From f54284a0f9589458d010763681e82e8de0fde89a Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Sat, 25 Apr 2026 18:00:13 +0300 Subject: [PATCH] feat(docs-playbooks): update phase2 runbooks and add windows winrm rollout playbook --- README.md | 7 +- ansible/README.md | 23 +++++ ansible/deploy_aw_windows_phase2.yml | 107 ++++++++++++++++++++++ ansible/group_vars/windows.example.yml | 21 +++++ ansible/inventory.example.ini | 3 + docs/FULL_DEPLOYMENT_MANUAL_RU.md | 72 ++++++++------- docs/windows/deployment.md | 32 +++++++ docs/windows/ensemble.md | 8 +- docs/windows/troubleshooting.md | 22 +++++ docs/windows/validation.md | 25 +++++ windows/ActivityWatch.Windows.Common.psm1 | 2 +- windows/deploy-domain-users.ps1 | 2 +- windows/deploy-single-user.ps1 | 2 +- windows/validate-deployment.ps1 | 2 +- 14 files changed, 284 insertions(+), 44 deletions(-) create mode 100644 ansible/deploy_aw_windows_phase2.yml create mode 100644 ansible/group_vars/windows.example.yml diff --git a/README.md b/README.md index f31dfa8..cfeaaa6 100755 --- a/README.md +++ b/README.md @@ -13,8 +13,7 @@ - `proxmox/` — шаблонные скрипты подготовки и наполнения CT на стороне Proxmox. - `aw-server/` — установочные скрипты, env-шаблон, systemd unit и RU patch для Web UI. - `ansible/` — Ansible-ensemble для автоматизированного сервера (Debian/CT). -- `windows/` — PowerShell toolkit: single-user, domain-users, ensemble orchestration, hardening/recovery, validation. -- `windows/` — PowerShell toolkit + phase-2 DLP telemetry (`aw-dlp-incidents_*`, `aw-dlp-endpoint-signals_*`). +- `windows/` — PowerShell toolkit: single-user, domain-users, ensemble orchestration, hardening/recovery, validation, phase-2 DLP telemetry (`aw-dlp-incidents_*`, `aw-dlp-endpoint-signals_*`). - `scripts/quality-gate.sh` — локальный preflight-пайплайн проверок. ## Базовый сценарий @@ -34,6 +33,10 @@ - `ansible/provision_proxmox_ct_and_deploy_aw.yml` - `ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` (массово по матрице CT) +Для централизованного phase-2 деплоя Windows-клиентов через WinRM: + +- `ansible/deploy_aw_windows_phase2.yml` + Скрипты `proxmox/create-ct.sh` и `proxmox/push-aw-artifacts.sh` по умолчанию читают: - `secrets/deploy.secrets.env` diff --git a/ansible/README.md b/ansible/README.md index 393cd01..9132c93 100644 --- a/ansible/README.md +++ b/ansible/README.md @@ -4,16 +4,19 @@ - деплой на уже существующий Debian host/CT; - полный цикл с нуля в Proxmox: создание CT + bootstrap + установка ActivityWatch + RU patch. +- централизованный деплой Windows phase-2 collectors по WinRM. ## Файлы - `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_server.yml` — основной playbook. - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_and_deploy_aw.yml` — full-stack playbook для Proxmox. - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` — массовый full-stack playbook (несколько CT). +- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows_phase2.yml` — WinRM playbook для развёртывания phase-2 Windows collector'ов. - `/home/igor/tmp/AWatch-rus/ansible/inventory.example.ini` — шаблон inventory. - `/home/igor/tmp/AWatch-rus/ansible/group_vars/all.example.yml` — шаблон переменных. - `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.example.yml` — шаблон переменных CT в Proxmox. - `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox-matrix.example.yml` — шаблон матрицы CT. +- `/home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml` — шаблон переменных Windows phase-2. ## Быстрый запуск @@ -54,6 +57,26 @@ cd /home/igor/tmp/AWatch-rus/ansible ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml ``` +## Windows phase-2 rollout (WinRM) + +1. Подготовьте