chore(home): mirror from kalinamall (038363c) with papatramp URLs

This commit is contained in:
2026-07-14 20:44:01 +10:00
commit 6d102603c2
46 changed files with 12612 additions and 0 deletions
+39
View File
@@ -0,0 +1,39 @@
# Push sanitized main to GitHub without leaving secrets on local main (kalinamall workflow).
# Usage: .\scripts\Push-GitHubMirror.ps1
param(
[string]$Remote = 'github',
[string]$Branch = 'main'
)
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root
git remote get-url $Remote 2>$null | Out-Null
if ($LASTEXITCODE -ne 0) {
throw "remote not configured: $Remote"
}
if ((git status --porcelain)) {
throw 'working tree not clean; commit or stash first'
}
$before = (git rev-parse HEAD).Trim()
Write-Output "local HEAD before GitHub push: $before"
& "$PSScriptRoot\Sanitize-ForGitHub.ps1"
& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target github
& "$PSScriptRoot\Test-NoSecretsForGitHub.ps1"
$status = git status --porcelain
if (-not $status) {
Write-Output 'no changes after sanitize; pushing current HEAD to GitHub'
git push $Remote $Branch
exit 0
}
git add -A
git commit -m "chore(github): sanitize secrets and sync public mirror URLs"
git push --force-with-lease $Remote $Branch
git reset --hard $before
Write-Output "pushed $Remote/$Branch (force-with-lease mirror); local main restored to $before (production/kalinamall)"
+41
View File
@@ -0,0 +1,41 @@
# Push main to a mirror remote with host-specific doc URLs, without leaving URL churn on main.
# Usage: .\scripts\Push-Mirror.ps1 github|kalinamall|papatramp
param(
[Parameter(Mandatory = $true)]
[ValidateSet('github', 'kalinamall', 'papatramp')]
[string]$Target
)
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root
$remote = switch ($Target) {
'github' { 'github' }
'kalinamall' { 'kalinamall' }
'papatramp' { 'papatramp' }
}
git remote get-url $remote 2>$null | Out-Null
if ($LASTEXITCODE -ne 0) {
throw "remote not configured: $remote"
}
if ((git status --porcelain)) {
throw 'working tree not clean; commit or stash first'
}
$before = (git rev-parse HEAD).Trim()
& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target $Target
if (-not (git status --porcelain)) {
Write-Output "no URL changes for $Target; pushing as-is"
git push $remote main
exit 0
}
git add -A
git commit -m "chore(docs): sync repository URLs for ${Target} mirror"
git push $remote main
git reset --hard $before
Write-Output "pushed $remote with ${Target} URLs; local main reset to $before"
+67
View File
@@ -0,0 +1,67 @@
# Push main to kalinamall / papatramp with production secrets and paths.
# GitHub (origin) stays sanitized — never push this commit to origin.
# Usage: .\scripts\Push-PrivateMirror.ps1 kalinamall|papatramp
param(
[Parameter(Mandatory = $true)]
[ValidateSet('kalinamall', 'papatramp')]
[string]$Target
)
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root
$remote = $Target
git remote get-url $remote 2>$null | Out-Null
if ($LASTEXITCODE -ne 0) {
throw "remote not configured: $remote (git remote add $remote <url>)"
}
if ((git status --porcelain)) {
throw 'working tree not clean; commit or stash first'
}
$before = (git rev-parse HEAD).Trim()
git fetch $remote main 2>$null
if ($LASTEXITCODE -ne 0) {
git fetch $remote 2>$null
}
# Production-only files: real tokens, NETLOGON paths, org hostnames.
$privateFiles = @(
'login_monitor.settings.example.ps1',
'update-rdp-monitor.ps1',
'exchange_monitor.settings.example.ps1'
)
$hadPrivate = $false
foreach ($f in $privateFiles) {
$ref = "${remote}/main"
git rev-parse "$ref`:$f" 2>$null | Out-Null
if ($LASTEXITCODE -eq 0) {
git checkout "$ref" -- $f
$hadPrivate = $true
Write-Output "restored from ${remote}/main: $f"
} else {
Write-Warning "skip (not on ${remote}/main): $f"
}
}
if (-not $hadPrivate) {
throw "no private files on ${remote}/main; restore production files manually once, then re-run"
}
& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target $Target
git add -A
$status = git status --porcelain
if (-not $status) {
Write-Output "no changes vs local main; pushing as-is to $remote"
git push $remote main
exit 0
}
git commit -m "chore(private): sync production secrets and paths for ${Target} mirror"
git push $remote main
git reset --hard $before
Write-Output "pushed $remote with production files; local main reset to $before (GitHub-safe)"
