X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/3c096107d23668caeec91ba27095c9f94d3792b5..452f525c182a835867d0f229c821c41118d15808:/setup-windows-with-uac.ps1?ds=sidebyside

diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1
index 254db14..8da5c55 100644
--- a/setup-windows-with-uac.ps1
+++ b/setup-windows-with-uac.ps1
@@ -1,11 +1,13 @@
 #Requires -RunAsAdministrator
 <#
   setup-windows-with-uac.ps1
-  Elevated portion of BlockBox Windows provisioning. Invoked by setup-windows.bat
+  Elevated portion of the Windows provisioning. Invoked by setup-windows.bat
   via Start-Process -Verb RunAs, or run manually from an Administrator prompt.
 
   What this installs / configures:
     - ssh-agent set to automatic + started
+    - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22
+    - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine PATH
     - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,
       Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)
     - Windows Driver Kit 10.0.26100
@@ -110,6 +112,114 @@ Write-Step 'Enabling ssh-agent'
 Set-Service -Name ssh-agent -StartupType Automatic
 if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent }
 
+# ---------------------------------------------------------------------------
+# OpenSSH Server (sshd)
+#
+# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the
+# transport rsync rides on when seeding test data in. Ships with Windows 10
+# 1809+ / Windows 11 as an on-demand capability, so no third-party install.
+#
+# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall
+# rule; we verify and create it if missing (it is absent on some images).
+#
+# Non-fatal: a box that can't run sshd should still finish provisioning.
+# ---------------------------------------------------------------------------
+Write-Step 'OpenSSH Server (sshd)'
+try {
+    $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' |
+            Select-Object -First 1
+    if (-not $sshd) {
+        Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.'
+    } else {
+        if ($sshd.State -ne 'Installed') {
+            Write-Host "    Installing $($sshd.Name) ..."
+            $r = Add-WindowsCapability -Online -Name $sshd.Name
+            if ($r.RestartNeeded) { Write-Host '    [reboot required after OpenSSH Server]' -ForegroundColor Yellow }
+        } else {
+            Write-Host "    OK: $($sshd.Name) already installed"
+        }
+
+        Set-Service -Name sshd -StartupType Automatic
+        if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd }
+        Write-Host '    sshd: Automatic + running'
+
+        # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and
+        # bridged adapters are frequently classified Public, and the capability's
+        # own rule is Private-only on some images, which is what leaves a plainly
+        # running sshd plainly unreachable.
+        #
+        # OpenSSH-Server-In-TCP is the name the capability itself uses, so this
+        # WIDENS that rule rather than adding a second one next to it. Creating
+        # our own under a different name would leave the narrow rule in place and
+        # the box still unreachable on a Public-classified adapter; creating one
+        # under the same name would collide. Adopt it if present, create it if not.
+        $ruleName = 'OpenSSH-Server-In-TCP'
+        if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) {
+            Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any
+            Write-Host "    Widened firewall rule $ruleName to all profiles"
+        } else {
+            New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' `
+                -Enabled True -Direction Inbound -Protocol TCP -Action Allow `
+                -LocalPort 22 -Profile Any | Out-Null
+            Write-Host "    Added firewall rule $ruleName (TCP 22, all profiles)"
+        }
+    }
+} catch {
+    Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)"
+}
+
+# ---------------------------------------------------------------------------
+# rsync for Windows (github.com/nuket/rsync-windows)
+#
+# Windows' OpenSSH ships the transport only - no rsync - so pushing test data
+# from a Linux box needs an rsync.exe on the Windows side.
+#
+# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is
+# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes
+# the client-side --rsync-path escape hatch painful to quote. Added to the
+# MACHINE PATH so it resolves for every account, including the non-interactive
+# sshd session, which builds its environment from the machine + user registry
+# PATH rather than from a login shell.
+#
+# Non-fatal: a download failure only warns.
+# ---------------------------------------------------------------------------
+Write-Step 'rsync for Windows'
+$RsyncUrl = 'https://github.com/nuket/rsync-windows/releases/download/v3.5.0-g521ad8ad/rsync.exe'
+$RsyncDir = 'C:\Tools\rsync'
+try {
+    New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null
+    $RsyncExe = Join-Path $RsyncDir 'rsync.exe'
+    # Download to a temp name first so an interrupted transfer can't leave a
+    # truncated rsync.exe sitting on the PATH.
+    $tmpExe = "$RsyncExe.download"
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpExe -UseBasicParsing
+    Move-Item -Path $tmpExe -Destination $RsyncExe -Force
+    Write-Host "    Downloaded rsync.exe to $RsyncExe"
+
+    # Machine PATH (HKLM environment). Idempotent: only appends if absent.
+    $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')
+    if (-not $m) { $m = '' }
+    if (($m -split ';') -notcontains $RsyncDir) {
+        $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir }
+        [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')
+        Write-Host "    Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)."
+        # sshd caches the environment it was started with, so an already-running
+        # service would not see the new PATH until restarted.
+        if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') {
+            Restart-Service sshd
+            Write-Host '    Restarted sshd so it inherits the updated machine PATH.'
+        }
+    } else {
+        Write-Host "    OK: $RsyncDir already in the machine PATH"
+    }
+
+    & $RsyncExe --version | Select-Object -First 1
+} catch {
+    Write-Warning "rsync install failed: $($_.Exception.Message)"
+    Write-Warning "Download manually from $RsyncUrl and drop it in $RsyncDir."
+}
+
 # ---------------------------------------------------------------------------
 # Visual Studio 2022 Community
 # ---------------------------------------------------------------------------