chore(install-kit): rebuild awindows package

2026-05-29 06:46:19 +03:00
parent e4a25ab9c0
commit 09e58b4170
30 changed files with 4534 additions and 452 deletions
@@ -9,12 +9,12 @@
    aw_windows_repo_root: "{{ playbook_dir | dirname }}"
    aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
    aw_windows_server_scheme: "http"
-    aw_windows_server_host: "10.10.10.13"
    aw_windows_server_port: 5600
    aw_windows_package_version: "v0.13.2"
    aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
    aw_windows_package_zip_path: ""
    aw_windows_domain: "SHARKON2025"
+    aw_windows_builtin_administrator_name: "Администратор"
    aw_windows_users:
      - Администратор
      - user1
@@ -29,9 +29,18 @@
    aw_windows_policy_mode: "server"
    aw_windows_policy_refresh_seconds: 300
    aw_windows_policy_engine_enabled: true
-    aw_windows_policy_engine_host: "{{ aw_windows_server_host }}"
    aw_windows_policy_engine_port: 5601
    aw_windows_policy_engine_scheme: "http"
+    aw_windows_hayabusa_auto_upload_enabled: true
+    aw_windows_hayabusa_auto_upload_interval_hours: 6
+    aw_windows_hayabusa_auto_upload_hours_back: 6
+    aw_windows_hayabusa_auto_upload_mode: "incident"
+    aw_windows_hayabusa_auto_upload_task_name: "ActivityWatch Hayabusa Upload"
+    aw_windows_file_1c_auto_upload_enabled: true
+    aw_windows_file_1c_auto_upload_interval_hours: 6
+    aw_windows_file_1c_auto_upload_task_name: "ActivityWatch File1C Upload"
+    aw_windows_file_1c_target_user: "igor"
+    aw_windows_file_1c_registry_workbook_path: "E:\\USER1\\СПИСОК ПРЕДПРИЯТИЙ И ИХ РАСПРЕДЕЛЕНИЕ.xlsx"
    aw_windows_afk_enabled_default: true
    aw_windows_window_enabled_default: true
    aw_windows_file_ops_enabled: true
@@ -41,6 +50,7 @@
    aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
    aw_windows_forensics_root: "{{ aw_windows_state_root }}\\forensics\\evtx-exports"
    aw_windows_logon_marker_enabled: true
+    aw_windows_process_events_enabled: true
    aw_windows_skip_hardening: false
    aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
    aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
@@ -62,16 +72,79 @@
    aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"

  tasks:
+    - name: Вычислить inventory host AW server по умолчанию
+      ansible.builtin.set_fact:
+        aw_server_inventory_host_effective: "{{ (groups['aw_server'] | default([]) | first) | default('', true) }}"
+
+    - name: Вычислить inventory host analytics node по умолчанию
+      ansible.builtin.set_fact:
+        aw_analytics_inventory_host_effective: "{{ (groups['proxmox'] | default([]) | first) | default('', true) }}"
+
+    - name: Вычислить effective host для AW server
+      ansible.builtin.set_fact:
+        aw_windows_server_host_effective: >-
+          {{
+            aw_windows_server_host
+            | default(
+                (
+                  hostvars[aw_server_inventory_host_effective].ansible_host
+                  | default(aw_server_inventory_host_effective, true)
+                )
+                if (aw_server_inventory_host_effective | length) > 0
+                else '',
+                true
+              )
+          }}
+
+    - name: Вычислить effective каталог health validation на AW server
+      ansible.builtin.set_fact:
+        aw_windows_health_validation_dir_effective: >-
+          {{
+            (
+              hostvars[aw_server_inventory_host_effective].aw_rus_health_validation_dir
+              | default('/var/lib/activitywatch/health/windows-validation', true)
+            )
+            if (aw_server_inventory_host_effective | length) > 0
+            else ''
+          }}
+
+    - name: Вычислить effective host для policy engine
+      ansible.builtin.set_fact:
+        aw_windows_policy_engine_host_effective: >-
+          {{
+            aw_windows_policy_engine_host
+            | default(aw_windows_server_host_effective, true)
+          }}
+
+    - name: Вычислить effective host для file-1C analytics
+      ansible.builtin.set_fact:
+        aw_windows_file_1c_target_host_effective: >-
+          {{
+            aw_windows_file_1c_target_host
+            | default(
+                (
+                  hostvars[aw_analytics_inventory_host_effective].ansible_host
+                  | default(aw_analytics_inventory_host_effective, true)
+                )
+                if (aw_analytics_inventory_host_effective | length) > 0
+                else '',
+                true
+              )
+          }}
+
    - name: Проверить обязательные переменные
      ansible.builtin.assert:
        that:
-          - aw_windows_server_host is defined
+          - aw_windows_server_host_effective | length > 0
          - aw_windows_server_port is defined
          - aw_windows_server_scheme is defined
          - aw_windows_domain is defined
+          - aw_windows_builtin_administrator_name is defined
+          - aw_windows_builtin_administrator_name | length > 0
          - aw_windows_users_effective | length > 0
          - aw_windows_install_root is defined
          - aw_windows_state_root is defined
+          - (not (aw_windows_file_1c_auto_upload_enabled | bool)) or (aw_windows_file_1c_target_host_effective | length > 0)
        fail_msg: "Не заданы обязательные переменные Windows-развёртывания."