+62
View File
@@ -0,0 +1,62 @@
# Rewrite cross-repo URLs in tracked docs/config for the target Git host.
# Usage: .\scripts\Rewrite-GitHostUrls.ps1 github|kalinamall|papatramp
param(
[Parameter(Mandatory = $true)]
[ValidateSet('github', 'kalinamall', 'papatramp')]
[string]$Target
)
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root
switch ($Target) {
'github' {
$Base = 'https://github.com/PTah'
$BlobSuffix = '/blob/main'
}
'kalinamall' {
$Base = 'https://git.kalinamall.ru/PapaTramp'
$BlobSuffix = '/src/branch/main'
}
'papatramp' {
$Base = 'https://git.papatramp.ru/PapaTramp'
$BlobSuffix = '/src/branch/main'
}
}
$BaseHost = $Base -replace '^https://', ''
$patterns = @(
@{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`${1}$BlobSuffix/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/blob/main/'; To = "$Base/`${1}$BlobSuffix/" }
@{ From = 'https://git\.kalinamall\.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/([^)/''"\s]+)/src/branch/main/'; To = "$Base/`${1}$BlobSuffix/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
@{ From = 'https://git.papatramp.ru/PapaTramp/'; To = "$Base/" }
@{ From = 'git.papatramp.ru/PapaTramp/'; To = "$BaseHost/" }
@{ From = 'git.papatramp.ru/PapaTramp/'; To = "$BaseHost/" }
@{ From = 'git.papatramp.ru/PapaTramp/'; To = "$BaseHost/" }
@{ From = 'git.papatramp.ru/PapaTramp/'; To = "$BaseHost/" }
)
$extensions = @('*.md', '*.json', '*.service', '*.example', '*.sh', '*.ps1', '*.yml', '*.yaml')
$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
foreach ($file in $files) {
$content = [System.IO.File]::ReadAllText((Join-Path $Root $file))
$updated = $content
foreach ($p in $patterns) {
$updated = [regex]::Replace($updated, $p.From, $p.To)
}
if ($updated -ne $content) {
[System.IO.File]::WriteAllText((Join-Path $Root $file), $updated, [System.Text.UTF8Encoding]::new($false))
Write-Output "updated: $file"
}
}
Write-Output "Rewrite-GitHostUrls: target=$Target base=$Base"
+169
View File
@@ -0,0 +1,169 @@
# Replace production-only values with public-safe placeholders (GitHub mirror).
# Usage: .\scripts\Sanitize-ForGitHub.ps1
# Reversible: production copies live on kalinamall/papatramp; restore via git reset --hard.
param(
[switch]$WhatIf
)
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root
function Set-TrackedFileText {
param(
[Parameter(Mandatory = $true)][string]$RelativePath,
[Parameter(Mandatory = $true)][string]$Content
)
$path = Join-Path $Root $RelativePath
if ($WhatIf) {
Write-Output "WhatIf: would write $RelativePath"
return
}
$utf8Bom = New-Object System.Text.UTF8Encoding $true
[System.IO.File]::WriteAllText($path, $Content.TrimEnd() + "`r`n", $utf8Bom)
Write-Output "sanitized: $RelativePath"
}
$loginSettings = @'
<#
.SYNOPSIS
Локальные настройки Login_Monitor.ps1
.DESCRIPTION
Скопируйте в C:\ProgramData\RDP-login-monitor\login_monitor.settings.ps1
и при необходимости отредактируйте. Deploy-LoginMonitor.ps1 не перезаписывает settings,
если SAC уже настроен (UseSAC не off и задан SacApiKey). При первой установке или апгрейде
с версии без SAC (нет Sac-Client.ps1 / пустой ключ) example копируется поверх с резервной .bak.
