---

$ErrorActionPreference = "Stop"

$capability = Get-WindowsCapability -Online |
    Where-Object Name -Like "OpenSSH.Server*"

if ($capability.State -ne "Installed") {
    Add-WindowsCapability -Online -Name $capability.Name
}

Set-Service -Name sshd -StartupType Automatic
Start-Service -Name sshd

$publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBS2pPg/ItZ3PC3iJNhobEiwtzSP/9RCbAmvUuq5Z11V codex-vilka-tracker"
$authorizedKeys = "$env:ProgramData\ssh\administrators_authorized_keys"

if (-not (Test-Path $authorizedKeys)) {
    New-Item -ItemType File -Path $authorizedKeys -Force | Out-Null
}

$currentKeys = Get-Content $authorizedKeys -ErrorAction SilentlyContinue
if ($currentKeys -notcontains $publicKey) {
    Add-Content -Path $authorizedKeys -Value $publicKey -Encoding ascii
}

& icacls.exe $authorizedKeys /inheritance:r /grant "*S-1-5-32-544:F" /grant "*S-1-5-18:F" | Out-Null

Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue |
    Disable-NetFirewallRule

Get-NetFirewallRule -DisplayName "Vilka Tracker SSH LAN" -ErrorAction SilentlyContinue |
    Remove-NetFirewallRule

New-NetFirewallRule `
    -DisplayName "Vilka Tracker SSH LAN" `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 22 `
    -RemoteAddress LocalSubnet `
    -Profile Any | Out-Null

Restart-Service sshd

Write-Host ""
Write-Host "SSH_READY_USER=$env:USERNAME"
Get-NetTCPConnection -State Listen -LocalPort 22