41 lines
2.7 KiB
PowerShell
41 lines
2.7 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[string]$ScriptPath = '\\nas\MST\codex\assistent\deploy\windows\Invoke-DomovoyNotificationReceiver.ps1',
|
|
[string]$KeyRecordPath = "$env:LOCALAPPDATA\Domovoy\notification-receiver-read-key.dpapi.json",
|
|
[string]$NasKeyBackupPath = '\\nas\MST\codex\_backups\domovoy\keys\notification-receiver-read-key.dpapi.json',
|
|
[string]$TaskName = 'Domovoy Notification Receiver'
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
Set-StrictMode -Version Latest
|
|
|
|
if (-not (Test-Path -LiteralPath $KeyRecordPath -PathType Leaf) -and (Test-Path -LiteralPath $NasKeyBackupPath -PathType Leaf)) {
|
|
New-Item -ItemType Directory -Force -Path (Split-Path -Parent $KeyRecordPath) | Out-Null
|
|
Copy-Item -LiteralPath $NasKeyBackupPath -Destination $KeyRecordPath
|
|
}
|
|
if (-not (Test-Path -LiteralPath $KeyRecordPath -PathType Leaf)) { throw 'DPAPI-protected notification read key is missing' }
|
|
$record = Get-Content -LiteralPath $KeyRecordPath -Raw | ConvertFrom-Json
|
|
if ($record.version -ne 1 -or $record.project -ne 'domovoy' -or $record.purpose -ne 'notification receiver read') { throw 'Unsupported notification key record' }
|
|
$probe = ConvertTo-SecureString ([string]$record.protected_value)
|
|
$probe.Dispose()
|
|
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent().Name
|
|
& icacls.exe $KeyRecordPath /inheritance:r /grant:r "${identity}:F" | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { throw 'DPAPI key ACL hardening failed' }
|
|
$nasDirectory = Split-Path -Parent $NasKeyBackupPath
|
|
New-Item -ItemType Directory -Force -Path $nasDirectory | Out-Null
|
|
$partial = "$NasKeyBackupPath.$PID.partial"
|
|
Copy-Item -LiteralPath $KeyRecordPath -Destination $partial
|
|
Move-Item -LiteralPath $partial -Destination $NasKeyBackupPath -Force
|
|
|
|
if (-not (Test-Path -LiteralPath $ScriptPath -PathType Leaf)) { throw 'Notification receiver script not found' }
|
|
$pwsh = (Get-Command pwsh.exe -ErrorAction Stop).Source
|
|
$arguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$ScriptPath`""
|
|
$action = New-ScheduledTaskAction -Execute $pwsh -Argument $arguments
|
|
$repeat = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 2) -RepetitionDuration (New-TimeSpan -Days 3650)
|
|
$logon = New-ScheduledTaskTrigger -AtLogOn -User $identity
|
|
$principal = New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited
|
|
$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Minutes 2)
|
|
Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger @($repeat, $logon) -Principal $principal -Settings $settings -Description 'Read typed Domovoy receipts and show local Windows notifications.' -Force | Out-Null
|
|
Write-Output "Scheduled task registered: $TaskName"
|