#>
# --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
$TelegramBotToken = 'YOUR_BOT_TOKEN'
$TelegramChatID = 'YOUR_CHAT_ID'
# $TelegramBotTokenProtectedB64 = ''
# $TelegramChatIDProtectedB64 = ''
# --- Email (опционально) ---
$NotifyOrder = 'tg'
# $MailSmtpHost = 'smtp.example.com'
# $MailSmtpPort = 587
# $MailSmtpUser = ''
# $MailSmtpPassword = ''
# $MailFrom = 'monitor@example.com'
# $MailTo = 'admin@example.com'
# $MailSmtpStartTls = $true
# $MailSmtpSsl = $false
# $MailSmtpPasswordProtectedB64 = ''
# --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
# $ServerDisplayName = 'RDP-Server-01'
# --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
# $ServerIPv4 = '192.168.1.10'
# --- Security Alert Center (SAC) ---
# off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
$UseSAC = 'fallback'
$SacUrl = 'https://sac.example.com'
$SacApiKey = 'sac_CHANGE_ME'
$SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
$SacTimeoutSec = 45
$SacSpoolFlushMaxFiles = 50
$SacSpoolMaxAgeHours = 72
# $SacTlsSkipVerify = $false
# $SacFallbackFailures = 5
# $false = не слать report.daily.rdp с агента (суточный отчёт только из SAC)
# В settings.ps1 используйте 1/0 или $true/$false — не пишите голое false без $
$DailyReportEnabled = 1
# --- Heartbeat SAC (agent.heartbeat): интервал в секундах; 14400 = 4 ч ---
$HeartbeatInterval = 14400
# Оповещение, если last_heartbeat.txt не обновлялся > множитель × интервал (2 × 4 ч = 8 ч)
$HeartbeatStaleAlertMultiplier = 2
# Poll SAC на команды qwinsta/logoff (сек); см. security-alert-center/docs/agent-control-plane.md
# $SacCommandPollIntervalSec = 60
# Окно (мин): LastBootUpTime + System 41/1074/6005/6008/6009 → «старт после перезагрузки ОС»
$StartupRebootDetectMinutes = 5
# --- Инвентаризация железа/ПО для SAC (agent.inventory, раз в 12 ч) ---
$GetInventory = $true
# --- RDS Shadow Control + WinRM inbound (Enter-PSSession), severity warning ---
# $EnableRcm1149Monitoring = 1 # RCM Operational 1149 (RDP auth; workstation + RDS server)
# $EnableRcmShadowControlMonitoring = 1 # RCM Operational 20506/20507/20510
# $EnableWinRmInboundMonitoring = 1 # WinRM Operational 91 (+ correlate Security 4624)
# $EnableAdminShareMonitoring = 1 # Security 5140 C$/ADMIN$ (audit File Share)
# $WinRmIgnoreLocalSource = 1 # ::1, 127.0.0.1, fe80 (шум Exchange/локальный WinRM)
# $WinRmIgnoreMachineAccounts = 1 # учётки, оканчивающиеся на $
# $WinRmExchangeStrictMode = 1 # Exchange: user в Event 91 обязателен; 4624 только LogonProcess WinRM
# HealthMailbox* уже в ExcludedUserPatterns скрипта
# Проверка: powershell -File Login_Monitor.ps1 -CheckSac
# --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
$IgnoreAdvapiNetworkLogonSourceIps = @(
'192.168.1.10'
)
# --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
# Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
${Ignore4624-LT3-EmptyIP-Event} = $false
# --- Ротация login_monitor.log и хранение бэкапов (Logs\Backup\LoginLog_*.bak) ---
# $LogRotationHour = 0
# $LogRotationMinute = 0
$MaxBackupDays = 31
# --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
# Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
$LockoutMonitorDomainController = 'dc01.contoso.local'
$NetBiosDomainName = 'CONTOSO'
$ExchangeIisLogPath = '\\mail.contoso.local\c$\inetpub\logs\LogFiles\W3SVC1'
$ExchangeServerHostForIisExclude = ''
$ExchangeIisLogTailLines = 5000
$ExchangeIisLogMinutesBeforeLockout = 30
'@
Set-TrackedFileText -RelativePath 'login_monitor.settings.example.ps1' -Content $loginSettings
$exchangeSettingsPath = Join-Path $Root 'exchange_monitor.settings.example.ps1'
if (Test-Path -LiteralPath $exchangeSettingsPath) {
$ex = Get-Content -LiteralPath $exchangeSettingsPath -Raw
$ex = $ex -replace 'kalinamall\.ru', 'example.com'
$ex = $ex -replace 'fifth\.example\.com', 'mail.contoso.local'
$ex = $ex -replace 'k\.selezneva@example\.com', 'broken-mailbox@example.com'
Set-TrackedFileText -RelativePath 'exchange_monitor.settings.example.ps1' -Content $ex
}
$updatePath = Join-Path $Root 'update-rdp-monitor.ps1'
if (Test-Path -LiteralPath $updatePath) {
$upd = Get-Content -LiteralPath $updatePath -Raw
$upd = $upd -replace "Posle fetch: vsegda reset --hard na kalinamall/main \(bez merge\), zatem clean -fd\.",
'Posle fetch: reset --hard na upstream/main (bez merge), zatem clean -fd.'
