Skip to content
All work

IT / device management

A self-hosted device fleet: 21 phones, tablets, and TV boxes, 5 set up at once

Self-hosted mobile device management with canary app updates, settings locked by role, and bulk USB setup.

Client
A 15,000-acre New Mexico land and hospitality operator
System
Device Fleet
My role
Design, build, and run
When
Oct 2026
Company console, sample data
Sample dataPhones, PCs, tickets and app requests needing a hand.

01 / Problem

What wasn't working.

Company phones and tablets were personal-style devices. Every update, password, and app install was done by hand, one device at a time. A paid MDM would charge per device, every month.

02 / Approach

What I built.

  1. 01

    Self-hosted MDM with QR enrollment and a custom device agent for remote support, location, and lost mode.

  2. 02

    App updates go to a canary first. They roll out only after the canary is healthy for 60 minutes and the signer matches.

  3. 03

    Settings lockdown in 4 tiers by role, with 12 restrictions added in one pass.

  4. 04

    OS updates in a 03:00 to 06:00 window. Bloat removed on every reachable device.

  5. 05

    5 Pixel phones provisioned at the same time from one USB hub on the server.

Managed phones and tablets, sample data
Sample dataHealth nudges and app update status across the device fleet.
Company devices by person, sample data
Sample dataPhones, tablets, TV boxes and PCs grouped by the person they belong to.
Device map, sample data
Sample dataWhere company devices last reported, for the office only.
MDM device list, sample data
Sample dataThe self-hosted MDM console listing enrolled devices.

03 / Architecture

How the pieces connect.

Headwind MDMJava device agentadb / scrcpyTailscalePython workerssystemd
QRadbEnroll wizardMDM serverself-hostedUpdate workercanary firstDevice agent21 devicesphones, tablets, TVRemote screenEnroll wizardMDM serverself-hostedUpdate workercanary firstDevice agent21 devicesphones, tablets, TVRemote screen
People / UIServiceEdge / networkDevice

04 / Result

5

phones set up at once over one USB hub, no factory reset. 21 devices under one console. 12 of 12 reachable devices clean of bloat. A 12-app catalog for personal requests, pre-checked.

Canary updates

Checked every 20 minutes across 17 sources. Signer must match.

Tiered lockdown

What a person can change depends on their role.

Bulk setup

A USB hub and a script beat an afternoon of tapping.

Remote support

See and control a device screen from the office.

Have a problem like this one?

Book a call

Next step

Tell me what isn't working.

A 30-minute call. You describe the problem, I tell you straight whether it's worth fixing and roughly what it costs.

Book a call