Restore from Gitea ZIP snapshot (12.08.2026) after full instance reinstall

Git history was lost when the previous Gitea instance was wiped and
reinstalled due to an unresolved corruption bug — this commit is the
last known-good file content, exported before the reinstall. Prior
commit history is not recoverable through this path.

ansible/setup-windows-users.yml

@@ -0,0 +1,214 @@
+---
+- name: Prepare Dynamic Inventory
+  hosts: localhost
+  gather_facts: no
+  tasks:
+    - name: Add target VM from Semaphore Survey to inventory
+      add_host:
+        name: "{{ target_ip }}"
+        groups: windows_vms
+        ansible_user: "admin"
+        ansible_password: "Zag12345!%"
+        ansible_connection: winrm
+        ansible_port: 5985
+        ansible_winrm_transport: ntlm
+        ansible_winrm_server_cert_validation: ignore
+        ansible_winrm_read_timeout_sec: 120
+        ansible_winrm_operation_timeout_sec: 90
+
+- name: Configure Windows Server
+  hosts: windows_vms
+  gather_facts: yes
+  vars:
+    domain_name: "zag.lan"
+  tasks:
+    # ==========================================
+    # 1. НАДЁЖНАЯ НАСТРОЙКА WINRM
+    # ==========================================
+    - name: 1. Ensure WinRM firewall rules are enabled for ALL profiles
+      community.windows.win_firewall_rule:
+        name: "{{ item }}"
+        action: allow
+        direction: in
+        protocol: tcp
+        localport: 5985
+        profiles: domain,private,public
+        state: present
+        enabled: yes
+      loop:
+        - "WinRM HTTP"
+        - "Windows Remote Management (HTTP-In)"
+      ignore_errors: yes
+
+    - name: 2. Configure WinRM settings
+      ansible.windows.win_shell: |
+        Set-Item -Path WSMan:\localhost\Client\AllowBasic -Value $true -Force
+        Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true -Force
+        Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true -Force
+        Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
+
+    - name: 3. Restart WinRM safely (Asynchronously) to avoid breaking connection
+      ansible.windows.win_shell: |
+        Start-Process powershell.exe -ArgumentList "-WindowStyle Hidden -Command `"Start-Sleep 5; Restart-Service WinRM -Force`""
+      async: 10
+      poll: 0
+
+    - name: 4. Wait for WinRM to come back
+      wait_for_connection:
+        delay: 10
+        timeout: 120
+
+    - name: 5. Ensure WinRM service is configured to Auto-Start
+      ansible.windows.win_service:
+        name: WinRM
+        start_mode: auto
+        state: started
+
+    # ==========================================
+    # 2. ПЕРЕИМЕНОВАНИЕ И ВВОД В ДОМЕН
+    # ==========================================
+    - name: 6. Rename the VM
+      ansible.windows.win_hostname:
+        name: "{{ new_hostname }}"
+      register: rename_res
+
+    - name: 7. Reboot after rename
+      ansible.windows.win_reboot:
+        reboot_timeout: 900
+        post_reboot_delay: 45
+      when: rename_res.reboot_required
+
+    - name: 8. Join domain
+      microsoft.ad.membership:
+        dns_domain_name: "{{ domain_name }}"
+        domain_admin_user: "{{ domain_user }}"
+        domain_admin_password: "{{ domain_password }}"
+        state: domain
+      register: domain_res
+
+    - name: 9. Reboot after domain join
+      ansible.windows.win_reboot:
+        reboot_timeout: 900
+        post_reboot_delay: 45
+      when: domain_res.reboot_required
+
+    # ==========================================
+    # 3. ОСНОВНЫЕ НАСТРОЙКИ СИСТЕМЫ
+    # ==========================================
+    - name: 10. Configure Windows Firewall (Ping & RDP)
+      community.windows.win_firewall_rule:
+        name: "{{ item.name }}"
+        action: allow
+        direction: in
+        protocol: "{{ item.proto }}"
+        localport: "{{ item.port | default(omit) }}"
+        profiles: domain,private,public
+        state: present
+        enabled: yes
+      loop:
+        - { name: "Allow Ping (ICMPv4-In)", proto: "icmpv4" }
