@allan i think a good breakdown is to use config management (like chef or puppet) to deploy a given version of osqueryd, managing your enroll_secret, deploying server certificate, and deploying a flagfile. then, have your flagfile configure osqueryd to use the tls plugins. then you can use one of the TLS servers to manage your queries, packs, etc.