---

$ErrorActionPreference = 'Stop'

# Разрешаем SSH с основного ноутбука.
$rule = 'OpenSSH-Server-In-TCP'
if (Get-NetFirewallRule -Name $rule -ErrorAction SilentlyContinue) {
    Set-NetFirewallRule -Name $rule -Enabled True -Action Allow `
        -RemoteAddress 192.168.101.9
} else {
    New-NetFirewallRule -Name $rule -DisplayName 'OpenSSH Server' `
        -Direction Inbound -Protocol TCP -LocalPort 22 `
        -RemoteAddress 192.168.101.9 -Action Allow | Out-Null
}

# Добавляем отдельный открытый ключ для диагностики.
$key = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMqtr9qyfdJk1xfWsm5+CUWd7aCLtv3NSgXxiYB7Fbl2 old-laptop-diagnostics'
$folder = "$env:ProgramData\ssh"
New-Item -ItemType Directory -Path $folder -Force | Out-Null
$file = "$folder\administrators_authorized_keys"

if (!(Test-Path $file) -or
    !(Select-String -Path $file -SimpleMatch $key -Quiet)) {
    Add-Content -Path $file -Value $key -Encoding ascii
}

icacls.exe $file /inheritance:r /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F"
if ($LASTEXITCODE -ne 0) { throw 'Не удалось настроить права ключа' }

Set-Service -Name sshd -StartupType Manual
Start-Service sshd

# Сведения для подключения и проверки подлинности ноутбука.
whoami
Get-NetIPAddress -AddressFamily IPv4 |
    Where-Object { $_.IPAddress -notmatch '^(127\.|169\.254\.)' } |
    Format-Table InterfaceAlias, IPAddress

& "$env:WINDIR\System32\OpenSSH\ssh-keygen.exe" `
    -lf "$folder\ssh_host_ed25519_key.pub"