feat(docs-playbooks): update phase2 runbooks and add windows winrm rollout playbook

2026-04-25 18:00:13 +03:00
parent bf27369b2a
commit f54284a0f9
14 changed files with 284 additions and 44 deletions
@@ -4,16 +4,19 @@

 - деплой на уже существующий Debian host/CT;
 - полный цикл с нуля в Proxmox: создание CT + bootstrap + установка ActivityWatch + RU patch.
+- централизованный деплой Windows phase-2 collectors по WinRM.

 ## Файлы

 - `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_server.yml` — основной playbook.
 - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_and_deploy_aw.yml` — full-stack playbook для Proxmox.
 - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` — массовый full-stack playbook (несколько CT).
+- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows_phase2.yml` — WinRM playbook для развёртывания phase-2 Windows collector'ов.
 - `/home/igor/tmp/AWatch-rus/ansible/inventory.example.ini` — шаблон inventory.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/all.example.yml` — шаблон переменных.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.example.yml` — шаблон переменных CT в Proxmox.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox-matrix.example.yml` — шаблон матрицы CT.
+- `/home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml` — шаблон переменных Windows phase-2.

 ## Быстрый запуск

@@ -54,6 +57,26 @@ cd /home/igor/tmp/AWatch-rus/ansible
 ansible-playbook -i inventory.ini provision_proxmox_ct_matrix_and_deploy_aw.yml
 ```

+## Windows phase-2 rollout (WinRM)
+
+1. Подготовьте inventory и vars:
+   - `cp /home/igor/tmp/AWatch-rus/ansible/inventory.example.ini /home/igor/tmp/AWatch-rus/ansible/inventory.ini`
+   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/windows.yml`
+2. Заполните `inventory.ini` (секция `[aw_windows]`) и `group_vars/windows.yml`.
+3. Запустите:
+
+```bash
+cd /home/igor/tmp/AWatch-rus/ansible
+ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml
+```
+
+Playbook:
+
+- выгружает `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`;
+- выполняет `deploy-domain-users.ps1` с phase-2 policy/rules;
+- запускает `validate-deployment.ps1`;
+- забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation` по умолчанию).
+
 ## Результат

 - Установлен ActivityWatch Server.
@@ -0,0 +1,107 @@
+---
+- name: Deploy AWatch-rus Windows phase2 collectors
+  hosts: aw_windows
+  gather_facts: false
+
+  vars:
+    aw_windows_repo_root: "/home/igor/tmp/AWatch-rus"
+    aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+    aw_windows_server_host: "10.10.10.13"
+    aw_windows_server_port: 5600
+    aw_windows_domain: "SHARKON2025"
+    aw_windows_users:
+      - user1
+      - user2
+      - user3
+      - user4
+      - user5
+    aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
+    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+    aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
+    aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
+    aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+    aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
+
+  tasks:
+    - name: Validate required variables
+      ansible.builtin.assert:
+        that:
+          - aw_windows_server_host is defined
+          - aw_windows_server_port is defined
+          - aw_windows_domain is defined
+          - aw_windows_users | length > 0
+          - aw_windows_install_root is defined
+          - aw_windows_state_root is defined
+        fail_msg: "Missing required Windows deployment variables."
+
+    - name: Ensure deploy directories exist
+      ansible.windows.win_file:
+        path: "{{ item }}"
+        state: directory
+      loop:
+        - "{{ aw_windows_deploy_root }}"
+        - "{{ aw_windows_deploy_root }}\\windows"
+
+    - name: Upload Windows deployment toolkit
+      ansible.windows.win_copy:
+        src: "{{ aw_windows_repo_root }}/windows/{{ item }}"
+        dest: "{{ aw_windows_deploy_root }}\\windows\\{{ item }}"
+      loop:
+        - ActivityWatch.Windows.Common.psd1
+        - ActivityWatch.Windows.Common.psm1
+        - browser-domains-native-collector.ps1
+        - dlp-endpoint-signals-collector.ps1
+        - deploy-domain-users.ps1
+        - hardening-recovery.ps1
+        - validate-deployment.ps1
+        - web-category-rules.example.json
+        - dlp-policy.example.json
+
+    - name: Upload user list for domain deploy
+      ansible.windows.win_copy:
+        dest: "{{ aw_windows_deploy_root }}\\windows\\users.txt"
+        content: |
+          {% for user in aw_windows_users -%}
+          {{ user }}
+          {% endfor -%}
+
+    - name: Run phase2 domain deployment
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          & "{{ aw_windows_deploy_root }}\windows\deploy-domain-users.ps1" `
+            -ServerHost "{{ aw_windows_server_host }}" `
+            -ServerPort {{ aw_windows_server_port }} `
+            -Domain "{{ aw_windows_domain }}" `
+            -UserListPath "{{ aw_windows_deploy_root }}\windows\users.txt" `
+            -InstallRoot "{{ aw_windows_install_root }}" `
+            -StateRoot "{{ aw_windows_state_root }}" `
+            -CustomRulesPath "{{ aw_windows_rules_path }}" `
+            -CustomPolicyPath "{{ aw_windows_policy_path }}"
+
+    - name: Run validation and store report on target
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $report = & "{{ aw_windows_deploy_root }}\windows\validate-deployment.ps1" `
+            -ConfigPath "{{ aw_windows_state_root }}\deployment-config.json"
+          $report | ConvertTo-Json -Depth 12 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8
+
+    - name: Ensure local validation directory exists
+      ansible.builtin.file:
+        path: "{{ aw_windows_validation_local_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+
+    - name: Fetch validation report
+      ansible.builtin.fetch:
+        src: "{{ aw_windows_validation_remote_path }}"
+        dest: "{{ aw_windows_validation_local_dir }}/"
+        flat: false
+
+    - name: Show report location
+      ansible.builtin.debug:
+        msg:
+          - "Windows phase2 deploy completed on {{ inventory_hostname }}."
+          - "Validation report: {{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}/C$/Windows/Temp/aw_validate_phase2_ansible.json"
@@ -0,0 +1,21 @@
+aw_windows_repo_root: "/home/igor/tmp/AWatch-rus"
+aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+aw_windows_server_host: "10.10.10.13"
+aw_windows_server_port: 5600
+aw_windows_domain: "SHARKON2025"
+aw_windows_users:
+  - user1
+  - user2
+  - user3
+  - user4
+  - user5
+
+# Рекомендуемый изолированный профиль для фазового раската.
+aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
+aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+
+aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
+aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
+
+aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
@@ -3,3 +3,6 @@ pve-main ansible_host=192.168.10.2 ansible_user=root ansible_port=22

 [aw_server]
 aw-ct ansible_host=10.20.30.13 ansible_user=root ansible_port=22
+
+[aw_windows]
+win-node1 ansible_host=192.168.100.21 ansible_user=Administrator ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore