---

$ErrorActionPreference = "Stop"

# Установка встроенного SSH-сервера Windows
$cap = Get-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
if ($cap.State -ne "Installed") {
    Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
}

Start-Service sshd
Set-Service sshd -StartupType Automatic

# Разрешаем вход по паролю
$config = "$env:ProgramData\ssh\sshd_config"
$lines = Get-Content $config

if ($lines -match '^\s*#?\s*PasswordAuthentication\s+') {
    $lines = $lines -replace '^\s*#?\s*PasswordAuthentication\s+.*$', 'PasswordAuthentication yes'
} else {
    $lines += 'PasswordAuthentication yes'
}

$lines | Set-Content $config -Encoding ascii

# Создаём отдельного временного пользователя
$password = Read-Host "Придумай временный пароль для CodexDiag" -AsSecureString

if (Get-LocalUser -Name "CodexDiag" -ErrorAction SilentlyContinue) {
    Set-LocalUser -Name "CodexDiag" -Password $password
} else {
    New-LocalUser -Name "CodexDiag" -Password $password -Description "Temporary diagnostics account" -AccountNeverExpires
}

Enable-LocalUser -Name "CodexDiag"

# Даём админские права для чтения системных журналов и драйверов
$admins = Get-LocalGroup -SID "S-1-5-32-544"
Add-LocalGroupMember -Group $admins -Member "CodexDiag" -ErrorAction SilentlyContinue

# Оставляем SSH доступным только внутри локальной сети
Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue |
    Disable-NetFirewallRule

Get-NetFirewallRule -Name "Codex-SSH-LAN" -ErrorAction SilentlyContinue |
    Remove-NetFirewallRule

New-NetFirewallRule `
    -Name "Codex-SSH-LAN" `
    -DisplayName "Codex SSH local network only" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 22 `
    -Action Allow `
    -RemoteAddress LocalSubnet `
    -Profile Any | Out-Null

Restart-Service sshd

Write-Host "`nSSH ГОТОВ" -ForegroundColor Green
Get-Service sshd
Test-NetConnection 127.0.0.1 -Port 22