# Skript: wg-install.ps1
# Versiya: 1.0.0
# Data: 2026-08-03
# Opisanie: ustanovka WireGuard na Win10 i sozdanie tunnelya do ofisa Rostov.
#           Privatnyy klyuch generiruetsya LOKALNO i nikuda ne otpravlyaetsya.
# ASCII-only: fayl otdayetsya po HTTP i vypolnyaetsya cherez iex,
#             kirillica lomaetsya iz-za charset v PowerShell 5.1.

[CmdletBinding()]
param(
    [string]$PeerIp = "10.9.9.2"
)

# ============================================
# KONFIGURATSIYA
# ============================================
$SERVER_PUBKEY  = "fzXJKg8d8ojWCyqKtdhZ9IbTcfSJXdYqNSJd1NzGBmQ="
$SERVER_ENDPOINT = "80.254.125.143:51820"
$ALLOWED_IPS    = "10.9.9.0/24, 192.168.9.0/24"
$KEEPALIVE      = 25
$TUNNEL_NAME    = "office-rostov"
$WG_DIR         = "$env:ProgramFiles\WireGuard"
$WORK_DIR       = "$env:ProgramData\wg-install"
$LOG_DIR        = Join-Path $WORK_DIR "logs"
$CONF_PATH      = Join-Path $WORK_DIR "$TUNNEL_NAME.conf"
$INSTALLER_URL  = "https://download.wireguard.com/windows-client/wireguard-installer.exe"

# ============================================
# KOD
# ============================================
if (!(Test-Path $LOG_DIR)) { New-Item -Path $LOG_DIR -ItemType Directory -Force | Out-Null }
$LOG_FILE = Join-Path $LOG_DIR "wg-install_$(Get-Date -Format 'yyyyMMdd').log"

function Write-Log {
    param($Level, $Message)
    $entry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Level] $Message"
    Add-Content -Path $LOG_FILE -Value $entry
    Write-Host $entry
}

# Prava administratora obyazatelny: ustanovka MSI i sluzhby tunnelya
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
           ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Write-Host "NUZHEN ZAPUSK OT IMENI ADMINISTRATORA." -ForegroundColor Red -BackgroundColor Black
    Write-Host "Zakroy okno, otkroy PowerShell pravoy knopkoy -> 'Zapusk ot imeni administratora' i povtori." -ForegroundColor Yellow
    return
}

Write-Log "INFO" "Start ustanovki. Peer IP: $PeerIp"

# --- 1. WireGuard ---
if (Test-Path (Join-Path $WG_DIR "wg.exe")) {
    Write-Log "INFO" "WireGuard uzhe ustanovlen - propuskayu"
} else {
    Write-Log "INFO" "Skachivayu WireGuard"
    $installer = Join-Path $env:TEMP "wireguard-installer.exe"
    try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        Invoke-WebRequest -Uri $INSTALLER_URL -OutFile $installer -UseBasicParsing
    } catch {
        Write-Log "ERROR" "Ne udalos skachat WireGuard: $($_.Exception.Message)"
        return
    }
    Write-Log "INFO" "Ustanavlivayu WireGuard"
    $proc = Start-Process -FilePath $installer -ArgumentList "/S" -Wait -PassThru
    Start-Sleep -Seconds 5
    if (!(Test-Path (Join-Path $WG_DIR "wg.exe"))) {
        Write-Log "ERROR" "Ustanovka ne udalas (kod $($proc.ExitCode))"
        return
    }
    Write-Log "INFO" "WireGuard ustanovlen"
}

$wg = Join-Path $WG_DIR "wg.exe"
$wgApp = Join-Path $WG_DIR "wireguard.exe"

