chore(install-kit): rebuild awindows package

install-kit-awindows-20260427-211240/ansible/README.md

@@ -89,6 +89,12 @@ ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml
 
 ## Windows/RDP rollout (WinRM)
 
+Важно:
+
+- `WinRM` здесь остаётся транспортом для `Ansible deploy` и `validation`;
+- для интерактивной PowerShell-работы из Linux/Codex по DetMir используйте project MCP-over-SSH путь, а не `WSMan`;
+- каноника лежит в `docs/DETMIR_POWERSHELL_MCP_REMOTE_RU.md` и `scripts/install_detmir_powershell_mcp.sh`.
+
 1. Подготовьте inventory и vars:
    - `cp ansible/inventory.example.ini ansible/inventory.ini`
    - `cp ansible/group_vars/windows.example.yml ansible/group_vars/windows.yml`
@@ -122,6 +128,7 @@ Playbook:
 - выполняет API smoke-check bucket `aw-watcher-window_<COMPUTERNAME>` и ожидает свежие события (по умолчанию включено);
 - запускает `validate-deployment.ps1`;
 - забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation-<USER>` по умолчанию).
+- настраивает scheduled task `ActivityWatch Hayabusa Upload` с периодом и lookback по vars.
 
 Дополнительные флаги:
 
@@ -144,6 +151,38 @@ Playbook:
 - `aw_windows_api_smoke_check_min_events: 1` — минимум событий, ожидаемых в smoke-check;
 - `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
 - `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
+- `aw_windows_hayabusa_auto_upload_enabled: true` — включить авто-upload EVTX на AW-server;
+- `aw_windows_hayabusa_auto_upload_interval_hours: 6` — период scheduled task;
+- `aw_windows_hayabusa_auto_upload_hours_back: 6` — lookback для каждого запуска;
+- `aw_windows_hayabusa_auto_upload_mode: "incident"` — mode для server-side processing;
+- `aw_windows_hayabusa_auto_upload_task_name: "ActivityWatch Hayabusa Upload"` — имя scheduled task.
+
+## Server-side Hayabusa auto-case и Telegram alerting
+
+На стороне `deploy_aw_server.yml` теперь есть server-side контур:
+
+- `aw-hayabusa-drop.path`
+- `aw-hayabusa-drop.service`
+- `aw-hayabusa-autoprocess`
+- `aw-hayabusa-case-alert`
+
+Что делает контур:
+
+- автоматически подхватывает `zip` из `/opt/activitywatch/aw-rus-ops/drop`;
+- запускает `aw-hayabusa`;
+- считает severity/score по `timeline.jsonl`;
+- создаёт или обновляет case;
+- пишет bounded metadata в `forensics.hayabusa`;
+- отправляет Telegram alert.
+
+Основные vars:
+
+- `aw_hayabusa_auto_case_enabled: true`
+- `aw_hayabusa_auto_case_min_severity: "medium"`
+- `aw_hayabusa_telegram_enabled: true`
+- `aw_hayabusa_telegram_min_severity: "high"`
+- `aw_hayabusa_telegram_bot_token`
+- `aw_hayabusa_telegram_chat_ids`
 
