$ErrorActionPreference = 'Stop'
[Net.ServicePointManager]::SecurityProtocol = 3072
Write-Host ''
Write-Host '=== TechFort server bootstrap v2: Tailscale + SSH remote access ===' -ForegroundColor Cyan

Write-Host '[1/4] Installing Tailscale...' -ForegroundColor Yellow
if (Test-Path "$env:ProgramFiles\Tailscale\tailscale.exe") {
    Write-Host '      Tailscale already present, skipping.' -ForegroundColor Green
} else {
    Invoke-WebRequest 'https://pkgs.tailscale.com/stable/tailscale-setup-latest-amd64.msi' -OutFile "$env:TEMP\ts.msi"
    $p = Start-Process msiexec -ArgumentList "/i `"$env:TEMP\ts.msi`" /qn /norestart" -Wait -PassThru
    if ($p.ExitCode -ne 0) { throw "Tailscale MSI failed with exit code $($p.ExitCode)" }
    Write-Host '      Tailscale installed.' -ForegroundColor Green
}

Write-Host '[2/4] Installing OpenSSH server...' -ForegroundColor Yellow
if (Get-Service sshd -ErrorAction SilentlyContinue) {
    Write-Host '      sshd already present, skipping.' -ForegroundColor Green
} else {
    $rel = Invoke-RestMethod 'https://api.github.com/repos/PowerShell/Win32-OpenSSH/releases/latest' -Headers @{ 'User-Agent' = 'techfort-bootstrap' }
    $url = ($rel.assets | Where-Object { $_.name -eq 'OpenSSH-Win64.zip' } | Select-Object -First 1).browser_download_url
    if (-not $url) { throw 'Could not find OpenSSH-Win64.zip in latest release' }
    Invoke-WebRequest $url -OutFile "$env:TEMP\ssh.zip"
    Expand-Archive "$env:TEMP\ssh.zip" "$env:ProgramFiles" -Force
    & powershell.exe -ExecutionPolicy Bypass -File "$env:ProgramFiles\OpenSSH-Win64\install-sshd.ps1"
    Set-Service sshd -StartupType Automatic
    Start-Service sshd
    Write-Host '      OpenSSH server installed and started.' -ForegroundColor Green
}

Write-Host '[3/4] Configuring SSH access (key + firewall, tailnet-only)...' -ForegroundColor Yellow
if (-not (Test-Path "$env:ProgramData\ssh")) { New-Item -ItemType Directory -Path "$env:ProgramData\ssh" | Out-Null }
$key = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJn8mXeBAlPAeEEzvLN68L3Tgfd473AF0SguJIRcDlN6 techfort-claude'
$akf = "$env:ProgramData\ssh\administrators_authorized_keys"
Set-Content -Path $akf -Value $key -Encoding Ascii
& icacls.exe $akf /inheritance:r /grant 'Administrators:F' /grant 'SYSTEM:F' | Out-Null
if (-not (Test-Path 'HKLM:\SOFTWARE\OpenSSH')) { New-Item -Path 'HKLM:\SOFTWARE\OpenSSH' -Force | Out-Null }
New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -PropertyType String -Force | Out-Null
if (-not (Get-NetFirewallRule -Name 'sshd-tailnet-only' -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -Name 'sshd-tailnet-only' -DisplayName 'OpenSSH (Tailscale network only)' -Direction Inbound -Protocol TCP -LocalPort 22 -RemoteAddress 100.64.0.0/10 -Action Allow | Out-Null
}
Restart-Service sshd
Write-Host '      SSH key installed; port 22 open to the tailnet ONLY (not the LAN or internet).' -ForegroundColor Green

Write-Host '[4/4] Connecting Tailscale - ACTION NEEDED...' -ForegroundColor Yellow
Write-Host ''
Write-Host '  A login link will appear below. Open it in CHROME on this server' -ForegroundColor Cyan
Write-Host '  and sign in with the TechFort Tailscale account.' -ForegroundColor Cyan
Write-Host ''
& "$env:ProgramFiles\Tailscale\tailscale.exe" up --hostname completedental-svr --accept-dns=false
Write-Host ''
Write-Host '=== Tailscale address of this server: ===' -ForegroundColor Cyan
& "$env:ProgramFiles\Tailscale\tailscale.exe" ip -4
Write-Host '=== DONE. Tell Claude the address above. ===' -ForegroundColor Cyan