# --- 2. Klyuchi: generiruem lokalno, privatnyy ne pokidaet noutbuk ---
if (!(Test-Path $WORK_DIR)) { New-Item -Path $WORK_DIR -ItemType Directory -Force | Out-Null }
$keyPath = Join-Path $WORK_DIR "client.key"
$pubPath = Join-Path $WORK_DIR "client.pub"

if (Test-Path $keyPath) {
    Write-Log "INFO" "Klyuchi uzhe est - ispolzuyu sushchestvuyushchie"
    $privKey = (Get-Content $keyPath -Raw).Trim()
    $pubKey  = (Get-Content $pubPath -Raw).Trim()
} else {
    Write-Log "INFO" "Generiruyu paru klyuchey"
    $privKey = (& $wg genkey).Trim()
    $pubKey  = ($privKey | & $wg pubkey).Trim()
    Set-Content -Path $keyPath -Value $privKey -NoNewline
    Set-Content -Path $pubPath -Value $pubKey  -NoNewline
    # Dostup k privatnomu klyuchu - tolko administratoram i SYSTEM.
    # SID, a ne imena: na russkoy Windows "BUILTIN\Administrators" ne rezolvitsya.
    try {
        $acl = Get-Acl $keyPath
        $acl.SetAccessRuleProtection($true, $false)
        foreach ($sid in @("S-1-5-32-544", "S-1-5-18")) {
            $idRef = (New-Object System.Security.Principal.SecurityIdentifier($sid))
            $acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
                $idRef, "FullControl", "Allow")))
        }
        Set-Acl -Path $keyPath -AclObject $acl
        Write-Log "INFO" "Prava na privatnyy klyuch ogranicheny"
    } catch {
        Write-Log "WARNING" "Ne udalos ogranichit prava na klyuch: $($_.Exception.Message)"
    }
}

# --- 3. Konfig tunnelya ---
$conf = @"
[Interface]
PrivateKey = $privKey
Address = $PeerIp/32

[Peer]
PublicKey = $SERVER_PUBKEY
Endpoint = $SERVER_ENDPOINT
AllowedIPs = $ALLOWED_IPS
PersistentKeepalive = $KEEPALIVE
"@
Set-Content -Path $CONF_PATH -Value $conf -Encoding ASCII
Write-Log "INFO" "Konfig zapisan: $CONF_PATH"

# --- 4. Sluzhba tunnelya (idempotentno) ---
$svcName = "WireGuardTunnel`$$TUNNEL_NAME"
if (Get-Service -Name $svcName -ErrorAction SilentlyContinue) {
    Write-Log "INFO" "Sluzhba tunnelya est - pereustanavlivayu s novym konfigom"
    & $wgApp /uninstalltunnelservice $TUNNEL_NAME | Out-Null
    Start-Sleep -Seconds 3
}
& $wgApp /installtunnelservice $CONF_PATH | Out-Null
Start-Sleep -Seconds 5

if (Get-Service -Name $svcName -ErrorAction SilentlyContinue) {
    Write-Log "INFO" "Tunnel '$TUNNEL_NAME' ustanovlen i zapushchen"
} else {
    Write-Log "ERROR" "Sluzhba tunnelya ne sozdana - smotri log WireGuard"
    return
}

# --- 5. RDP na etom kompyutere ---
$rdpDenied = (Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
if ($rdpDenied -eq 0) {
    Write-Log "INFO" "RDP na etom kompyutere uzhe vklyuchen"
} else {
    Write-Log "WARNING" "RDP na etom kompyutere vyklyuchen (eto noutbuk-klient - normalno)"
}

# --- 6. Chto otdat administratoru ---
try { Set-Clipboard -Value $pubKey; $clip = "(skopirovan v bufer obmena)" } catch { $clip = "" }

Write-Host ""
Write-Host "=======================================================" -ForegroundColor Green
Write-Host " GOTOVO. Otprav administratoru etu stroku $clip" -ForegroundColor Green
Write-Host "=======================================================" -ForegroundColor Green
Write-Host ""
Write-Host "  $pubKey" -ForegroundColor Cyan
Write-Host ""
Write-Host " Imya kompyutera: $env:COMPUTERNAME" -ForegroundColor Gray
Write-Host " Tunnel podnimetsya sam, kak tolko administrator dobavit klyuch." -ForegroundColor Gray
Write-Host " Proverka svyazi:  wg show" -ForegroundColor Gray
Write-Host "=======================================================" -ForegroundColor Green
Write-Log "INFO" "PUBKEY klienta: $pubKey"