fix(ansible): align ensemble rollout with current windows deploy

ansible/README.md

@@ -73,10 +73,16 @@ ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml
 Playbook:
 
 - выгружает `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`;
-- выполняет `deploy-domain-users.ps1` с phase-2 policy/rules;
+- выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с phase-2 policy/rules;
 - запускает `validate-deployment.ps1`;
 - забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation` по умолчанию).
 
+Дополнительные флаги:
+
+- `aw_windows_afk_enabled: false` — не запускать `aw-watcher-afk`;
+- `aw_windows_window_enabled: false` — не запускать `aw-watcher-window`;
+- `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
+
 ## Результат
 
 - Установлен ActivityWatch Server.

ansible/deploy_aw_windows_phase2.yml

@@ -17,6 +17,9 @@
       - user5
     aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
     aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+    aw_windows_afk_enabled: true
+    aw_windows_window_enabled: true
+    aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
     aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
     aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
@@ -52,6 +55,7 @@
         - browser-domains-native-collector.ps1
         - dlp-endpoint-signals-collector.ps1
         - deploy-domain-users.ps1
+        - deploy-ensemble.ps1
         - hardening-recovery.ps1
         - validate-deployment.ps1
         - web-category-rules.example.json
@@ -65,19 +69,26 @@
           {{ user }}
           {% endfor -%}
 
-    - name: Run phase2 domain deployment
+    - name: Run phase2 ensemble deployment
       ansible.windows.win_powershell:
         script: |
           $ErrorActionPreference = 'Stop'
-          & "{{ aw_windows_deploy_root }}\windows\deploy-domain-users.ps1" `
-            -ServerHost "{{ aw_windows_server_host }}" `
-            -ServerPort {{ aw_windows_server_port }} `
-            -Domain "{{ aw_windows_domain }}" `
-            -UserListPath "{{ aw_windows_deploy_root }}\windows\users.txt" `
-            -InstallRoot "{{ aw_windows_install_root }}" `
-            -StateRoot "{{ aw_windows_state_root }}" `
-            -CustomRulesPath "{{ aw_windows_rules_path }}" `
-            -CustomPolicyPath "{{ aw_windows_policy_path }}"
+          $params = @{
+            ServerHost = "{{ aw_windows_server_host }}"
+            ServerPort = {{ aw_windows_server_port }}
+            Domain = "{{ aw_windows_domain }}"
+            UserListPath = "{{ aw_windows_deploy_root }}\windows\users.txt"
+            InstallRoot = "{{ aw_windows_install_root }}"
+            StateRoot = "{{ aw_windows_state_root }}"
+            AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
+            WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
+            CustomRulesPath = "{{ aw_windows_rules_path }}"
+            CustomPolicyPath = "{{ aw_windows_policy_path }}"
+          }
+          {% if aw_windows_skip_hardening | bool %}
+          $params.SkipHardening = $true
+          {% endif %}
+          & "{{ aw_windows_deploy_root }}\windows\deploy-ensemble.ps1" @params
 
     - name: Run validation and store report on target
       ansible.windows.win_powershell:

ansible/group_vars/windows.example.yml

@@ -13,6 +13,9 @@ aw_windows_users:
 # Рекомендуемый изолированный профиль для фазового раската.
 aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
 aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+aw_windows_afk_enabled: true
+aw_windows_window_enabled: true
+aw_windows_skip_hardening: false
 
 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
 aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"