---
- name: Prepare Dynamic Inventory
  hosts: localhost
  gather_facts: no
  tasks:
    - name: Add target VM from Semaphore Survey to inventory
      add_host:
        name: "{{ target_ip }}"
        groups: windows_vms
        ansible_user: "admin"
        ansible_password: "Zag12345!%"
        ansible_connection: winrm
        ansible_port: 5985
        ansible_winrm_transport: ntlm
        ansible_winrm_server_cert_validation: ignore
        ansible_winrm_read_timeout_sec: 120
        ansible_winrm_operation_timeout_sec: 90

- name: Configure Windows Server
  hosts: windows_vms
  gather_facts: yes
  vars:
    domain_name: "zag.lan"
  tasks:
    # ==========================================
    # 1. НАДЁЖНАЯ НАСТРОЙКА WINRM
    # ==========================================
    - name: 1. Ensure WinRM firewall rules are enabled for ALL profiles
      community.windows.win_firewall_rule:
        name: "{{ item }}"
        action: allow
        direction: in
        protocol: tcp
        localport: 5985
        profiles: domain,private,public
        state: present
        enabled: yes
      loop:
        - "WinRM HTTP"
        - "Windows Remote Management (HTTP-In)"
      ignore_errors: yes

    - name: 2. Configure WinRM settings
      ansible.windows.win_shell: |
        Set-Item -Path WSMan:\localhost\Client\AllowBasic -Value $true -Force
        Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $true -Force
        Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true -Force
        Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value "*" -Force

    - name: 3. Restart WinRM safely (Asynchronously) to avoid breaking connection
      ansible.windows.win_shell: |
        Start-Process powershell.exe -ArgumentList "-WindowStyle Hidden -Command `"Start-Sleep 5; Restart-Service WinRM -Force`""
      async: 10
      poll: 0

    - name: 4. Wait for WinRM to come back
      wait_for_connection:
        delay: 10
        timeout: 120

    - name: 5. Ensure WinRM service is configured to Auto-Start
      ansible.windows.win_service:
        name: WinRM
        start_mode: auto
        state: started

    # ==========================================
    # 2. ПЕРЕИМЕНОВАНИЕ И ВВОД В ДОМЕН
    # ==========================================
    - name: 6. Rename the VM
      ansible.windows.win_hostname:
        name: "{{ new_hostname }}"
      register: rename_res

    - name: 7. Reboot after rename
      ansible.windows.win_reboot:
        reboot_timeout: 900
        post_reboot_delay: 45
      when: rename_res.reboot_required

    - name: 8. Join domain
      microsoft.ad.membership:
        dns_domain_name: "{{ domain_name }}"
        domain_admin_user: "{{ domain_user }}"
        domain_admin_password: "{{ domain_password }}"
        state: domain
      register: domain_res

    - name: 9. Reboot after domain join
      ansible.windows.win_reboot:
        reboot_timeout: 900
        post_reboot_delay: 45
      when: domain_res.reboot_required

    # ==========================================
    # 3. ОСНОВНЫЕ НАСТРОЙКИ СИСТЕМЫ
    # ==========================================
    - name: 10. Configure Windows Firewall (Ping & RDP)
      community.windows.win_firewall_rule:
        name: "{{ item.name }}"
        action: allow
        direction: in
        protocol: "{{ item.proto }}"
        localport: "{{ item.port | default(omit) }}"
        profiles: domain,private,public
        state: present
        enabled: yes
      loop:
        - { name: "Allow Ping (ICMPv4-In)", proto: "icmpv4" }
        - { name: "Allow RDP (TCP 3389)", proto: "tcp", port: 3389 }

    - name: 11. Enable Remote Desktop (RDP) in Registry
      ansible.windows.win_regedit:
        path: HKLM:\System\CurrentControlSet\Control\Terminal Server
        name: fDenyTSConnections
        data: 0
        type: dword
        state: present

    - name: 12. Activate Windows (Unattended)
      ansible.windows.win_shell: "& ([ScriptBlock]::Create((irm https://get.activated.win))) /KMS38"
      ignore_errors: yes

    - name: 13. Set "High Performance" power plan and disable sleep
      ansible.windows.win_shell: |
        powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        powercfg /change standby-timeout-ac 0
        powercfg /change standby-timeout-dc 0
        powercfg /change monitor-timeout-ac 0
        powercfg /change monitor-timeout-dc 0
        powercfg /change hibernate-timeout-ac 0
        powercfg /change hibernate-timeout-dc 0

    # ==========================================
    # 4. УСТАНОВКА И НАСТРОЙКА RADMIN
    # ==========================================
    - name: 14. Create directories for Antivirus exclusions
      ansible.windows.win_file:
        path: "{{ item }}"
        state: directory
      loop:
        - C:\distr
        - C:\Windows\SysWOW64\rserver30

    - name: 15. Add Windows Defender exclusions
      ansible.windows.win_shell: |
        Add-MpPreference -ExclusionPath "C:\distr" -ErrorAction SilentlyContinue
        Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\rserver30" -ErrorAction SilentlyContinue

    - name: 16. Copy Radmin MSI directly from network share
      ansible.windows.win_copy:
        src: \\fs\alls\rs352.msi
        dest: C:\distr\rs352.msi
        remote_src: yes
      become: yes
      become_method: runas
      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
      vars:
        ansible_become_user: "{{ domain_user }}"
        ansible_become_pass: "{{ domain_password }}"

    - name: 17. Install Radmin silently
      ansible.windows.win_package:
        path: C:\distr\rs352.msi
        state: present
        arguments: /qn

    - name: 18. Force stop Radmin service and kill processes before patching
      ansible.windows.win_shell: |
        Stop-Service -Name "RServer3" -Force -ErrorAction SilentlyContinue
        Get-Process -Name "RServer3" -ErrorAction SilentlyContinue | Stop-Process -Force
        Start-Sleep -Seconds 3

    - name: 19. Extract wsock32.zip from network share directly to rserver30
      community.windows.win_unzip:
        src: \\fs\alls\wsock32.zip
        dest: C:\Windows\SysWOW64\rserver30\
      become: yes
      become_method: runas
      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
      vars:
        ansible_become_user: "{{ domain_user }}"
        ansible_become_pass: "{{ domain_password }}"

    - name: 20. Set Windows NT authentication mode in Radmin
      ansible.windows.win_regedit:
        path: HKLM:\SOFTWARE\WOW6432Node\Radmin\Server\Parameters
        name: "{{ item.name }}"
        data: "{{ item.data }}"
        type: dword
        state: present
      loop:
        - { name: AuthenticationMode, data: 2 }
        - { name: AuthFlags, data: 1 }
        - { name: NTUserAuth, data: 1 }
        - { name: EnableRadminUsers, data: 0 }

    - name: 21. Add computer to AD group Radmin
      ansible.windows.win_shell: |
        net localgroup "Radmin" {{ ansible_facts['hostname'] }}$ /add /domain
      become: yes
      become_method: runas
      become_flags: logon_type=new_credentials logon_flags=netcredentials_only
      vars:
        ansible_become_user: "{{ domain_user }}"
        ansible_become_pass: "{{ domain_password }}"
      register: add_to_ad_group
      ignore_errors: yes

    - name: 22. Start Radmin service
      ansible.windows.win_service:
        name: RServer3
        state: started
        start_mode: auto