusion_group
+            progress "Jamf: Done creating smart group '#{jamf_target_groups_exclusion_group_name}'", log: :debug
+
+          end
+
+          @jamf_target_groups_exclusion_group
+        end
+
+        ############################
+        def jamf_target_groups_exclusion_group_exist?
+          Jamf::ComputerGroup.all_names(:refresh, cnx: jamf_cnx).include? jamf_target_groups_exclusion_group_name
+        end
+
+        ############################
+        def jamf_target_groups_exclusion_group_criteria(tgt_grps = nil)
+          # for some reason this can be really slow
+          jamf_cnx.timeout = 1800
+          tgt_grps ||= target_groups_to_use
+          criteria = []
+          tgt_grps.each do |tgrp|
+            progress "Jamf: Adding criterion for target group '#{tgrp}' (can be slow)", log: :info
+            criteria << Jamf::Criteriable::Criterion.new(
+              and_or: :and,
+              name: 'Computer Group',
+              search_type: 'not member of',
+              value: tgrp
+            )
+          end
+          criteria
+        end
+
+        ############################
+        def configure_jamf_target_groups_exclusion_group(tgt_grps = nil)
+          return if target_groups_to_use.pix_empty?
+
+          tgt_grps ||= target_groups_to_use
+          progress "Jamf: Configuring smart group '#{jamf_target_groups_exclusion_group_name}'", log: :info
+
+          jamf_target_groups_exclusion_group.criteria =
+            Jamf::Criteriable::Criteria.new jamf_target_groups_exclusion_group_criteria(tgt_grps)
+
+          jamf_target_groups_exclusion_group.save
+
+          progress "Jamf: Sleeping 10 secs to let Jamf server see changes to smart group '#{jamf_target_groups_exclusion_group_name}'", log: :debug
+          sleep 10
+        end
+
+        ############################
+        def repair_jamf_target_groups_exclusion_group
+          progress "Jamf: Repairing smart group '#{jamf_target_groups_exclusion_group_name}'", log: :info
+
+          if target_groups_to_use.pix_empty?
+            delete_jamf_target_groups_exclusion_group
+          else
+            configure_jamf_target_groups_exclusion_group
+            progress "Jamf: Done repairing smart group '#{jamf_target_groups_exclusion_group_name}'", log: :debug
+
+          end
+        end
+
+        ############################
+        def delete_jamf_target_groups_exclusion_group
+          return unless jamf_target_groups_exclusion_group_exist?
+
+          progress "Jamf: Deleting smart group '#{jamf_target_groups_exclusion_group_name}'", log: :info
+          grp = Jamf::ComputerGroup.fetch(
+            name: jamf_target_groups_exclusion_group_name,
+            cnx: jamf_cnx
+          )
+          grp.delete
+
+          # give the server time to see the deletion
+          log_debug "Jamf: Sleeping 10 secs to let server see deletion of smart group '#{jamf_target_groups_exclusion_group_name}'"
+          sleep 10
+        end
+
+        ############################
+        def jamf_target_groups_exclusion_group_url
+          return @jamf_target_groups_exclusion_group_url if @jamf_target_groups_exclusion_group_url
+
+          gr_id = Jamf::ComputerGroup.valid_id jamf_target_groups_exclusion_group_name, cnx: jamf_cnx
+          return unless gr_id
+
+          @jamf_target_groups_exclusion_group_url = "#{jamf_gui_url}/smartComputerGroups.html?id=#{gr_id}&o=r"
+        end
+
+        # should we use the jamf_target_groups_exclusion_group in our exclusions?
+        # If yes, it must have been created before now.
+        # If no, it can't have been deleted yet.
+        #
+        # @return [Boolean] should we use the jamf_target_groups_exclusion_group in our exclusions?
+        #########
+        def use_jamf_target_groups_exclusion_group?
+          if changes_for_update[:target_groups]
+            ## if some-to-none, no
+            if changes_for_update[:target_groups][:new].empty?
+              false
+            # if from none-to-some, yes
+            elsif changes_for_update[:target_groups][:old].empty?
+              true
+            # if tgt grps changed, just update the smartgroup, don't change any scopes
+            else
+              true
+            end
+
+          else
+            !target_groups.empty?
+          end
+        end
+
         #######  The Frozen Group
         ###########################################
         ###########################################
@@ -1260,14 +1425,14 @@ module Xolo
             self.title_id = title
             log_debug "Jamf: Display Name in managed? after setting patch_source and title_id: #{display_name}"
 
