@echo off
REM ===========================================================================
REM podbringup.bat -- ONE double-click pod bring-up.  BT411.
REM
REM   1. self-elevates (accept the UAC prompt -- that is the only interaction)
REM   2. installs the built-in Windows OpenSSH SERVER
REM   3. authorizes ONE key (the laptop's bt411 key) and locks its ACL
REM   4. opens SSH on private/domain profiles ONLY (never the public internet)
REM   5. probes the display/GPU/monitor/serial topology
REM   6. sends the results BACK over Tailscale -- no copying by hand
REM
REM Undo (admin cmd):
REM   sc stop sshd & sc config sshd start= disabled
REM   del C:\ProgramData\ssh\administrators_authorized_keys
REM   netsh advfirewall firewall delete rule name="BT411 SSH"
REM ===========================================================================

REM ---- 1. elevate -----------------------------------------------------------
net session >nul 2>&1
if %errorlevel% neq 0 (
  echo Requesting administrator rights -- click YES on the prompt...
  powershell -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
  exit /b
)

setlocal enabledelayedexpansion
set LAPTOP=desktop-ae1su9u
set TS=C:\PROGRA~1\Tailscale\tailscale.exe
set REPORT=%~dp0podbringup_report.txt
set DXOUT=%~dp0podbringup_dxdiag.txt

echo ==================== BT411 POD BRING-UP ====================> "%REPORT%"
echo host=%COMPUTERNAME%  user=%USERNAME%  session=%SESSIONNAME%>> "%REPORT%"
ver >> "%REPORT%"
echo.>> "%REPORT%"

REM ---- 2. OpenSSH server ----------------------------------------------------
echo [1/5] installing OpenSSH server (this can take a minute)...
echo ---- OpenSSH install ---->> "%REPORT%"
dism /online /quiet /norestart /add-capability /capabilityname:OpenSSH.Server~~~~0.0.1.0 >> "%REPORT%" 2>&1
sc config sshd start= auto >> "%REPORT%" 2>&1
net start sshd >> "%REPORT%" 2>&1
sc query sshd | findstr /i "STATE" >> "%REPORT%" 2>&1

REM ---- 3. authorize the laptop key -----------------------------------------
echo [2/5] authorizing the BT411 key...
if not exist C:\ProgramData\ssh mkdir C:\ProgramData\ssh
set AKF=C:\ProgramData\ssh\administrators_authorized_keys
findstr /c:"bt411-claude-code@laptop" "%AKF%" >nul 2>&1
if errorlevel 1 (
  echo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmGkinDbZMwQ/UhwqU/oECUIeAN+pBjLgsekj41di7W bt411-claude-code@laptop>> "%AKF%"
)
icacls "%AKF%" /inheritance:r /grant "SYSTEM:F" /grant "BUILTIN\Administrators:F" >> "%REPORT%" 2>&1
echo ---- authorized_keys ---->> "%REPORT%"
type "%AKF%" >> "%REPORT%" 2>&1

REM ---- 4. firewall (private/domain only) ------------------------------------
echo [3/5] firewall rule (private/tailnet only)...
netsh advfirewall firewall show rule name="BT411 SSH" >nul 2>&1
if errorlevel 1 (
  netsh advfirewall firewall add rule name="BT411 SSH" dir=in action=allow protocol=TCP localport=22 profile=private,domain >> "%REPORT%" 2>&1
)

REM ---- 5. topology probe ----------------------------------------------------
echo [4/5] probing displays / GPUs / monitors / serial ports...
echo.>> "%REPORT%"
echo ---- OS ---->> "%REPORT%"
wmic os get Caption,Version,BuildNumber,OSArchitecture /format:list >> "%REPORT%" 2>&1
echo ---- GPUs ---->> "%REPORT%"
wmic path Win32_VideoController get Name,DriverVersion,DriverDate,CurrentHorizontalResolution,CurrentVerticalResolution /format:list >> "%REPORT%" 2>&1
echo ---- Monitors ---->> "%REPORT%"
wmic path Win32_DesktopMonitor get DeviceID,Name,ScreenWidth,ScreenHeight,Availability /format:list >> "%REPORT%" 2>&1
echo ---- Serial ports (RIO) ---->> "%REPORT%"
wmic path Win32_SerialPort get DeviceID,Name /format:list >> "%REPORT%" 2>&1
echo ---- Tailscale ---->> "%REPORT%"
"%TS%" ip -4 >> "%REPORT%" 2>&1
echo ---- CONNECT WITH ---->> "%REPORT%"
echo   ssh -i ~/.ssh/bt411_pod %USERNAME%@bt411-pod>> "%REPORT%"

echo [5/5] dxdiag (monitor rects + D3D caps, ~30s)...
dxdiag /whql:off /t "%DXOUT%"

REM ---- 6. send it all back --------------------------------------------------
echo Sending results back to %LAPTOP% over Tailscale...
"%TS%" file cp "%REPORT%" "%DXOUT%" %LAPTOP%:
if errorlevel 1 (
  echo.
  echo  ! Taildrop send failed -- right-click these two files and use
  echo    "Send with Tailscale" instead:
  echo      %REPORT%
  echo      %DXOUT%
) else (
  echo  ...sent.
)

echo.
echo ================= DONE =================
echo   ssh user: %USERNAME%    host: bt411-pod
type "%REPORT%" | findstr /i "STATE ssh-ed25519 Caption"
echo.
pause