@echo off
chcp 65001 >nul
set LOG=%USERPROFILE%\phonesync\ssh_enable_log.txt
echo [%date% %time%] SSH enable auto START >> "%LOG%"

echo [%date% %time%] [1/5] Install OpenSSH.Server >> "%LOG%"
dism /online /Add-Capability /CapabilityName:OpenSSH.Server~~~~0.0.1.0 /Quiet /NoRestart >> "%LOG%" 2>&1

echo [%date% %time%] [2/5] Set DefaultShell=PowerShell >> "%LOG%"
reg add "HKLM\SOFTWARE\OpenSSH" /v DefaultShell /t REG_SZ /d "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /f >> "%LOG%" 2>&1

echo [%date% %time%] [3/5] Start sshd + auto >> "%LOG%"
sc config sshd start= auto >> "%LOG%" 2>&1
net start sshd >> "%LOG%" 2>&1

echo [%date% %time%] [4/5] Firewall rule >> "%LOG%"
netsh advfirewall firewall add rule name="OpenSSH Server (sshd)" dir=in action=allow protocol=TCP localport=22 >> "%LOG%" 2>&1

echo [%date% %time%] [5/5] Authorize nas-automation key >> "%LOG%"
if not exist "%USERPROFILE%\.ssh" mkdir "%USERPROFILE%\.ssh"
set PUBKEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP4Z6pxGIOUywAiepssiYJ0PwDf22KASa4JCAQY1geSU nas-automation
set AUTHFILE=%USERPROFILE%\.ssh\authorized_keys
if exist "%AUTHFILE%" (
    findstr "nas-automation" "%AUTHFILE%" >nul || echo %PUBKEY%>>"%AUTHFILE%"
) else (
    echo %PUBKEY%>"%AUTHFILE%"
)
icacls "%USERPROFILE%\.ssh" /inheritance:r /grant:r "%USERNAME%:(R)" "SYSTEM:(F)" "Administrators:(F)" >> "%LOG%" 2>&1
icacls "%AUTHFILE%" /inheritance:r /grant:r "%USERNAME%:(R)" >> "%LOG%" 2>&1

echo [%date% %time%] SSH enable auto DONE >> "%LOG%"