inventory и vars: + - `cp /home/igor/tmp/AWatch-rus/ansible/inventory.example.ini /home/igor/tmp/AWatch-rus/ansible/inventory.ini` + - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/windows.yml` +2. Заполните `inventory.ini` (секция `[aw_windows]`) и `group_vars/windows.yml`. +3. Запустите: + +```bash +cd /home/igor/tmp/AWatch-rus/ansible +ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml +``` + +Playbook: + +- выгружает `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`; +- выполняет `deploy-domain-users.ps1` с phase-2 policy/rules; +- запускает `validate-deployment.ps1`; +- забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation` по умолчанию). + ## Результат - Установлен ActivityWatch Server. diff --git a/ansible/deploy_aw_windows_phase2.yml b/ansible/deploy_aw_windows_phase2.yml new file mode 100644 index 0000000..9441f42 --- /dev/null +++ b/ansible/deploy_aw_windows_phase2.yml @@ -0,0 +1,107 @@ +--- +- name: Deploy AWatch-rus Windows phase2 collectors + hosts: aw_windows + gather_facts: false + + vars: + aw_windows_repo_root: "/home/igor/tmp/AWatch-rus" + aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus" + aw_windows_server_host: "10.10.10.13" + aw_windows_server_port: 5600 + aw_windows_domain: "SHARKON2025" + aw_windows_users: + - user1 + - user2 + - user3 + - user4 + - user5 + aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2" + aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2" + aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json" + aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json" + aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json" + aw_windows_validation_local_dir: "/tmp/aw-rus-validation" + + tasks: + - name: Validate required variables + ansible.builtin.assert: + that: + - aw_windows_server_host is defined + - aw_windows_server_port is defined + - aw_windows_domain is defined + - aw_windows_users | length > 0 + - aw_windows_install_root is defined + - aw_windows_state_root is defined + fail_msg: "Missing required Windows deployment variables." + + - name: Ensure deploy directories exist + ansible.windows.win_file: + path: "{{ item }}" + state: directory + loop: + - "{{ aw_windows_deploy_root }}" + - "{{ aw_windows_deploy_root }}\\windows" + + - name: Upload Windows deployment toolkit + ansible.windows.win_copy: + src: "{{ aw_windows_repo_root }}/windows/{{ item }}" + dest: "{{ aw_windows_deploy_root }}\\windows\\{{ item }}" + loop: + - ActivityWatch.Windows.Common.psd1 + - ActivityWatch.Windows.Common.psm1 + - browser-domains-native-collector.ps1 + - dlp-endpoint-signals-collector.ps1 + - deploy-domain-users.ps1 + - hardening-recovery.ps1 + - validate-deployment.ps1 + - web-category-rules.example.json + - dlp-policy.example.json + + - name: Upload user list for domain deploy + ansible.windows.win_copy: + dest: "{{ aw_windows_deploy_root }}\\windows\\users.txt" + content: | + {% for user in aw_windows_users -%} + {{ user }} + {% endfor -%} + + - name: Run phase2 domain deployment + ansible.windows.win_powershell: + script: | + $ErrorActionPreference = 'Stop' + & "{{ aw_windows_deploy_root }}\windows\deploy-domain-users.ps1" ` + -ServerHost "{{ aw_windows_server_host }}" ` + -ServerPort {{ aw_windows_server_port }} ` + -Domain "{{ aw_windows_domain }}" ` + -UserListPath "{{ aw_windows_deploy_root }}\windows\users.txt" ` + -InstallRoot "{{ aw_windows_install_root }}" ` + -StateRoot "{{ aw_windows_state_root }}" ` + -CustomRulesPath "{{ aw_windows_rules_path }}" ` + -CustomPolicyPath "{{ aw_windows_policy_path }}" + + - name: Run validation and store report on target + ansible.windows.win_powershell: + script: | + $ErrorActionPreference = 'Stop' + $report = & "{{ aw_windows_deploy_root }}\windows\validate-deployment.ps1" ` + -ConfigPath "{{ aw_windows_state_root }}\deployment-config.json" + $report | ConvertTo-Json -Depth 12 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8 + + - name: Ensure local validation directory exists + ansible.builtin.file: + path: "{{ aw_windows_validation_local_dir }}" + state: directory + mode: "0755" + delegate_to: localhost + + - name: Fetch validation report + ansible.builtin.fetch: + src: "{{ aw_windows_validation_remote_path }}" + dest: "{{ aw_windows_validation_local_dir }}/" + flat: false + + - name: Show report location + ansible.builtin.debug: + msg: + - "Windows phase2 deploy completed on {{ inventory_hostname }}." + - "Validation report: {{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}/C$/Windows/Temp/aw_validate_phase2_ansible.json" diff --git a/ansible/group_vars/windows.example.yml b/ansible/group_vars/windows.example.yml new file mode 100644 index 0000000..85c6a01 --- /dev/null +++ b/ansible/group_vars/windows.example.yml @@ -0,0 +1,21 @@ +aw_windows_repo_root: "/home/igor/tmp/AWatch-rus" +aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus" +aw_windows_server_host: "10.10.10.13" +aw_windows_server_port: 5600 +aw_windows_domain: "SHARKON2025" +aw_windows_users: + - user1 + - user2 + - user3 + - user4 + - user5 + +# Рекомендуемый изолированный профиль для фазового раската. +aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2" +aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2" + +aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json" +aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json" + +aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json" +aw_windows_validation_local_dir: "/tmp/aw-rus-validation" diff --git a/ansible/inventory.example.ini b/ansible/inventory.example.ini index 1376644..f73f446 100644 --- a/ansible/inventory.example.ini +++ b/ansible/inventory.example.ini @@ -3,3 +3,6 @@ pve-main ansible_host=192.168.10.2 ansible_user=root ansible_port=22 [aw_server] aw-ct ansible_host=10.20.30.13 ansible_user=root ansible_port=22 + +[aw_windows] +win-node1 ansible_host=192.168.100.21 ansible_user=Administrator ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore diff --git a/docs/FULL_DEPLOYMENT_MANUAL_RU.md b/docs/FULL_DEPLOYMENT_MANUAL_RU.md index 09b3cad..9c75936 100755 --- a/docs/FULL_DEPLOYMENT_MANUAL_RU.md +++ b/docs/FULL_DEPLOYMENT_MANUAL_RU.md @@ -6,20 +6,22 @@ ## 0) Структура проекта (полные пути) -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/create-ct.sh` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/push-aw-artifacts.sh` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/aw-server/install_aw_server.sh` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/aw-server/apply_webui_ru_patch.sh` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows/deploy-single-user.ps1` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows/deploy-domain-users.ps1` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows/deploy-ensemble.ps1` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows/hardening-recovery.ps1` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows/validate-deployment.ps1` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows/browser-domains-native-collector.ps1` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible/deploy_aw_server.yml` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible/provision_proxmox_ct_and_deploy_aw.yml` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` +- `/home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env` +- `/home/igor/tmp/AWatch-rus/proxmox/create-ct.sh` +- `/home/igor/tmp/AWatch-rus/proxmox/push-aw-artifacts.sh` +- `/home/igor/tmp/AWatch-rus/aw-server/install_aw_server.sh` +- `/home/igor/tmp/AWatch-rus/aw-server/apply_webui_ru_patch.sh` +- `/home/igor/tmp/AWatch-rus/windows/deploy-single-user.ps1` +- `/home/igor/tmp/AWatch-rus/windows/deploy-domain-users.ps1` +- `/home/igor/tmp/AWatch-rus/windows/deploy-ensemble.ps1` +- `/home/igor/tmp/AWatch-rus/windows/hardening-recovery.ps1` +- `/home/igor/tmp/AWatch-rus/windows/validate-deployment.ps1` +- `/home/igor/tmp/AWatch-rus/windows/browser-domains-native-collector.ps1` +- `/home/igor/tmp/AWatch-rus/windows/dlp-endpoint-signals-collector.ps1` +- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_server.yml` +- `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_and_deploy_aw.yml` +- `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` +- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows_phase2.yml` --- @@ -37,11 +39,11 @@ Скопируйте шаблон: ```bash -cp /mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env.example \ - /mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env +cp /home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env.example \ + /home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env ``` -Заполните в файле `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env`: +Заполните в файле `/home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env`: - все `CT_*` параметры контейнера; - все `AW_SERVER_*` параметры сервера; @@ -57,14 +59,14 @@ cp /mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env.examp Подготовьте: -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible/inventory.ini` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible/group_vars/all.yml` -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible/group_vars/proxmox.yml` +- `/home/igor/tmp/AWatch-rus/ansible/inventory.ini` +- `/home/igor/tmp/AWatch-rus/ansible/group_vars/all.yml` +- `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.yml` Запуск: ```bash -cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible +cd /home/igor/tmp/AWatch-rus/ansible ansible-playbook -i inventory.ini provision_proxmox_ct_and_deploy_aw.yml ``` @@ -79,7 +81,7 @@ ansible-playbook -i inventory.ini provision_proxmox_ct_and_deploy_aw.yml Для массового режима (несколько CT): ```bash -cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian/ansible +cd /home/igor/tmp/AWatch-rus/ansible ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml ``` @@ -88,25 +90,25 @@ ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml На узле Proxmox: ```bash -cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian -/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/create-ct.sh +cd /home/igor/tmp/AWatch-rus +/home/igor/tmp/AWatch-rus/proxmox/create-ct.sh ``` По умолчанию читается: -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env` +- `/home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env` При необходимости можно передать другой путь: ```bash -/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/create-ct.sh /absolute/path/to/deploy.secrets.env +/home/igor/tmp/AWatch-rus/proxmox/create-ct.sh /absolute/path/to/deploy.secrets.env ``` ### 2.2 Загрузить bootstrap-артефакты и env внутрь CT ```bash -cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian -/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/push-aw-artifacts.sh +cd /home/igor/tmp/AWatch-rus +/home/igor/tmp/AWatch-rus/proxmox/push-aw-artifacts.sh ``` Скрипт загружает в CT: @@ -158,7 +160,7 @@ grep -n 'aw-ru-patch\|aw-sw-cleanup' /opt/activitywatch/webui-ru/index.html Скопируйте каталог: -- `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/windows` +- `/home/igor/tmp/AWatch-rus/windows` например в: @@ -315,11 +317,11 @@ pct exec -- tar -C / -czf /root/activitywatch-config-backup.tgz \ ### 6.2 Обновление сервера 1. Обновить `AW_SERVER_VERSION` и `AW_SERVER_DOWNLOAD_URL` в - `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env` + `/home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env` 2. Выполнить: ```bash -/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/push-aw-artifacts.sh +/home/igor/tmp/AWatch-rus/proxmox/push-aw-artifacts.sh pct enter bash /root/bootstrap/install_aw_server.sh bash /root/bootstrap/apply_webui_ru_patch.sh @@ -347,7 +349,7 @@ systemctl restart activitywatch-server.service ## 7) Безопасность -- Не хранить реальные секреты вне `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env`. +- Не хранить реальные секреты вне `/home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env`. - Не открывать `5600/tcp` в интернет напрямую. - Публиковать через VPN или reverse proxy с ограничением доступа. - Перед изменениями всегда делать backup. @@ -356,9 +358,9 @@ systemctl restart activitywatch-server.service ## 8) Короткий чек-лист ввода в эксплуатацию -1. Заполнен `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/secrets/deploy.secrets.env`. -2. Выполнен `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/create-ct.sh`. -3. Выполнен `/mnt/usb_hdd2/Projects/ActivityWatch-Russian/proxmox/push-aw-artifacts.sh`. +1. Заполнен `/home/igor/tmp/AWatch-rus/secrets/deploy.secrets.env`. +2. Выполнен `/home/igor/tmp/AWatch-rus/proxmox/create-ct.sh`. +3. Выполнен `/home/igor/tmp/AWatch-rus/proxmox/push-aw-artifacts.sh`. 4. В CT выполнены `/root/bootstrap/install_aw_server.sh` и `/root/bootstrap/apply_webui_ru_patch.sh`. 5. Сервер API/порт/UI проверены. 6. На Windows выполнен `deploy-domain-users.ps1`. diff --git a/docs/windows/deployment.md b/docs/windows/deployment.md index 731bb08..b94f018 100755 --- a/docs/windows/deployment.md +++ b/docs/windows/deployment.md @@ -21,6 +21,7 @@ - Создаёт системную задачу `ActivityWatch Recovery`, которая циклически перезапускает per-user launch tasks. - Применяет ACL к `C:\Program Files\ActivityWatch`, `C:\ProgramData\ActivityWatch` и каталогу логов. - Не содержит хардкодов инфраструктуры: сервер, домен, список пользователей и правила передаются параметрами. +- Корректно регистрирует задачи через `-LogonType Interactive` (совместимо с Windows Server, где `InteractiveToken` не поддерживается). ## Предпосылки @@ -95,6 +96,35 @@ CSV-формат: колонка `User`, `Username`, `SamAccountName` или `Lo Если список уже содержит `DOMAIN\user`, параметр `-Domain` не нужен. +## Рекомендуемый phased rollout (изолированный профиль) + +Для безопасного параллельного запуска рядом с legacy-инсталляцией используйте отдельные пути: + +```powershell +.\windows\deploy-domain-users.ps1 ` + -ServerHost 10.10.10.13 ` + -ServerPort 5600 ` + -Domain SHARKON2025 ` + -Users user2,user3,user4,user5 ` + -InstallRoot 'C:\Program Files\ActivityWatch-Phase2-u2u5' ` + -StateRoot 'C:\ProgramData\ActivityWatch-Phase2-u2u5' ` + -CustomRulesPath C:\Deploy\AWatch-rus\windows\web-category-rules.example.json ` + -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json +``` + +Single-user pilot в таком же стиле: + +```powershell +.