 ## Развёртывание pfSense poller
 

install-kit-awindows-20260427-211240/ansible/deploy_aw_server.yml

@@ -94,6 +94,89 @@
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
 
+    - name: Установить prune script для локального state
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/aw-server/aw-prune-local-state.sh"
+        dest: /usr/local/bin/aw-prune-local-state.sh
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Ограничить рост journald на aw-server
+      ansible.builtin.copy:
+        dest: /etc/systemd/journald.conf.d/aw-rus-retention.conf
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Journal]
+          SystemMaxUse={{ aw_server_journal_system_max_use }}
+          RuntimeMaxUse={{ aw_server_journal_runtime_max_use }}
+          SystemKeepFree={{ aw_server_journal_system_keep_free }}
+      register: aw_journald_dropin
+
+    - name: Установить systemd service prune локального state
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/aw-prune-local-state.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Prune ActivityWatch local backups and temp state
+
+          [Service]
+          Type=oneshot
+          Environment=AW_DATA_DIR={{ aw_server_data_dir }}
+          Environment=AW_BACKUP_RETENTION_DAYS={{ aw_server_backup_retention_days }}
+          Environment=AW_BACKUP_KEEP_LAST_DB={{ aw_server_backup_keep_last_db }}
+          Environment=AW_BACKUP_KEEP_LAST_JSON={{ aw_server_backup_keep_last_json }}
+          ExecStart=/usr/local/bin/aw-prune-local-state.sh
+
+    - name: Установить systemd timer prune локального state
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/aw-prune-local-state.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Daily prune of ActivityWatch local backups and temp state
+
+          [Timer]
+          OnCalendar=*-*-* 04:40:00
+          Persistent=true
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Перечитать systemd после retention unit/drop-in
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Включить и запустить timer prune локального state
+      ansible.builtin.systemd:
+        name: aw-prune-local-state.timer
+        enabled: true
+        state: started
+
+    - name: Применить journald retention без простоя
+      ansible.builtin.command:
+        argv:
+          - systemctl
+          - restart
+          - systemd-journald
+      when: aw_journald_dropin.changed
+      failed_when: false
+
+    - name: Сжать существующий journald до нового лимита
+      ansible.builtin.command:
+        argv:
+          - journalctl
+          - --vacuum-size={{ aw_server_journal_system_max_use }}
+      changed_when: true
+      failed_when: false
+
     - name: (Check mode) Пропустить установку релиза ActivityWatch
       ansible.builtin.debug:
         msg: "ansible_check_mode=true: download/unarchive/install of ActivityWatch release is skipped."
@@ -115,6 +198,11 @@
             remote_src: true
             extra_opts: ["-o"]
 
+        - name: Удалить временный архив ActivityWatch после распаковки
+          ansible.builtin.file:
+            path: "{{ aw_archive_path }}"
+            state: absent
+
         - name: Найти распакованный каталог ActivityWatch
           ansible.builtin.find:
             paths: "{{ aw_release_dir }}"
@@ -288,6 +376,22 @@
             dest: /opt/activitywatch/aw-server/apply_webui_ru_patch.sh
             mode: "0755"
 
+        - name: Проверить Influx token для AW worktime exporter
+          ansible.builtin.assert:
+            that:
+              - aw_worktime_influx_token is defined
+              - aw_worktime_influx_token | length > 0
+            fail_msg: "aw_worktime_influx_enabled=true, но aw_worktime_influx_token пуст. Exporter будет падать и Grafana не получит worktime-ряды."
+          when: aw_worktime_influx_enabled | default(false) | bool
+
+        - name: Проверить Influx token для AW DLP exporter
+          ansible.builtin.assert:
+            that:
+              - aw_dlp_influx_token is defined
+              - aw_dlp_influx_token | length > 0
+            fail_msg: "aw_dlp_influx_enabled=true, но aw_dlp_influx_token пуст. Exporter будет падать и Grafana не получит DLP-ряды."
+          when: aw_dlp_influx_enabled | default(false) | bool
+
         - name: Записать /etc/activitywatch/aw-server.env перед хотфиксами
           ansible.builtin.copy:
             dest: /etc/activitywatch/aw-server.env
@@ -340,8 +444,16 @@
               AW_HEALTH_STRICT_FILEOPS={{ aw_health_strict_fileops | default(0) }}
               AW_MONITORED_WINDOWS_HOST={{ aw_monitored_windows_host }}
               AW_MONITORED_WINDOWS_HOSTNAME={{ aw_monitored_windows_hostname }}
+              AW_RUS_HEALTH_WORKTIME_API={{ aw_rus_health_worktime_api_base | default('http://127.0.0.1:5610') }}
               AW_RUS_HEALTH_STATE_DIR={{ aw_rus_health_state_dir }}
               AW_RUS_HEALTH_VALIDATION_DIR={{ aw_rus_health_validation_dir }}
+              AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS={{ aw_rus_health_session_events_max_age_seconds | default(86400) }}
+              AW_HAYABUSA_AUTO_CASE_ENABLED={{ 'true' if (aw_hayabusa_auto_case_enabled | default(true) | bool) else 'false' }}
+              AW_HAYABUSA_AUTO_CASE_MIN_SEVERITY={{ aw_hayabusa_auto_case_min_severity | default('medium') }}
+              AW_HAYABUSA_TELEGRAM_ENABLED={{ 'true' if (aw_hayabusa_telegram_enabled | default(false) | bool) else 'false' }}
+              AW_HAYABUSA_TELEGRAM_MIN_SEVERITY={{ aw_hayabusa_telegram_min_severity | default('high') }}
+              AW_HAYABUSA_TELEGRAM_BOT_TOKEN={{ aw_hayabusa_telegram_bot_token | default('') }}
+              AW_HAYABUSA_TELEGRAM_CHAT_IDS={{ aw_hayabusa_telegram_chat_ids | default('') }}
 
