#Requires -Version 5.1

[CmdletBinding()]
param()

$ErrorActionPreference = "Stop"

$IdServer = "rustdesk.bosner.de"
$RelayServer = "rustdesk.bosner.de"
$ApiServer = "https://rustdesk.bosner.de"
$PublicKey = "2V5DxRrXp4mTyUqlmpRF2DRcOivfL2GcSLViXHXVJUg="
$DirectAccessPort = 21118
$FirewallRuleName = "RustDesk Direct Access (Bosner LAN)"
$Config = "host=$IdServer,relay=$RelayServer,api=$ApiServer,key=$PublicKey"

function Test-Administrator {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

if (-not (Test-Administrator)) {
    Write-Host "Fordere Administratorrechte an ..."
    $arguments = "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`""
    $process = Start-Process -FilePath "powershell.exe" -Verb RunAs -ArgumentList $arguments -Wait -PassThru
    exit $process.ExitCode
}

$candidatePaths = @(
    (Join-Path $env:ProgramFiles "RustDesk\RustDesk.exe")
)
if (${env:ProgramFiles(x86)}) {
    $candidatePaths += Join-Path ${env:ProgramFiles(x86)} "RustDesk\RustDesk.exe"
}

$installedBinary = $candidatePaths | Where-Object { Test-Path $_ } | Select-Object -First 1
if (-not $installedBinary) {
    throw "RustDesk ist nicht installiert. Bitte zuerst das Installationsskript von https://rustdesk.bosner.de ausfuehren."
}

Write-Host "Setze ID- und Relay-Server ..."
$configure = Start-Process -FilePath $installedBinary -ArgumentList @("--config", $Config) -Wait -PassThru
if ($configure.ExitCode -ne 0) {
    throw "RustDesk-Konfiguration wurde mit Exit-Code $($configure.ExitCode) beendet."
}

Write-Host "Aktiviere direkten Zugriff im lokalen Netz auf TCP $DirectAccessPort ..."
& $installedBinary --option allow-websocket Y
& $installedBinary --option direct-server Y
& $installedBinary --option direct-access-port $DirectAccessPort

$firewallRule = Get-NetFirewallRule -DisplayName $FirewallRuleName -ErrorAction SilentlyContinue
if ($null -eq $firewallRule) {
    New-NetFirewallRule `
        -DisplayName $FirewallRuleName `
        -Description "Erlaubt RustDesk-Direktzugriff ausschliesslich aus dem lokalen Subnetz." `
        -Direction Inbound `
        -Action Allow `
        -Enabled True `
        -Profile Any `
        -Protocol TCP `
        -LocalPort $DirectAccessPort `
        -RemoteAddress LocalSubnet `
        -Program $installedBinary | Out-Null
} else {
    Set-NetFirewallRule -DisplayName $FirewallRuleName -Enabled True -Action Allow -Profile Any | Out-Null
}

$service = Get-Service -Name "RustDesk" -ErrorAction SilentlyContinue
if ($null -eq $service) {
    throw "Der RustDesk-Dienst wurde nicht gefunden. Bitte RustDesk mit dem Installationsskript neu installieren."
}

Write-Host "Starte den RustDesk-Dienst neu ..."
Restart-Service -Name "RustDesk" -Force
$service.WaitForStatus([System.ServiceProcess.ServiceControllerStatus]::Running, [TimeSpan]::FromSeconds(30))
Start-Sleep -Seconds 3

$configuredServer = (& $installedBinary --option custom-rendezvous-server | Out-String).Trim()
$configuredRelay = (& $installedBinary --option relay-server | Out-String).Trim()
$configuredApi = (& $installedBinary --option api-server | Out-String).Trim()
$configuredKey = (& $installedBinary --option key | Out-String).Trim()
$configuredWebSocket = (& $installedBinary --option allow-websocket | Out-String).Trim()
$configuredDirectServer = (& $installedBinary --option direct-server | Out-String).Trim()
$configuredDirectPort = (& $installedBinary --option direct-access-port | Out-String).Trim()

if ($configuredServer -ne $IdServer -or
    $configuredRelay -ne $RelayServer -or
    $configuredApi -ne $ApiServer -or
    $configuredKey -ne $PublicKey -or
    $configuredWebSocket -ne "Y" -or
    $configuredDirectServer -ne "Y" -or
    $configuredDirectPort -ne "$DirectAccessPort") {
    throw "Konfiguration konnte nicht verifiziert werden. ID='$configuredServer', Relay='$configuredRelay', API='$configuredApi', Direkt='${configuredDirectServer}:$configuredDirectPort'."
}

$clientId = (& $installedBinary --get-id | Out-String).Trim()
Write-Host "Fertig. RustDesk ist jetzt registriert."
Write-Host "RustDesk-ID: $clientId"
Write-Host "ID-Server: $configuredServer"
Write-Host "Relay-Server: $configuredRelay"
Write-Host "Management-API: $configuredApi"
Write-Host "Sicherer Kontotransport: WebSocket/TLS aktiv"
Write-Host "LAN-Direktzugriff: TCP $configuredDirectPort (nur lokales Subnetz)"