# Abre acesso SSH temporario (somente por chave) para instalar o Uptime Kuma.
# Rodar em PowerShell como ADMINISTRADOR:
#   powershell -ExecutionPolicy Bypass -File .\abrir-ssh.ps1
# Para desfazer tudo: fechar-ssh.ps1

$ErrorActionPreference = 'Stop'
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole('Administrators')) {
    Write-Host 'Rode este script em um PowerShell como Administrador.' -ForegroundColor Red; exit 1
}

$PubKey = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICJa0Me5XTKzEtkk9A+u08uJLDde7qf/BDgt7LLj7OGC claude-kuma-temp'

Write-Host '1/5 Instalando OpenSSH Server (pode demorar alguns minutos)...'
if ((Get-WindowsCapability -Online -Name 'OpenSSH.Server*').State -ne 'Installed') {
    Add-WindowsCapability -Online -Name 'OpenSSH.Server~~~~0.0.1.0' | Out-Null
}
Start-Service sshd   # primeira partida gera C:\ProgramData\ssh\sshd_config

Write-Host '2/5 Autorizando a chave temporaria...'
# Usuario administrador: o sshd le apenas este arquivo
$adm = 'C:\ProgramData\ssh\administrators_authorized_keys'
Set-Content -Path $adm -Value $PubKey -Encoding ascii
icacls $adm /inheritance:r /grant '*S-1-5-32-544:F' /grant '*S-1-5-18:F' | Out-Null
# Usuario comum: arquivo no perfil
$ud = Join-Path $env:USERPROFILE '.ssh'
New-Item -ItemType Directory -Force -Path $ud | Out-Null
Set-Content -Path (Join-Path $ud 'authorized_keys') -Value $PubKey -Encoding ascii

Write-Host '3/5 Desligando login por senha (so chave)...'
$cfg = 'C:\ProgramData\ssh\sshd_config'
$c = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*PasswordAuthentication\s' }
Set-Content -Path $cfg -Value (@('PasswordAuthentication no') + $c) -Encoding ascii

Write-Host '4/5 Shell padrao = PowerShell e firewall...'
New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value "$env:WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force | Out-Null
Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue | Disable-NetFirewallRule
Remove-NetFirewallRule -DisplayName 'SSH temporario Kuma' -ErrorAction SilentlyContinue
# ponytail: liberado para a rede local e a 192.168.5.0/24 (PC de onde o acesso vem)
New-NetFirewallRule -DisplayName 'SSH temporario Kuma' -Direction Inbound -Protocol TCP -LocalPort 22 -RemoteAddress LocalSubnet,192.168.5.0/24 -Action Allow | Out-Null

Write-Host '5/5 Reiniciando o servico...'
Restart-Service sshd

Write-Host ''
Write-Host '===== PRONTO - passe estas informacoes =====' -ForegroundColor Green
Write-Host "Usuario : $env:USERNAME"
Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.IPAddress -notlike '127.*' -and $_.IPAddress -notlike '169.254.*' } |
    ForEach-Object { Write-Host "IP      : $($_.IPAddress)  ($($_.InterfaceAlias))" }
Write-Host 'Para encerrar o acesso depois: fechar-ssh.ps1'