\windows\deploy-single-user.ps1 ` + -ServerHost 10.10.10.13 ` + -ServerPort 5600 ` + -TargetUser 'SHARKON2025\user1' ` + -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' ` + -StateRoot 'C:\ProgramData\ActivityWatch-Phase2-user1' ` + -CustomRulesPath C:\Deploy\AWatch-rus\windows\web-category-rules.example.json ` + -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json +``` + ## Ensemble deploy (production workflow) ```powershell @@ -129,6 +159,8 @@ CSV-формат: колонка `User`, `Username`, `SamAccountName` или `Lo - `C:\ProgramData\ActivityWatch\dlp-policy.json` — активная DLP-политика. - `C:\ProgramData\ActivityWatch\logs\` — логи collector'а. +Для phased rollout те же файлы формируются в каталоге `StateRoot`, переданном параметром. + ## Повторный прогон - Скрипты идемпотентны: переустанавливают задачи и обновляют runtime-файлы. diff --git a/docs/windows/ensemble.md b/docs/windows/ensemble.md index abb1a6c..93b44a3 100644 --- a/docs/windows/ensemble.md +++ b/docs/windows/ensemble.md @@ -20,8 +20,10 @@ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 ` -ServerHost 10.10.10.13 ` -ServerPort 5600 ` - -Domain AD ` + -Domain SHARKON2025 ` -Users user1,user2,user3,user4,user5 ` + -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' ` + -StateRoot 'C:\ProgramData\ActivityWatch-Phase2' ` -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json ` -ValidateAfterDeploy ``` @@ -32,13 +34,13 @@ C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 ` 2. Вызывает массовый деплой `deploy-domain-users.ps1`. 3. Применяет hardening/recovery (`hardening-recovery.ps1`), если не задан `-SkipHardening`. 4. Опционально запускает контроль (`validate-deployment.ps1`) при `-ValidateAfterDeploy`. -5. Пишет итоговый JSON-отчёт в `C:\ProgramData\ActivityWatch\ensemble-report-*.json`. +5. Пишет итоговый JSON-отчёт в `\ensemble-report-*.json`. ## Быстрый health-check ```powershell $report = C:\Deploy\AWatch-rus\windows\validate-deployment.ps1 ` - -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json + -ConfigPath C:\ProgramData\ActivityWatch-Phase2\deployment-config.json $report | ConvertTo-Json -Depth 12 ``` diff --git a/docs/windows/troubleshooting.md b/docs/windows/troubleshooting.md index 0b3e487..6e0c631 100755 --- a/docs/windows/troubleshooting.md +++ b/docs/windows/troubleshooting.md @@ -64,6 +64,28 @@ Start-ScheduledTask -TaskName 'ActivityWatch Launch [CONTOSO_user01]' - Если сервер и пользователи уже есть в `deployment-config.json`, дополнительные параметры не нужны. +### Ошибка `InvalidVariableReferenceWithDrive` (в строке `Server: http://...`) + +Симптом: + +- деплой падает на выводе URL сервера с ошибкой о недопустимой ссылке на переменную. + +Решение: + +- обновить скрипты до версии, где используется `${ServerScheme}` в строке вывода; +- перезалить `deploy-single-user.ps1` / `deploy-domain-users.ps1` на целевой хост. + +### Ошибка `LogonType InteractiveToken` при регистрации задач + +Симптом: + +- `Register-ActivityWatchUserTasks` падает с ошибкой преобразования enum для `LogonType`. + +Решение: + +- использовать версию `ActivityWatch.Windows.Common.psm1`, где `LogonType` задан как `Interactive`; +- повторно запустить deploy/hardening после обновления модуля. + ## Диагностика Проверить задачи: diff --git a/docs/windows/validation.md b/docs/windows/validation.md index f40521a..74660c2 100755 --- a/docs/windows/validation.md +++ b/docs/windows/validation.md @@ -8,6 +8,8 @@ $report = .\windows\validate-deployment.ps1 ` $report | ConvertTo-Json -Depth 12 ``` +Примечание: валидатор проверяет задачи через полный список Task Scheduler и корректно обрабатывает имена с квадратными скобками (`ActivityWatch Launch [DOMAIN_user]`). + Критерий: - `overallOk = true` @@ -38,6 +40,13 @@ Get-ScheduledTask -TaskName 'ActivityWatch*' | - по одной задаче `ActivityWatch Launch [...]