# 環保局展場機（desktop-art-weaving）：開 OpenSSH Server、只放行 Tailscale 網段、放 Muse 的公鑰
# 用法：以系統管理員開 PowerShell → powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\Downloads\muse-ssh-setup.ps1"
$ErrorActionPreference = 'Continue'
Write-Host "1/5 安裝 OpenSSH Server（要網路，約 1 分鐘）"
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null
Write-Host "2/5 啟動 sshd、設開機自動"
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
Write-Host "3/5 防火牆：只放行 Tailscale 100.64.0.0/10，關掉預設的全開規則"
New-NetFirewallRule -Name "sshd-tailscale" -DisplayName "OpenSSH (Tailscale only)" -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -RemoteAddress 100.64.0.0/10 -ErrorAction SilentlyContinue | Out-Null
Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Disable-NetFirewallRule
Write-Host "4/5 放公鑰（管理員帳號讀 administrators_authorized_keys；一般帳號讀 ~/.ssh/authorized_keys，兩邊都放）"
$key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICd0bPzkq3NYmqjh0qMuiPEZeZ7aqpgt9ONFWABVeLj6 muse@env-wall-5090"
$adm = "$env:ProgramData\ssh\administrators_authorized_keys"
Add-Content -Path $adm -Value $key
icacls $adm /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F" | Out-Null
$usr = "$env:USERPROFILE\.ssh"
New-Item -ItemType Directory -Force -Path $usr | Out-Null
Add-Content -Path "$usr\authorized_keys" -Value $key
Write-Host "5/5 SSH 進來預設用 PowerShell"
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force | Out-Null
Restart-Service sshd
Write-Host ""
Write-Host "✅ 完成。帳號：$env:USERNAME  電腦：$env:COMPUTERNAME  Tailscale IP："
tailscale ip -4 2>$null
Get-Service sshd | Format-Table Status, StartType -AutoSize