-          # display name is required for managed titles, but will be empty for subbed
-          # so for subbed, we look it up from the patch source
+          # display name & publisher are required for managed titles, but will be empty for subbed
+          # so for subbed, we look them up from the patch source in set_subscribed_display_name_and_publisher
           else
-            log_debug "Jamf: Title '#{title}' is subscribed, so looking up patch source and title_id from"
+            log_debug "Jamf: Title '#{title}' is subscribed, so looking up patch source and title_id"
             log_debug "Jamf: Display Name in NOT managed?: #{display_name}"
-            if display_name.pix_empty?
-              self.display_name = Jamf::PatchSource.available_titles(patch_source, cnx: jamf_cnx).select { |t| t[:name_id] == title_id }.first&.dig :app_name
-            end
+
+            set_subscribed_display_name_and_publisher
+
           end # if managed
 
           log_debug "Jamf: class: #{self.class}, display_name: #{display_name}, patch_source: #{patch_source}, title_id: #{title_id}"
@@ -1284,11 +1449,48 @@ module Xolo
             )
           jamf_patch_title.category = Xolo::Server::JAMF_XOLO_CATEGORY
           self.jamf_patch_title_id = jamf_patch_title.save
-          log_debug "Activated Jamf Patch Title '#{display_name}' (#{title}) with id #{jamf_patch_title_id}"
+
+          log_debug "Jamf: Activated Jamf Patch Title '#{display_name}' (#{title}) with id #{jamf_patch_title_id}"
 
           jamf_patch_title
         end
 
+        # set the display name and publisher from the patch title data
+        ########################
+        def set_subscribed_display_name_and_publisher
+          return unless subscribed?
+
+          # if we already have a patch title id, the title won't be available from the patch source,
+          # so use the JPAPI endpoint to look up the data from the already active title.
+          # TODO: update this when ruby-jss uses the JPAPI for patch title stuff
+          if jamf_patch_title_id
+            log_debug 'Jamf: Getting display name and publisher from already-active title.'
+            patch_title_data = jamf_cnx.jp_get "v2/patch-software-title-configurations/#{jamf_patch_title_id}"
+
+            dname = patch_title_data[:displayName]
+            publ = patch_title_data[:softwareTitlePublisher]
+
+          # we don't yet have the patch title id, so the title is still 'available' from the patch source
+          # so get the data there
+          else
+            log_debug 'Jamf: Getting display name and publisher from avilable/not-yet-active title.'
+            patch_title_data = Jamf::PatchSource.available_titles(patch_source, cnx: jamf_cnx).select { |t| t[:name_id] == title_id }.first
+
+            dname = patch_title_data&.dig :app_name
+            publ = patch_title_data&.dig :publisher
+          end # if jamf_patch_title_id
+
+          if dname
+            progress "Jamf: Setting display name for subscribed title: #{dname}", log: :debug
+            self.display_name = dname
+          end
+
+          return unless publ
+
+          progress "Jamf: Setting publisher for subscribed title: #{publ}", log: :debug
+          self.publisher = publ
+        end
+
         # wait up to 60secs for a managed title to become available to be activated
         # subscribed titles are already available
         ####################
@@ -1408,7 +1610,11 @@ module Xolo
         # @param pol [Jamf::Policy] the policy we are configuring
         # @return [void]
         ###################
-        def configure_jamf_manual_install_released_policy(pol)
+        def configure_jamf_manual_install_released_policy(pol = nil)
+          progress "Jamf: Configuring manual install-released policy '#{jamf_manual_install_released_policy_name}'", log: :info
+
+          pol ||= jamf_manual_install_released_policy
+
           pol.category = Xolo::Server::JAMF_XOLO_CATEGORY
           pol.set_trigger_event :checkin, false
           pol.set_trigger_event :custom, jamf_manual_install_released_policy_name
@@ -1421,19 +1627,9 @@ module Xolo
 