+        - { name: "Allow RDP (TCP 3389)", proto: "tcp", port: 3389 }
+
+    - name: 11. Enable Remote Desktop (RDP) in Registry
+      ansible.windows.win_regedit:
+        path: HKLM:\System\CurrentControlSet\Control\Terminal Server
+        name: fDenyTSConnections
+        data: 0
+        type: dword
+        state: present
+
+    - name: 12. Activate Windows (Unattended)
+      ansible.windows.win_shell: "& ([ScriptBlock]::Create((irm https://get.activated.win))) /KMS38"
+      ignore_errors: yes
+
+    - name: 13. Set "High Performance" power plan and disable sleep
+      ansible.windows.win_shell: |
+        powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
+        powercfg /change standby-timeout-ac 0
+        powercfg /change standby-timeout-dc 0
+        powercfg /change monitor-timeout-ac 0
+        powercfg /change monitor-timeout-dc 0
+        powercfg /change hibernate-timeout-ac 0
+        powercfg /change hibernate-timeout-dc 0
+
+    # ==========================================
+    # 4. УСТАНОВКА И НАСТРОЙКА RADMIN
+    # ==========================================
+    - name: 14. Create directories for Antivirus exclusions
+      ansible.windows.win_file:
+        path: "{{ item }}"
+        state: directory
+      loop:
+        - C:\distr
+        - C:\Windows\SysWOW64\rserver30
+
+    - name: 15. Add Windows Defender exclusions
+      ansible.windows.win_shell: |
+        Add-MpPreference -ExclusionPath "C:\distr" -ErrorAction SilentlyContinue
+        Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\rserver30" -ErrorAction SilentlyContinue
+
+    - name: 16. Copy Radmin MSI directly from network share
+      ansible.windows.win_copy:
+        src: \\fs\alls\rs352.msi
+        dest: C:\distr\rs352.msi
+        remote_src: yes
+      become: yes
+      become_method: runas
+      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
+      vars:
+        ansible_become_user: "{{ domain_user }}"
+        ansible_become_pass: "{{ domain_password }}"
+
+    - name: 17. Install Radmin silently
+      ansible.windows.win_package:
+        path: C:\distr\rs352.msi
+        state: present
+        arguments: /qn
+
+    - name: 18. Force stop Radmin service and kill processes before patching
+      ansible.windows.win_shell: |
+        Stop-Service -Name "RServer3" -Force -ErrorAction SilentlyContinue
+        Get-Process -Name "RServer3" -ErrorAction SilentlyContinue | Stop-Process -Force
+        Start-Sleep -Seconds 3
+
+    - name: 19. Extract wsock32.zip from network share directly to rserver30
+      community.windows.win_unzip:
+        src: \\fs\alls\wsock32.zip
+        dest: C:\Windows\SysWOW64\rserver30\
+      become: yes
+      become_method: runas
+      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
+      vars:
+        ansible_become_user: "{{ domain_user }}"
+        ansible_become_pass: "{{ domain_password }}"
+
+    - name: 20. Set Windows NT authentication mode in Radmin
+      ansible.windows.win_regedit:
+        path: HKLM:\SOFTWARE\WOW6432Node\Radmin\Server\Parameters
+        name: "{{ item.name }}"
+        data: "{{ item.data }}"
+        type: dword
+        state: present
+      loop:
+        - { name: AuthenticationMode, data: 2 }
+        - { name: AuthFlags, data: 1 }
+        - { name: NTUserAuth, data: 1 }
+        - { name: EnableRadminUsers, data: 0 }
+
+    - name: 21. Add computer to AD group Radmin
+      ansible.windows.win_shell: |
+        net localgroup "Radmin" {{ ansible_facts['hostname'] }}$ /add /domain
+      become: yes
+      become_method: runas
+      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
+      vars:
+        ansible_become_user: "{{ domain_user }}"
+        ansible_become_pass: "{{ domain_password }}"
+      register: add_to_ad_group
+      ignore_errors: yes
+
+    - name: 22. Start Radmin service
+      ansible.windows.win_service:
+        name: RServer3
+        state: started
+        start_mode: auto