         - name: Создать каталог DLP policy engine
           ansible.builtin.file:
@@ -914,7 +1026,6 @@
           ansible.builtin.systemd:
             name: aw-worktime-influx-exporter.service
             state: started
-          failed_when: false
           when: aw_worktime_influx_enabled | default(false) | bool
 
         - name: Включить и перезапустить AW DLP Influx exporter timer
@@ -928,7 +1039,6 @@
           ansible.builtin.systemd:
             name: aw-dlp-influx-exporter.service
             state: started
-          failed_when: false
           when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Применить хотфиксы compiled JS чанков (Trends, Timespiral, Category helper)
@@ -1506,6 +1616,11 @@
             remote_src: true
             creates: "{{ aw_hayabusa_release_dir }}/{{ aw_hayabusa_binary_name }}"
 
+        - name: Удалить временный архив Hayabusa после распаковки
+          ansible.builtin.file:
+            path: "{{ aw_hayabusa_archive_path }}"
+            state: absent
+
         - name: Нормализовать права release Hayabusa
           ansible.builtin.file:
             path: "{{ aw_hayabusa_release_dir }}"
@@ -1545,6 +1660,124 @@
             group: root
             mode: "0755"
 
+        - name: Создать server-side ops bundle для Hayabusa
+          ansible.builtin.file:
+            path: "{{ item }}"
+            state: directory
+            owner: root
+            group: root
+            mode: "0755"
+          loop:
+            - /opt/activitywatch/aw-rus-ops
+            - /opt/activitywatch/aw-rus-ops/hayabusa
+            - /opt/activitywatch/aw-rus-ops/ansible
+            - /opt/activitywatch/aw-rus-ops/drop
+
+        - name: Положить исходный wrapper в server-side ops bundle
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa.sh"
+            dest: /opt/activitywatch/aw-rus-ops/hayabusa/aw-hayabusa.sh
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить helper link-case для Hayabusa
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-link-case.py"
+            dest: /usr/local/bin/aw-hayabusa-link-case
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Положить helper link-case в server-side ops bundle
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-link-case.py"
+            dest: /opt/activitywatch/aw-rus-ops/hayabusa/aw-hayabusa-link-case.py
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить helper from-windows для Hayabusa
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-from-windows.py"
+            dest: /usr/local/bin/aw-hayabusa-from-windows
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Положить helper from-windows в server-side ops bundle
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-from-windows.py"
+            dest: /opt/activitywatch/aw-rus-ops/hayabusa/aw-hayabusa-from-windows.py
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Положить README Hayabusa в server-side ops bundle
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/README.md"
+            dest: /opt/activitywatch/aw-rus-ops/hayabusa/README.md
+            owner: root
+            group: root
+            mode: "0644"
+
+        - name: Установить helper autoprocess для Hayabusa
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-autoprocess.py"
+            dest: /usr/local/bin/aw-hayabusa-autoprocess
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Положить helper autoprocess в server-side ops bundle
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-autoprocess.py"
+            dest: /opt/activitywatch/aw-rus-ops/hayabusa/aw-hayabusa-autoprocess.py
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить helper case-alert для Hayabusa
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-case-alert.py"
+            dest: /usr/local/bin/aw-hayabusa-case-alert
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Положить helper case-alert в server-side ops bundle
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/hayabusa/aw-hayabusa-case-alert.py"
+            dest: /opt/activitywatch/aw-rus-ops/hayabusa/aw-hayabusa-case-alert.py
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить systemd unit aw-hayabusa-drop.service
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/aw-hayabusa-drop.service"
+            dest: /etc/systemd/system/aw-hayabusa-drop.service
+            owner: root
+            group: root
+            mode: "0644"
+          notify: Перезагрузить systemd
+
+        - name: Установить systemd unit aw-hayabusa-drop.path
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/aw-hayabusa-drop.path"
+            dest: /etc/systemd/system/aw-hayabusa-drop.path
+            owner: root
+            group: root
+            mode: "0644"
+          notify: Перезагрузить systemd
+
+        - name: Включить и запустить aw-hayabusa-drop.path
+          ansible.builtin.systemd:
+            name: aw-hayabusa-drop.path
+            enabled: true
+            state: started
+            daemon_reload: true
+
         - name: Проверить server-side runner через doctor
           ansible.builtin.command:
             cmd: /usr/local/bin/aw-hayabusa doctor
@@ -1572,6 +1805,7 @@
             cmd: /usr/local/bin/aw-rus-healthd.py --json
           register: aw_post_deploy_health
           changed_when: false
+          failed_when: false
 