           toggle_jamf_manual_install_released_policy pol
 
-          # figure out the exclusions.
-          #
-          # explicit exlusions for the title
-          excls = changes_for_update&.key?(:excluded_groups) ? changes_for_update[:excluded_groups][:new].dup : excluded_groups.dup
-          excls ||= []
-          # plus the frozen group
-          excls << jamf_frozen_group_name
-          # plus any forced group from the server config
-          excls << valid_forced_exclusion_group_name if valid_forced_exclusion_group_name
-          # NOTE: we do not exclude existing installs, so that manual re-installs can be a thing.
-          log_debug "Setting exclusions for manual install policy for current release: #{excls}"
+          log_debug "Setting exclusions for manual install policy for current release: #{excluded_groups_to_use}"
 
-          pol.scope.set_exclusions :computer_groups, excls
+          pol.scope.set_exclusions :computer_groups, excluded_groups_to_use
 
           if self_service?
             add_title_to_self_service(pol)
@@ -1442,6 +1638,30 @@ module Xolo
           end
         end
 
+        # what exclusions should we use now on all title-level scopable things?
+        #######################
+        def excluded_groups_to_use
+          # always the frozen group
+          excls = [jamf_frozen_group_name]
+
+          # plus any explicit exclusions for the title
+          excls += changes_for_update&.key?(:excluded_groups) ? changes_for_update[:excluded_groups][:new] : excluded_groups
+
+          # plus the target_groups_exclusion_group if needed
+          excls << jamf_target_groups_exclusion_group_name if use_jamf_target_groups_exclusion_group?
+
+          # plus any forced group from the server config
+          excls << valid_forced_exclusion_group_name if valid_forced_exclusion_group_name
+
+          excls
+        end
+
+        # what target groups should we use now on all title-level scopable things?
+        #######################
+        def target_groups_to_use
+          changes_for_update&.key?(:target_groups) ? changes_for_update[:target_groups][:new] : target_groups
+        end
+
         # enable or disable the manual install policy for the current release, depending on
         # whether or not we have a released version
         # @param pol [Jamf::Policy] the manual install policy for the current release, which may or may not be saved yet.
@@ -1504,13 +1724,6 @@ module Xolo
 
           configure_pol_for_self_service(pol)
           pol.save
-
-          # loop thru versions to make any SSvc changes
-          version_objects.each do |vobj|
-            ppol = vobj.jamf_patch_policy
-            vobj.configure_patch_pol_for_self_service ppol
-            ppol.save
-          end
         end
 
         # Add the jamf_manual_install_released_policy to self service if needed
@@ -1593,12 +1806,17 @@ module Xolo
           pol.self_service_description = new_desc
 
           pol.self_service_install_button_text = Xolo::Server::Title::SELF_SERVICE_INSTALL_BTN_TEXT
+          # icon already uploaded to jamf
+          return if ssvc_icon_id
+
+          # icon never uploaded to xolo
           return unless ssvc_icon_file
 
-          # TODO: Is this needed if we already have a ssvc_icon_id ??
+          # Upload the icon from xolo to jamd
           progress 'Jamf: Uploading Self Service icon', log: :debug
           pol.save # won't do anything unless needed, but has to exist before we can upload icons
           pol.upload :icon, ssvc_icon_file
+
           # re-fetch the pol to get the icon id
           self.ssvc_icon_id = Jamf::Policy.fetch(id: pol.id, cnx: jamf_cnx).icon.id
         end

data/lib/xolo/server/mixins/version_jamf_access.rb

@@ -45,6 +45,14 @@ module Xolo
         # changes
         JAMF_POLICY_NAME_AUTO_REINSTALL_SFX = 'auto-reinstall'
 
