---

& {
    $sshCapability = Get-WindowsCapability -Online `
        -Name 'OpenSSH.Server~~~~0.0.1.0' -ErrorAction Stop

    if ($sshCapability.State -ne 'Installed') {
        $sshInstall = Add-WindowsCapability -Online `
            -Name 'OpenSSH.Server~~~~0.0.1.0' -ErrorAction Stop

        if ($sshInstall.RestartNeeded) {
            throw 'Windows запрашивает перезагрузку. Не перезагружай сервер — пришли этот результат.'
        }
    }

    Start-Service -Name sshd -ErrorAction Stop
    Set-Service -Name sshd -StartupType Automatic -ErrorAction Stop

    $sshFirewallRule = Get-NetFirewallRule `
        -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue

    if ($sshFirewallRule) {
        Enable-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction Stop
    } else {
        New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' `
            -DisplayName 'OpenSSH Server (sshd)' `
            -Enabled True -Direction Inbound -Protocol TCP `
            -Action Allow -LocalPort 22 -ErrorAction Stop
    }

    Get-Service -Name sshd | Select-Object Name, Status, StartType

    Get-NetTCPConnection -LocalPort 22 -State Listen -ErrorAction Stop |
        Select-Object LocalAddress, LocalPort, State

    & "$env:WINDIR\System32\OpenSSH\ssh-keygen.exe" `
        -lf "$env:ProgramData\ssh\ssh_host_ed25519_key.pub"
}