` на пользователя; - одна задача `ActivityWatch Recovery`. +Точечная проверка: + +```powershell +Get-ScheduledTask | Where-Object TaskName -eq 'ActivityWatch Launch [SHARKON2025_user1]' +Get-ScheduledTask | Where-Object TaskName -eq 'ActivityWatch Recovery' +``` + ### 3. Проверить процессы после логина пользователя ```powershell @@ -100,6 +109,22 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/buckets | Select-Object -Ex Get-Content "C:\ProgramData\ActivityWatch\logs\dlp-incidents-$env:USERNAME.log" -Tail 50 ``` +## Проверка phase-2 endpoint signals + +1. Скопируйте любой текст в буфер обмена. +2. Отправьте тестовую печать (любой принтер/виртуальный PDF). +3. Проверьте endpoint bucket: + +```powershell +Invoke-WebRequest http://aw.example.local:5600/api/0/buckets/aw-dlp-endpoint-signals_/events?limit=20 +``` + +4. Проверьте локальный лог: + +```powershell +Get-Content "C:\ProgramData\ActivityWatch\logs\endpoint-signals-$env:USERNAME.log" -Tail 50 +``` + ## Проверка восстановления 1. Завершите `aw-watcher-afk.exe` и `aw-watcher-window.exe` у тестового пользователя. diff --git a/windows/ActivityWatch.Windows.Common.psm1 b/windows/ActivityWatch.Windows.Common.psm1 index ccf8cbe..6f89508 100755 --- a/windows/ActivityWatch.Windows.Common.psm1 +++ b/windows/ActivityWatch.Windows.Common.psm1 @@ -572,7 +572,7 @@ function Register-ActivityWatchUserTasks { $action = New-ScheduledTaskAction -Execute $powershellExe -Argument "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$LaunchScriptPath`" -ConfigPath `"$ConfigPath`"" $trigger = New-ScheduledTaskTrigger -AtLogOn -User $definition.UserId - $principal = New-ScheduledTaskPrincipal -UserId $definition.UserId -LogonType InteractiveToken -RunLevel Highest + $principal = New-ScheduledTaskPrincipal -UserId $definition.UserId -LogonType Interactive -RunLevel Highest $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 0) Register-ScheduledTask -TaskName $definition.LaunchTaskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings | Out-Null diff --git a/windows/deploy-domain-users.ps1 b/windows/deploy-domain-users.ps1 index 89c1727..0f0e0f3 100755 --- a/windows/deploy-domain-users.ps1 +++ b/windows/deploy-domain-users.ps1 @@ -88,6 +88,6 @@ Start-ActivityWatchTasks -TaskDefinitions $taskDefinitions -RecoveryTaskName $co Write-Host 'ActivityWatch deployed for users:' $targetUsers | ForEach-Object { Write-Host " - $_" } -Write-Host "Server: $ServerScheme://$ServerHost`:$ServerPort" +Write-Host "Server: ${ServerScheme}://$ServerHost`:$ServerPort" Write-Host "State root: $StateRoot" Write-Host "Policy file: $($assetResult.ActivePolicy)" diff --git a/windows/deploy-single-user.ps1 b/windows/deploy-single-user.ps1 index 0a94b5a..4267314 100755 --- a/windows/deploy-single-user.ps1 +++ b/windows/deploy-single-user.ps1 @@ -85,7 +85,7 @@ Register-ActivityWatchRecoveryTask -TaskName $config.recovery.taskName -Recovery Start-ActivityWatchTasks -TaskDefinitions $taskDefinitions -RecoveryTaskName $config.recovery.taskName Write-Host "ActivityWatch deployed for $TargetUser" -Write-Host "Server: $ServerScheme://$ServerHost`:$ServerPort" +Write-Host "Server: ${ServerScheme}://$ServerHost`:$ServerPort" Write-Host "Install root: $InstallRoot" Write-Host "State root: $StateRoot" Write-Host "Rules file: $($assetResult.ActiveRules)" diff --git a/windows/validate-deployment.ps1 b/windows/validate-deployment.ps1 index 9a405f1..71e93a0 100644 --- a/windows/validate-deployment.ps1 +++ b/windows/validate-deployment.ps1 @@ -46,7 +46,7 @@ $taskNames += [string]$config.recovery.taskName $taskNames = $taskNames | Sort-Object -Unique $tasks = foreach ($taskName in $taskNames) { - $task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue + $task = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -eq $taskName } | Select-Object -First 1 if ($task) { [pscustomobject]@{ taskName = $task.TaskName