$upd = $upd -replace "\\\\b26\\NETLOGON\\RDP-login-monitor", '\\dc.contoso.local\NETLOGON\RDP-login-monitor'
$upd = $upd -replace "https://git\.kalinamall\.ru/PapaTramp/RDP-login-monitor\.git",
'https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git'
Set-TrackedFileText -RelativePath 'update-rdp-monitor.ps1' -Content $upd
}
$netlogonDoc = Join-Path $Root 'Docs/deploy-netlogon-publish.md'
if (Test-Path -LiteralPath $netlogonDoc) {
$doc = Get-Content -LiteralPath $netlogonDoc -Raw
$doc = $doc -replace 'K6A-DC3', 'dc01.corp.example.com'
$doc = $doc -replace '\\\\b26\\', '\\dc.contoso.local\'
$doc = $doc -replace "https://git\.kalinamall\.ru/PapaTramp/RDP-login-monitor\.git",
'https://git.example.com/org/RDP-login-monitor.git'
Set-TrackedFileText -RelativePath 'Docs/deploy-netlogon-publish.md' -Content $doc
}
$mdFiles = @(git ls-files '*.md' 2>$null | Where-Object { $_ -and (Test-Path $_) })
foreach ($rel in $mdFiles) {
$path = Join-Path $Root $rel
$md = Get-Content -LiteralPath $path -Raw
$orig = $md
$md = $md -replace 'https://git\.kalinamall\.ru/PapaTramp/([^)/\s]+)/src/branch/main/', 'https://git.papatramp.ru/PapaTramp/$1/src/branch/main/'
$md = $md -replace 'https://git\.papatramp\.ru/PapaTramp/([^)/\s]+)/src/branch/main/', 'https://git.papatramp.ru/PapaTramp/$1/src/branch/main/'
$md = $md -replace 'https://git\.kalinamall\.ru/PapaTramp/', 'https://git.papatramp.ru/PapaTramp/'
$md = $md -replace 'https://git\.papatramp\.ru/PapaTramp/', 'https://git.papatramp.ru/PapaTramp/'
if ($md -ne $orig) {
Set-TrackedFileText -RelativePath $rel -Content $md
}
}
Write-Output 'Sanitize-ForGitHub: done'
+47
View File
@@ -0,0 +1,47 @@
# Fail if tracked text still contains production-only markers (run before GitHub push).
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root
$patterns = @(
'8239219522',
'sac_UkOsAT',
'2843230',
'sac\.kalinamall\.ru',
'\\\\b26\\',
'K6A-DC3',
'fifth\.kalinamall',
'192\.168\.160\.57',
'kalinamall\.ru',
'git\.kalinamall\.ru',
'git\.papatramp\.ru',
'\d{8,12}:[A-Za-z0-9_-]{20,}'
)
$extensions = @('*.md', '*.ps1', '*.example', '*.txt', '*.json', '*.yml', '*.yaml')
$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
$hits = @()
foreach ($file in $files) {
if ($file -like 'scripts/Rewrite-GitHostUrls.ps1') { continue }
if ($file -like 'scripts/Push-PrivateMirror.ps1') { continue }
if ($file -like 'scripts/Sanitize-ForGitHub.ps1') { continue }
if ($file -like 'scripts/Test-NoSecretsForGitHub.ps1') { continue }
if ($file -like 'scripts/Push-GitHubMirror.ps1') { continue }
if ($file -like 'scripts/Push-Mirror.ps1') { continue }
$text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue
if ([string]::IsNullOrEmpty($text)) { continue }
foreach ($pat in $patterns) {
if ($text -match $pat) {
$hits += "${file}: matches /$pat/"
}
}
}
if ($hits.Count -gt 0) {
Write-Error ("GitHub secret scan failed:`n" + ($hits -join "`n"))
}
Write-Output "GitHub secret scan: OK ($($files.Count) files)"