         - name: Показать результат aw-rus-healthd
           ansible.builtin.debug:

install-kit-awindows-20260427-211240/ansible/deploy_aw_windows.yml

@@ -9,12 +9,12 @@
     aw_windows_repo_root: "{{ playbook_dir | dirname }}"
     aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
     aw_windows_server_scheme: "http"
-    aw_windows_server_host: "10.10.10.13"
     aw_windows_server_port: 5600
     aw_windows_package_version: "v0.13.2"
     aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
     aw_windows_package_zip_path: ""
     aw_windows_domain: "SHARKON2025"
+    aw_windows_builtin_administrator_name: "Администратор"
     aw_windows_users:
       - Администратор
       - user1
@@ -29,9 +29,18 @@
     aw_windows_policy_mode: "server"
     aw_windows_policy_refresh_seconds: 300
     aw_windows_policy_engine_enabled: true
-    aw_windows_policy_engine_host: "{{ aw_windows_server_host }}"
     aw_windows_policy_engine_port: 5601
     aw_windows_policy_engine_scheme: "http"
+    aw_windows_hayabusa_auto_upload_enabled: true
+    aw_windows_hayabusa_auto_upload_interval_hours: 6
+    aw_windows_hayabusa_auto_upload_hours_back: 6
+    aw_windows_hayabusa_auto_upload_mode: "incident"
+    aw_windows_hayabusa_auto_upload_task_name: "ActivityWatch Hayabusa Upload"
+    aw_windows_file_1c_auto_upload_enabled: true
+    aw_windows_file_1c_auto_upload_interval_hours: 6
+    aw_windows_file_1c_auto_upload_task_name: "ActivityWatch File1C Upload"
+    aw_windows_file_1c_target_user: "igor"
+    aw_windows_file_1c_registry_workbook_path: "E:\\USER1\\СПИСОК ПРЕДПРИЯТИЙ И ИХ РАСПРЕДЕЛЕНИЕ.xlsx"
     aw_windows_afk_enabled_default: true
     aw_windows_window_enabled_default: true
     aw_windows_file_ops_enabled: true
@@ -41,6 +50,7 @@
     aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
     aw_windows_forensics_root: "{{ aw_windows_state_root }}\\forensics\\evtx-exports"
     aw_windows_logon_marker_enabled: true
+    aw_windows_process_events_enabled: true
     aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
     aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
@@ -62,16 +72,79 @@
     aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"
 