+        PATCH_POL_SSVC_NOTIFICATION_TYPE = :ssvc_and_nctr
+        PATCH_POL_SSVC_INSTALL_BTN_TXT = 'Update'
+        PATCH_POL_SSVC_REMINDER_FREQ_HRS = 24
+        PATCH_POL_SSVC_DEADLINE_DAYS = 7
+
+        PATCH_POL_GRACE_PERIOD_MINUTES = 15
+        PATCH_POL_GRACE_PERIOD_SUBJ = 'Important'
+        PATCH_POL_GRACE_PERIOD_MSG = '$APP_NAMES will quit in $DELAY_MINUTES minutes so that $SOFTWARE_TITLE can be updated. Please save anything you are working on and quit the app(s).'
         # POLICIES, PATCH POLICIES, SCOPING
         #############################
         #
@@ -402,19 +410,6 @@ module Xolo
           jamf_package.save
         end
 
-        # update the :patch_unknown for the patch policy
-        # @return [void]
-        ##############################
-        def update_jamf_patch_policy_patch_unknown
-          return unless changes_for_update&.key? :patch_unknown
-
-          ppol = jamf_patch_policy
-          action = changes_for_update[:patch_unknown][:new] ? 'Enabling' : 'Disabling'
-          progress "Jamf: #{action} 'patch_unknown' for patch policy #{ppol.name}", log: :debug
-          ppol.patch_unknown = changes_for_update[:patch_unknown][:new] ? true : false
-          ppol.save
-        end
-
         # repair the package object only
         #############################
         def repair_jamf_package
@@ -915,16 +910,33 @@ module Xolo
           ppol.save
         end
 
+        # update the :patch_unknown for the patch policy
+        # @return [void]
+        ##############################
+        def update_jamf_patch_policy_patch_unknown
+          return unless changes_for_update&.key? :patch_unknown
+
+          ppol = jamf_patch_policy
+          action = changes_for_update[:patch_unknown][:new] ? 'Enabling' : 'Disabling'
+          progress "Jamf: #{action} 'patch_unknown' for patch policy #{ppol.name}", log: :debug
+          ppol.patch_unknown = changes_for_update[:patch_unknown][:new] ? true : false
+          ppol.save
+        end
+
         # Configure the patch policy
         # NOTE: This doesn't save the changes!
         ##############################
         def configure_jamf_patch_policy(ppol)
+          progress "Jamf: Configuring Patch Policy for Version '#{version}' of Title '#{title}'.", log: :info
+
           ppol.name = jamf_patch_policy_name
           ppol.target_version = version
 
           # This should default to false, so that
           # we don't accidentally downgrade non-xolo test installs,
           # or server-pushed updates (like with commvault or cisco VPN)
+          # The ternary operator is used here so that nils become
+          # explicit false
           ppol.patch_unknown = patch_unknown ? true : false
 
           # when first creating a patch policy, its status is always
@@ -940,43 +952,79 @@ module Xolo
           # exclusions are for always
           set_policy_exclusions ppol
 
+          # deployment method
+          configure_patch_pol_deployment ppol: ppol
+
           # only pilot and released versions should have the patch policy enabled
-          if pilot? || released?
+          if pilot? || released? || creating? || releasing?
             ppol.enable
           else
             ppol.disable
           end
+        end
+
+        # Update the patch policy deployment settings if
+        # they were changed in the title.
+        #
+        # @param ttl_obj [Xolo::Server::Title] the title object that is being changed.
+        ###############################
+        def update_patch_policy_deployment(ttl_obj:)
+          return unless ttl_obj.changes_for_update[:self_service_updates]
 
-          configure_patch_pol_for_self_service ppol
+          ppol = jamf_patch_policy
+          configure_patch_pol_deployment ttl_obj: ttl_obj, ppol: ppol
+          ppol.save
         end
 
