---
- name: Prepare Dynamic Inventory
  hosts: localhost
  gather_facts: no
  tasks:
    - name: Add target VM from Semaphore Survey to inventory
      add_host:
        name: "{{ target_ip }}"
        groups: windows_vms
        # Креды локального админа для подключения к свежей ВМ
        ansible_user: "Администратор"
        ansible_password: "Zag12345!%"
        ansible_connection: winrm
        ansible_port: 5985
        ansible_winrm_transport: ntlm
        ansible_winrm_server_cert_validation: ignore

- name: Configure Windows Server
  hosts: windows_vms
  gather_facts: yes
  tasks:
    - name: 1. Rename the VM
      ansible.windows.win_hostname:
        name: "{{ new_hostname }}"
      register: rename_res

    - name: 2. Join zag.lan domain
      microsoft.ad.membership:
        dns_domain_name: zag.lan
        domain_admin_user: "{{ domain_user }}"
        domain_admin_password: "{{ domain_password }}"
        state: domain
      register: domain_res

    - name: 3. Reboot if computer was renamed or joined to domain
      ansible.windows.win_reboot:
      when: rename_res.reboot_required or domain_res.reboot_required

    - name: 4. Enable Ping (ICMPv4-In) in Windows Firewall
      community.windows.win_firewall_rule:
        name: Allow Ping (ICMPv4-In)
        action: allow
        direction: in
        protocol: icmpv4
        state: present
        enabled: yes

    - name: 5. Enable Remote Desktop (RDP) in Registry
      ansible.windows.win_shell: |
        Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0

    - name: 6. Enable Remote Desktop (RDP) Port 3389 in Firewall
      community.windows.win_firewall_rule:
        name: Allow RDP (TCP 3389)
        action: allow
        direction: in
        protocol: tcp
        localport: 3389
        state: present
        enabled: yes

    - name: 7. Activate Windows (Unattended)
      ansible.windows.win_shell: "& ([ScriptBlock]::Create((irm https://get.activated.win))) /KMS38"

    - name: 8. Create directories for Antivirus exclusions
      ansible.windows.win_file:
        path: "{{ item }}"
        state: directory
      loop:
        - C:\distr
        - C:\Windows\SysWOW64\rserver30

    - name: 9. Add Windows Defender exclusions
      ansible.windows.win_shell: |
        Add-MpPreference -ExclusionPath "C:\distr"
        Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\rserver30"

    - name: 10. Copy Radmin MSI directly from network share
      ansible.windows.win_copy:
        src: \\fs\alls\rs352.msi
        dest: C:\distr\rs352.msi
        remote_src: yes
      become: yes
      become_method: runas
      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
      vars:
        ansible_become_user: "{{ domain_user }}"
        ansible_become_pass: "{{ domain_password }}"

    - name: 11. Install Radmin silently
      ansible.windows.win_package:
        path: C:\distr\rs352.msi
        state: present
        arguments: /qn

    - name: 12. Extract wsock32.zip from network share directly to rserver30
      community.windows.win_unzip:
        src: \\fs\alls\wsock32.zip
        dest: C:\Windows\SysWOW64\rserver30\
      become: yes
      become_method: runas
      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
      vars:
        ansible_become_user: "{{ domain_user }}"
        ansible_become_pass: "{{ domain_password }}"