   tasks:
+    - name: Вычислить inventory host AW server по умолчанию
+      ansible.builtin.set_fact:
+        aw_server_inventory_host_effective: "{{ (groups['aw_server'] | default([]) | first) | default('', true) }}"
+
+    - name: Вычислить inventory host analytics node по умолчанию
+      ansible.builtin.set_fact:
+        aw_analytics_inventory_host_effective: "{{ (groups['proxmox'] | default([]) | first) | default('', true) }}"
+
+    - name: Вычислить effective host для AW server
+      ansible.builtin.set_fact:
+        aw_windows_server_host_effective: >-
+          {{
+            aw_windows_server_host
+            | default(
+                (
+                  hostvars[aw_server_inventory_host_effective].ansible_host
+                  | default(aw_server_inventory_host_effective, true)
+                )
+                if (aw_server_inventory_host_effective | length) > 0
+                else '',
+                true
+              )
+          }}
+
+    - name: Вычислить effective каталог health validation на AW server
+      ansible.builtin.set_fact:
+        aw_windows_health_validation_dir_effective: >-
+          {{
+            (
+              hostvars[aw_server_inventory_host_effective].aw_rus_health_validation_dir
+              | default('/var/lib/activitywatch/health/windows-validation', true)
+            )
+            if (aw_server_inventory_host_effective | length) > 0
+            else ''
+          }}
+
+    - name: Вычислить effective host для policy engine
+      ansible.builtin.set_fact:
+        aw_windows_policy_engine_host_effective: >-
+          {{
+            aw_windows_policy_engine_host
+            | default(aw_windows_server_host_effective, true)
+          }}
+
+    - name: Вычислить effective host для file-1C analytics
+      ansible.builtin.set_fact:
+        aw_windows_file_1c_target_host_effective: >-
+          {{
+            aw_windows_file_1c_target_host
+            | default(
+                (
+                  hostvars[aw_analytics_inventory_host_effective].ansible_host
+                  | default(aw_analytics_inventory_host_effective, true)
+                )
+                if (aw_analytics_inventory_host_effective | length) > 0
+                else '',
+                true
+              )
+          }}
+
     - name: Проверить обязательные переменные
       ansible.builtin.assert:
         that:
-          - aw_windows_server_host is defined
+          - aw_windows_server_host_effective | length > 0
           - aw_windows_server_port is defined
           - aw_windows_server_scheme is defined
           - aw_windows_domain is defined
+          - aw_windows_builtin_administrator_name is defined
+          - aw_windows_builtin_administrator_name | length > 0
           - aw_windows_users_effective | length > 0
           - aw_windows_install_root is defined
           - aw_windows_state_root is defined
+          - (not (aw_windows_file_1c_auto_upload_enabled | bool)) or (aw_windows_file_1c_target_host_effective | length > 0)
         fail_msg: "Не заданы обязательные переменные Windows-развёртывания."
 
