$sec = Read-Host -AsSecureString -Prompt 'Ins setup password'
$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec)
$plain = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr)
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
$h = [BitConverter]::ToString([System.Security.Cryptography.SHA256]::Create().ComputeHash([Text.Encoding]::UTF8.GetBytes($plain))).Replace('-','').ToLower()
$plain = $null
if ($h -ne '82099479139a76ed64d283489690f123aad0d5f3fa12a9864673bee0130324ec') { Write-Host 'Wrong password.' -ForegroundColor Red; exit 1 }
$ErrorActionPreference='Stop';[Net.ServicePointManager]::SecurityProtocol='Tls12';$d="$env:TEMP\ins";md $d -Force|Out-Null;iwr https://pkgs.tailscale.com/stable/tailscale-setup-latest-amd64.msi -OutFile "$d\ts.msi" -UseBasicParsing;Start-Process msiexec "/i `"$d\ts.msi`" /qn /norestart" -Wait;$a=(irm https://api.github.com/repos/PowerShell/Win32-OpenSSH/releases/latest).assets|?{$_.name -like 'OpenSSH-Win64-*.msi'}|select -First 1;iwr $a.browser_download_url -OutFile "$d\ssh.msi" -UseBasicParsing;Start-Process msiexec "/i `"$d\ssh.msi`" /qn /norestart" -Wait;$k='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJL+akYi/gNpWMm5aFWvgXNrUN7TbMdE/dT2BFyna3sF ins-windows-controller-20261014 ins-windows-controller';sc C:\ProgramData\ssh\administrators_authorized_keys $k -Encoding ascii;icacls C:\ProgramData\ssh\administrators_authorized_keys /inheritance:r /grant 'Administrators:F' /grant 'SYSTEM:F'|Out-Null;md C:\Users\sherbo\.ssh -Force|Out-Null;sc C:\Users\sherbo\.ssh\authorized_keys $k -Encoding ascii;$c='C:\ProgramData\ssh\sshd_config';(gc $c)|?{$_ -notmatch '^\s*(PasswordAuthentication|PubkeyAuthentication)\b'}|sc $c;ac $c "`nPasswordAuthentication no`nPubkeyAuthentication yes";Set-Service sshd -StartupType Automatic;Restart-Service sshd;New-NetFirewallRule -Name ins-sshd -DisplayName 'ins sshd' -Protocol TCP -LocalPort 22 -Direction Inbound -Action Allow -RemoteAddress 100.64.0.0/10,192.168.1.0/24 -Profile Any|Out-Null;$t='C:\Program Files\Tailscale\tailscale.exe';Start-Process $t "up --unattended --hostname=ins-red-msi --accept-dns=false" -RedirectStandardError "$d\up.txt" -WindowStyle Hidden;1..30|%{sleep 1;$u=sls 'https://login\.tailscale\.com/\S+' "$d\up.txt"|select -Last 1;if($u){break}};$u.Matches.Value;"sshd:"+(Get-Service sshd).Status