    - name: Нормализовать effective флаги collector'ов и smoke-check
@@ -102,11 +175,14 @@
        - file-operations-collector.ps1
        - worktime-session-collector.ps1
        - export-evtx-for-hayabusa.ps1
+        - export-upload-hayabusa-to-aw-server.ps1
+        - export-upload-file-1c-telemetry.ps1
        - migrate-awatch-rus-paths.ps1
        - deploy-domain-users.ps1
        - deploy-ensemble.ps1
        - hardening-recovery.ps1
        - rebuild-worktime-tasks.ps1
+        - audit-cryptopro.ps1
        - validate-deployment.ps1
        - web-category-rules.example.json
        - dlp-policy.example.json
@@ -156,9 +232,10 @@
      ansible.windows.win_powershell:
        script: |
          $ErrorActionPreference = 'Stop'
+          $env:AWATCH_RUS_BUILTIN_ADMINISTRATOR_NAME = "{{ aw_windows_builtin_administrator_name }}"
          $params = @{
            ServerScheme = "{{ aw_windows_server_scheme }}"
-            ServerHost = "{{ aw_windows_server_host }}"
+            ServerHost = "{{ aw_windows_server_host_effective }}"
            ServerPort = {{ aw_windows_server_port }}
            Version = "{{ aw_windows_package_version }}"
            Domain = "{{ aw_windows_domain }}"
@@ -175,12 +252,24 @@
            EvtxExportRoot = "{{ aw_windows_forensics_root }}"
            EvtxRetentionDays = {{ aw_windows_evtx_retention_days | int }}
            LogonMarkerEnabled = {{ '$true' if (aw_windows_logon_marker_enabled | bool) else '$false' }}
+            ProcessEventsEnabled = {{ '$true' if (aw_windows_process_events_enabled | bool) else '$false' }}
            PolicyMode = "{{ aw_windows_policy_mode }}"
            PolicyEngineEnabled = {{ '$true' if (aw_windows_policy_engine_enabled | bool) else '$false' }}
-            PolicyEngineHost = "{{ aw_windows_policy_engine_host }}"
+            PolicyEngineHost = "{{ aw_windows_policy_engine_host_effective }}"
            PolicyEnginePort = {{ aw_windows_policy_engine_port }}
            PolicyEngineScheme = "{{ aw_windows_policy_engine_scheme }}"
            PolicyRefreshSeconds = {{ aw_windows_policy_refresh_seconds }}
+            HayabusaAutoUploadEnabled = {{ '$true' if (aw_windows_hayabusa_auto_upload_enabled | bool) else '$false' }}
+            HayabusaAutoUploadIntervalHours = {{ aw_windows_hayabusa_auto_upload_interval_hours | int }}
+            HayabusaAutoUploadHoursBack = {{ aw_windows_hayabusa_auto_upload_hours_back | int }}
+            HayabusaAutoUploadMode = "{{ aw_windows_hayabusa_auto_upload_mode }}"
+            HayabusaAutoUploadTaskName = "{{ aw_windows_hayabusa_auto_upload_task_name }}"
+            File1CAutoUploadEnabled = {{ '$true' if (aw_windows_file_1c_auto_upload_enabled | bool) else '$false' }}
+            File1CAutoUploadIntervalHours = {{ aw_windows_file_1c_auto_upload_interval_hours | int }}
+            File1CAutoUploadTaskName = "{{ aw_windows_file_1c_auto_upload_task_name }}"
+            File1CTargetHost = "{{ aw_windows_file_1c_target_host_effective }}"
+            File1CTargetUser = "{{ aw_windows_file_1c_target_user }}"
+            File1CRegistryWorkbookPath = "{{ aw_windows_file_1c_registry_workbook_path }}"
            CustomRulesPath = "{{ aw_windows_rules_path }}"
            CustomPolicyPath = "{{ aw_windows_policy_path }}"
          }
@@ -340,7 +429,7 @@
      when:
        - aw_windows_api_smoke_check_enabled | bool
      ansible.builtin.uri:
-        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
+        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host_effective }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
        method: GET
        status_code: 200
        return_content: true
@@ -367,7 +456,7 @@
        - aw_windows_api_smoke_check_window_enabled_effective | bool
        - aw_windows_window_enabled_effective | bool
      ansible.builtin.uri:
-        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_window_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
+        url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host_effective }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_window_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
        method: GET
        status_code: 200
        return_content: true
@@ -404,6 +493,26 @@
        dest: "{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"
        flat: true

+    - name: Убедиться, что каталог Windows validation существует на AW server
+      when:
+        - aw_server_inventory_host_effective | length > 0
+        - aw_windows_health_validation_dir_effective | length > 0
+      ansible.builtin.file:
+        path: "{{ aw_windows_health_validation_dir_effective }}"
+        state: directory
+        mode: "0755"
+      delegate_to: "{{ aw_server_inventory_host_effective }}"
+
+    - name: Опубликовать validation report на AW server для aw-rus-healthd
+      when:
+        - aw_server_inventory_host_effective | length > 0
+        - aw_windows_health_validation_dir_effective | length > 0
+      ansible.builtin.copy:
+        src: "{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json"
+        dest: "{{ aw_windows_health_validation_dir_effective }}/{{ inventory_hostname }}-aw_validate_ansible.json"
+        mode: "0644"
+      delegate_to: "{{ aw_server_inventory_host_effective }}"
+
    - name: Проверить статус валидации
      ansible.builtin.shell: |
        python3 - <<'PY'