     - name: Нормализовать effective флаги collector'ов и smoke-check
@@ -102,11 +175,14 @@
         - file-operations-collector.ps1
         - worktime-session-collector.ps1
         - export-evtx-for-hayabusa.ps1
+        - export-upload-hayabusa-to-aw-server.ps1
+        - export-upload-file-1c-telemetry.ps1
         - migrate-awatch-rus-paths.ps1
         - deploy-domain-users.ps1
         - deploy-ensemble.ps1
         - hardening-recovery.ps1
         - rebuild-worktime-tasks.ps1
+        - audit-cryptopro.ps1
         - validate-deployment.ps1
         - web-category-rules.example.json
         - dlp-policy.example.json
@@ -156,9 +232,10 @@
       ansible.windows.win_powershell:
         script: |
           $ErrorActionPreference = 'Stop'
+          $env:AWATCH_RUS_BUILTIN_ADMINISTRATOR_NAME = "{{ aw_windows_builtin_administrator_name }}"
           $params = @{
             ServerScheme = "{{ aw_windows_server_scheme }}"
-            ServerHost = "{{ aw_windows_server_host }}"
+            ServerHost = "{{ aw_windows_server_host_effective }}"
             ServerPort = {{ aw_windows_server_port }}
             Version = "{{ aw_windows_package_version }}"
             Domain = "{{ aw_windows_domain }}"
@@ -175,12 +252,24 @@
             EvtxExportRoot = "{{ aw_windows_forensics_root }}"
             EvtxRetentionDays = {{ aw_windows_evtx_retention_days | int }}
             LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
+            ProcessEventsEnabled = {{ '$true' if (aw_windows_process_events_enabled | bool) else '$false' }}
             PolicyMode = "{{ aw_windows_policy_mode }}"
             PolicyEngineEnabled = {{ '$true' if (aw_windows_policy_engine_enabled | bool) else '$false' }}
-            PolicyEngineHost = "{{ aw_windows_policy_engine_host }}"
+            PolicyEngineHost = "{{ aw_windows_policy_engine_host_effective }}"
             PolicyEnginePort = {{ aw_windows_policy_engine_port }}
             PolicyEngineScheme = "{{ aw_windows_policy_engine_scheme }}"
             PolicyRefreshSeconds = {{ aw_windows_policy_refresh_seconds }}
+            HayabusaAutoUploadEnabled = {{ '$true' if (aw_windows_hayabusa_auto_upload_enabled | bool) else '$false' }}
+            HayabusaAutoUploadIntervalHours = {{ aw_windows_hayabusa_auto_upload_interval_hours | int }}
+            HayabusaAutoUploadHoursBack = {{ aw_windows_hayabusa_auto_upload_hours_back | int }}
+            HayabusaAutoUploadMode = "{{ aw_windows_hayabusa_auto_upload_mode }}"
+            HayabusaAutoUploadTaskName = "{{ aw_windows_hayabusa_auto_upload_task_name }}"
+            File1CAutoUploadEnabled = {{ '$true' if (aw_windows_file_1c_auto_upload_enabled | bool) else '$false' }}
+            File1CAutoUploadIntervalHours = {{ aw_windows_file_1c_auto_upload_interval_hours | int }}
+            File1CAutoUploadTaskName = "{{ aw_windows_file_1c_auto_upload_task_name }}"
+            File1CTargetHost = "{{ aw_windows_file_1c_target_host_effective }}"
+            File1CTargetUser = "{{ aw_windows_file_1c_target_user }}"
+            File1CRegistryWorkbookPath = "{{ aw_windows_file_1c_registry_workbook_path }}"
             CustomRulesPath = "{{ aw_windows_rules_path }}"
             CustomPolicyPath = "{{ aw_windows_policy_path }}"
           }
@@ -340,7 +429,7 @@
       when:
         - aw_windows_api_smoke_check_enabled | bool
       ansible.builtin.uri:
-        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
+        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host_effective }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
         method: GET
         status_code: 200
         return_content: true
@@ -367,7 +456,7 @@
         - aw_windows_api_smoke_check_window_enabled_effective | bool
         - aw_windows_window_enabled_effective | bool
       ansible.builtin.uri:
-        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_window_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
+        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host_effective }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_window_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
         method: GET
         status_code: 200
         return_content: true
@@ -404,6 +493,26 @@
         dest: "{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"
         flat: true
 
+    - name: Убедиться, что каталог Windows validation существует на AW server
+      when:
+        - aw_server_inventory_host_effective | length > 0
+        - aw_windows_health_validation_dir_effective | length > 0
+      ansible.builtin.file:
+        path: "{{ aw_windows_health_validation_dir_effective }}"
+        state: directory
+        mode: "0755"
+      delegate_to: "{{ aw_server_inventory_host_effective }}"
+
+    - name: Опубликовать validation report на AW server для aw-rus-healthd
+      when:
+        - aw_server_inventory_host_effective | length > 0
+        - aw_windows_health_validation_dir_effective | length > 0
+      ansible.builtin.copy:
+        src: "{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"
+        dest: "{{ aw_windows_health_validation_dir_effective }}/{{ inventory_hostname }}-aw_validate_ansible.json"
+        mode: "0644"
+      delegate_to: "{{ aw_server_inventory_host_effective }}"
+
     - name: Проверить статус валидации
       ansible.builtin.shell: |
         python3 - <<'PY'