-        # Configure the patch policy for self service
+        # Configure the patch policy for self service or automatic deployment
         # NOTE: Does NOT save the policy changes!
         # @param ppol [Jamf::PatchPolicy] The patch policy to configure
         # @return [void]
         # ###############################
-        def configure_patch_pol_for_self_service(ppol = nil)
+        def configure_patch_pol_deployment(ppol: nil, ttl_obj: nil)
           ppol ||= jamf_patch_policy
+          ttl_obj ||= title_object
+
+          use_ssvc_updates =
+            if ttl_obj.changes_for_update&.dig :self_service_updates
+              ttl_obj.changes_for_update[:self_service_updates][:new]
+            else
+              ttl_obj.self_service_updates
+            end
+
+          # always set the grace period regardless of deployment type
+          progress "Jamf: Configuring Patch Policy grace period for version '#{version}' of title '#{title}' ", log: :info
+          ppol.grace_period = PATCH_POL_GRACE_PERIOD_MINUTES
+          ppol.grace_period_subject = PATCH_POL_GRACE_PERIOD_SUBJ
+          ppol.grace_period_message = PATCH_POL_GRACE_PERIOD_MSG
+
+          # Self Service deployment
+          if use_ssvc_updates
+            progress "Jamf: Configuring Patch Policy for version '#{version}' of title '#{title}' for Self Service", log: :info
 
-          # if we're here we're in ssvc
-          progress "Jamf: Configuring patch policy for version '#{version}' of title '#{title}' for Self Service'", log: :info
+            ppol.add_to_self_service
 
-          # TODO: xadm settings for most of these ssvc values.
-          # TODO: deadlines, graceperiod ? needed in ruby-jss
-          msg = "#{title_object.display_name} is ready to be updated to version #{version}"
-          ppol.add_to_self_service
-          ppol.self_service_install_button_text = 'Update'
-          ppol.self_service_description = msg
-          ppol.self_service_notifications_enabled = true
-          ppol.self_service_notification_type = :ssvc_and_nctr
-          ppol.self_service_notification_subject = "#{title_object.display_name} update available"
-          ppol.self_service_notification_message = msg
-          ppol.self_service_reminders_enabled = true
-          ppol.self_service_reminder_frequency = 24 # hours
+            msg = "#{title_object.display_name} is ready to be updated to version #{version}"
 
-          return unless title_object.ssvc_icon_id
+            ppol.self_service_install_button_text = PATCH_POL_SSVC_INSTALL_BTN_TXT
+            ppol.self_service_description = msg
+            ppol.self_service_notifications_enabled = true
+            ppol.self_service_notification_type = PATCH_POL_SSVC_NOTIFICATION_TYPE
+            ppol.self_service_notification_subject = "#{title_object.display_name} update available"
+            ppol.self_service_notification_message = msg
+            ppol.self_service_reminders_enabled = true
+            ppol.self_service_reminder_frequency = PATCH_POL_SSVC_REMINDER_FREQ_HRS
+            ppol.deadline = PATCH_POL_SSVC_DEADLINE_DAYS
 
-          set_patch_policy_ssvc_icon ppol, title_object.ssvc_icon_id
+            return unless title_object.ssvc_icon_id
+
+            set_patch_policy_ssvc_icon ppol, title_object.ssvc_icon_id
+
+          # Automatic deployment
+          else
+            progress "Jamf: Configuring Patch Policy for version '#{version}' of title '#{title}' for automatic deployment", log: :info
+            ppol.remove_from_self_service
+          end
         end
 
         # Set an existing ssvc icon for a given patch policy
@@ -1086,6 +1134,7 @@ module Xolo
         ############################
         def set_policy_exclusions(pol, ttl_obj: nil)
           ttl_obj ||= title_object
+
           # dup, so when we add the installed group below, we don't
           # keep that for future calls to this method.
           exclusions = excluded_groups_to_use(ttl_obj: ttl_obj).dup
@@ -1254,7 +1303,7 @@ module Xolo
           pol = jamf_patch_policy
           return unless pol
 
-          progress "Jamf: Updating exccluded groups for Patch Policy '#{jamf_patch_policy_name}'."
+          progress "Jamf: Updating excluded groups for Patch Policy '#{jamf_patch_policy_name}'."
           set_policy_exclusions(pol, ttl_obj: ttl_obj)
           pol.save
         end