install-kit-awindows-20260427-211240/ansible/group_vars/all.example.yml

@@ -8,7 +8,9 @@ aw_server_db_path: "/var/lib/activitywatch/.local/share/activitywatch/aw-server-
 aw_server_log_dir: "/var/log/activitywatch"
 aw_server_user: "activitywatch"
 aw_server_group: "activitywatch"
-aw_worktime_report_base: "http://10.10.10.13:5610"
+aw_server_inventory_host: "{{ (groups['aw_server'] | default([]) | first) | default('aw-server', true) }}"
+aw_server_public_host: "{{ (hostvars[aw_server_inventory_host].ansible_host | default(aw_server_inventory_host, true)) if (aw_server_inventory_host | length) > 0 else 'aw-server' }}"
+aw_worktime_report_base: "http://{{ aw_server_public_host }}:5610"
 aw_worktime_timezone: "Europe/Moscow"
 aw_worktime_influx_enabled: false
 aw_worktime_influx_url: "http://10.10.10.10:8086"
@@ -27,8 +29,15 @@ aw_dlp_influx_event_limit: 2000
 aw_dlp_influx_token: ""
 aw_monitored_windows_host: "192.168.100.18"
 aw_monitored_windows_hostname: "SHARKON2025"
+aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_hayabusa_auto_case_enabled: true
+aw_hayabusa_auto_case_min_severity: "medium"
+aw_hayabusa_telegram_enabled: true
+aw_hayabusa_telegram_min_severity: "high"
+aw_hayabusa_telegram_bot_token: ""
+aw_hayabusa_telegram_chat_ids: ""
 
 aw_repo_root: "{{ playbook_dir | dirname }}"
 
@@ -41,7 +50,7 @@ aw_apply_worktime_settings: true
 aw_server_cors_origins:
   - "http://127.0.0.1:5600"
   - "http://localhost:5600"
-  - "http://10.10.10.13:5600"
+  - "http://{{ aw_server_public_host }}:5600"
   - "http://aw-server:5600"
 
 # Опциональные значения периода рабочего времени в Web UI.

install-kit-awindows-20260427-211240/ansible/group_vars/pfsense-poller.example.yml

@@ -12,16 +12,16 @@ aw_pfsense_poller_config:
     scheme: "https"
     verify_tls: false
     timeout_seconds: 15
-    headers:
-      X-API-Key: "replace-me"
-      X-API-Secret: "replace-me"
+    auth:
+      api_key: "replace-me"
+      api_secret: "replace-me"
   endpoints:
     - name: "system-status"
       path: "/api/v2/status/system"
       bucket_prefix: "aw-pfsense-health"
       bucket_type: "aw.pfsense.health"
     - name: "interfaces"
-      path: "/api/v2/interface"
+      path: "/api/v2/interfaces"
       bucket_prefix: "aw-pfsense-interfaces"
       bucket_type: "aw.pfsense.interfaces"
     - name: "gateways"

install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml

@@ -1,12 +1,22 @@
 aw_windows_repo_root: "{{ playbook_dir | dirname }}"
 aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
 aw_windows_server_scheme: "http"
-aw_windows_server_host: "10.10.10.13"
+# Leave empty to derive from the first host in [aw_server] inventory.
+aw_windows_server_host: ""
 aw_windows_server_port: 5600
+aw_windows_hayabusa_auto_upload_enabled: false
+aw_windows_hayabusa_auto_upload_interval_hours: 6
+aw_windows_hayabusa_auto_upload_hours_back: 6
+aw_windows_hayabusa_auto_upload_mode: "incident"
+aw_windows_hayabusa_auto_upload_task_name: "ActivityWatch Hayabusa Upload"
 aw_windows_package_version: "v0.13.2"
 aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
 aw_windows_package_zip_path: ""
 aw_windows_domain: "SHARKON2025"
+# Localized name of the built-in local Administrator account (SID ending in -500).
+# On the current Russian Windows host this must stay "Администратор";
+# do not replace it with "Administrator" unless the target OS account is actually named that way.
+aw_windows_builtin_administrator_name: "Администратор"
 aw_windows_users:
   - Администратор
   - user1
@@ -40,6 +50,7 @@ aw_windows_evtx_channels:
   - Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
   - Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
 aw_windows_logon_marker_enabled: true
+aw_windows_process_events_enabled: true
 aw_windows_skip_hardening: false
 
 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"